Tools

xoreaxeaxeax/schrodingers-toctou

Detect compiler-invented memory loads that turn secure C into TOCTOU vulnerabilities. Includes automated source audits, Unicorn-based binary…

0xdea/ghidra-scripts

Curated Ghidra scripts to automate reverse engineering and vulnerability analysis: locate insecure functions, extract decompiler pseudocode, fix…

offensive360/mcp-server

MCP server that runs SAST scans on local codebases and returns findings with severity and fixes, enabling AI assistants to perform security analysis…

offensive360/sast-scan-action

GitHub Action for Offensive360 SAST scans and SARIF results. See the open-source program for eligibility and setup.

elttam/semgrep-rules

Static analysis security rules for vulnerability detection and audit-focused code review across Java, Go, Python, C#, Kotlin, PHP, Kubernetes, and…

niffyhunt/codeguard-copilot

AI-powered security co-pilot that catches vulnerabilities as you code. Real-time security scanning, educational explanations, and auto fixes for…

0p4n1k/noctyra

AST-based Python code transformation & deobfuscation framework

slowql/slowql

Next-generation SQL static analyzer written in Rust. 282+ rules. Zero false positives. Security, performance, reliability, cost, compliance, quality.…

pantheon-security/medusa

AI-first security scanner. NEW in v2026.7: Claude Code compromise detection — vet .claude/ hooks, permissions & skills before you clone — plus an…

martyx00/vulnfanatic-ng

BianryNinja plugin for identifying vulnerabilities in decompiled binaries with both programmatic scans and LLM support.

sonarsource/sonarcloud-scan

A Bitbucket Pipe to trigger SonarCloud analysis

roninforge/roninforge-hono

Cursor plugin for Hono v4 (TypeScript edge web framework). 59 LLM regressions with BAD/CORRECT pairs. Pinned to hono ^4.12.19 (>= 4.9.7 for…

whgojp/javaseclab

Comprehensive Java vulnerability lab with vulnerable and fixed code, attack scenarios, source/sink audit notes, and secure coding guidance for…

zegl/kube-score

Kubernetes object analysis with recommendations for improved reliability and security. kube-score actively prevents downtime and bugs in your…

david-a-wheeler/flawfinder

a static analysis tool for finding vulnerabilities in C/C++ source code

bk-security/auth-header-trust-rules

Semgrep rules that flag header-trust auth bypass patterns (CVE-2025-29927 class). Companion to bk-security.github.io.

trailofbits/multiplier

Indexes C/C++ build artifacts into a queryable whole-program database, exposing AST, token, and IR-level APIs for code auditing and vulnerability…