Tools

nccgroup/vcg

VisualCodeGrepper - Code security scanning tool.

vincentcox/stacoan

StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications.

zegl/kube-score

Kubernetes object analysis with recommendations for improved reliability and security. kube-score actively prevents downtime and bugs in your…

pantheon-security/medusa

AI-first security scanner. NEW in v2026.7: Claude Code compromise detection — vet .claude/ hooks, permissions & skills before you clone — plus an…

nightwatchcybersecurity/airflowscan

Checklist and tools for increasing security of Apache Airflow

nccgroup/secretscrub

Processes SARIF output from static analysis tools to detect and redact hard-coded secrets in source code, creating a clean copy without the original…

atlassian/git-secrets-scan

Scans Git repositories for hardcoded secrets, keys, and passwords using Gitleaks, integrating security into Bitbucket Pipelines with Code Insights…

olacabs/jackhammer

Jackhammer - One Security vulnerability assessment/management tool to solve all the security team problems.

slowql/slowql

Next-generation SQL static analyzer written in Rust. 282+ rules. Zero false positives. Security, performance, reliability, cost, compliance, quality.…

stelligent/cfn_nag

Linting tool for CloudFormation templates

sonatype-nexus-community/devaudit

Open-source, cross-platform, multi-purpose security auditing tool

github/codeql

CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security

owasp/riskassessmentframework

The Secure Coding Framework

iqtlabs/auraborealisapp

Do You Know What's In Your Python Packages? A Tool for Visualizing Python Package Registry Security Audit Data

ajinabraham/njsscan

Semantic-aware SAST scanner for Node.js applications that detects insecure code patterns using libsast pattern matching and semgrep syntax-aware…

designsecurity/progpilot

PHP static application security testing (SAST) tool that performs taint analysis to detect XSS, SQL injection, and other vulnerabilities using…

mustafabilgici/sucoshscanny

"Sucosh" is an automated Source Code vulnerability scanner and assessment framework for Python(Flask-Django) & NodeJs capable of performing code…

sonarsource/sonarqube

Code-quality and static-analysis platform with quality gates, multi-language scanning, and security-focused rules to detect vulnerabilities and…