Tools

openbreach/canop

Static analysis CLI that scans AI-generated code for vulnerabilities like SQL injection, unsafe reflection, and hardcoded secrets, with SARIF export…

bearer/bearer

Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.

coffeeandsecurity/dakshscra

Framework-aware static code analysis tool for automated source code review with platform-specific rules, taint analysis, effort estimation, and…

semgrep/semgrep

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

securego/gosec

Go security checker

aquasecurity/trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

checkmarx/kics

Static analysis scanner for infrastructure-as-code that detects security vulnerabilities, compliance violations, and misconfigurations across…

osmankandemir/static-code-analysis-helper

Scans project source code across 16 languages to flag dangerous functions linked to SQLi, XSS, SSRF, command injection, weak crypto, and other web…

gmh5225/actions-secrets

Adding this GitHub Action will scan your repository for sensitive data in your source code. We find things like passwords, server host strings, API…

xoreaxeaxeax/schrodingers-toctou

Detect compiler-invented memory loads that turn secure C into TOCTOU vulnerabilities. Includes automated source audits, Unicorn-based binary…

zupit/horusec

Horusec is an open source tool that improves identification of vulnerabilities in your project with just one command.

cc1a2b/jshunter

jshunter is a command-line tool designed for analyzing JavaScript files and extracting endpoints. This tool specializes in identifying sensitive…

elttam/semgrep-rules

Static analysis security rules for vulnerability detection and audit-focused code review across Java, Go, Python, C#, Kotlin, PHP, Kubernetes, and…

mgechev/ngrev

Tool for reverse engineering of Angular applications

0x999-x/jsluicepp

jsluice++ is a Burp Suite extension designed for passive and active scanning of JavaScript traffic using the CLI tool jsluice

squid-protocol1/gitgalaxy

AST-free heuristic knowledge graph engine for deep repository intelligence and zero-trust security scanning. Integrates as a GitLab CI/CD component,…

patrickdeanramos/cve-2024-41302-bookea-tu-mesa-is-vulnerable-to-sql-injection

Bookea-tu-Mesa is vulnerable to SQL Injection

mustafabilgici/sucoshscanny

"Sucosh" is an automated Source Code vulnerability scanner and assessment framework for Python(Flask-Django) & NodeJs capable of performing code…