codeql
github/codeqlCodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security
code-analysisdevsecopsstatic-code-analysis+1
10.2k
github/codeqlCodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security
sonarsource/sonarqubeCode-quality and static-analysis platform with quality gates, multi-language scanning, and security-focused rules to detect vulnerabilities and…
ossf/scorecardOpenSSF Scorecard - Security health metrics for Open Source
hahwul/dalfoxFast XSS scanner with parameter analysis, WAF fingerprinting, and DOM/AST verification. Supports reflected, stored, and DOM-based XSS detection via…
owasp/asvsApplication Security Verification Standard
pizlonator/fil-cFil-C: completely compatible memory safety for C and C++
akha-security/akcaEvidence-oriented DAST scanner in Go that crawls web apps and APIs, then runs adaptive SQLi, XSS, RCE, SSRF, and auth checks with replayable proof.
9pings/fad-checkerBuildless dependency auditor that scans 10 ecosystems offline, reporting CVEs prioritized by CISA KEV and EPSS, EOL packages, licenses, committed…
owasp-noir/alibiCross-check the views of your attack surface and find the endpoints that cannot corroborate each other.
seqra/opentaintFormal inter-procedural taint analysis engine for application security. Tracks untrusted data across function boundaries, persistence layers, and…
iamavu/zairoScans code diffs with context to build an impact graph and uses LLMs to find vulnerabilities, supporting multi-repo scans and CI gating with SARIF…
wpscanteam/wpscanWordPress security scanner that detects vulnerabilities, enumerates plugins/themes/users, and checks for weak passwords. Integrates with the WPScan…
owasp/fiasseA Framework for Integrating Application Security into Software Engineering (FIASSE) using the Securable Software Engineering Model (SSEM)
robertdfrench/ifuncd-upGNU IFUNC is the real culprit behind CVE-2024-3094
google/honggfuzzSecurity oriented software fuzzer. Supports evolutionary, feedback-driven fuzzing based on code coverage (SW and HW based)
nationwide-group-oss/cryptopticCodeQL-based scanner that inventories cryptographic function calls across repositories and GitHub organizations, producing a Cryptographic Bill of…
cc1a2b/jshunterjshunter is a command-line tool designed for analyzing JavaScript files and extracting endpoints. This tool specializes in identifying sensitive…
1rhino2/fnprintmatch functions in binaries by what they do, not what their bytes look like. behavioral function fingerprinting via microexecution.