AppSec and DevSecOps
Tools that check source code, dependencies, and CI/CD pipelines
1–100 of 384
ImpactToolCategoryStarsUpdated
Local onlyAutheliaauthelia/autheliaAn authentication server that works with your reverse proxy to put a login portal and multi-factor authentication in front of your own web apps. It also provides single sign-on and OpenID Connect.Defense and hardening / AppSec and DevSecOpsstars29,4012026-10-25Local onlyInfisicalinfisical/infisicalA secrets management platform that keeps API keys and passwords in one place and hands them to apps and CI at runtime. Use Infisical Cloud or run it yourself.Defense and hardening / AppSec and DevSecOpsstars29,9812026-10-25Local onlyKeycloakkeycloak/keycloakA self-hosted identity and access management server that handles login for your apps, with single sign-on, multi-factor authentication, identity brokering, and user management.Defense and hardening / AppSec and DevSecOpsstars37,5052026-10-25Local onlyShellCheckkoalaman/shellcheckA static analysis tool that reads sh and bash scripts without running them and points out common mistakes such as missing quotes and dangerous patterns.AppSec and DevSecOpsstars40,2352026-10-19Reaches othersTruffleHogtrufflesecurity/trufflehogA scanner that finds leaked API keys and passwords in Git history, files, cloud storage, and more. It can also check whether a key it finds still works.Vulnerability scanning / AppSec and DevSecOpsstars28,6982026-10-24Not ratedreamorluto/reaReview coming soon (opens GitHub in a new tab)Reverse engineering / AppSec and DevSecOpsstars374,3232026-10-24Not ratedawesome-hackinghack-with-github/awesome-hackingReview coming soon (opens GitHub in a new tab)AppSec and DevSecOps / Learning and practice labsstars123,4692026-07-26Not ratedseclistsdanielmiessler/seclistsReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars74,3202026-10-23Not ratedimhexwerwolv/imhexReview coming soon (opens GitHub in a new tab)Network / Reverse engineering / AppSec and DevSecOpsstars55,5452026-10-09Not ratedbig-list-of-naughty-stringsminimaxir/big-list-of-naughty-stringsReview coming soon (opens GitHub in a new tab)AppSec and DevSecOps / Web securitystars47,7212024-04-18Not ratedsecurity-audit-skillcloudflare/security-audit-skillReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars42,5542026-09-14Not ratedswe-agentswe-agent/swe-agentReview coming soon (opens GitHub in a new tab)AppSec and DevSecOps / Vulnerability scanningstars20,6302026-10-19Not ratedsemgrepsemgrep/semgrepReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars17,2212026-10-23Not ratedffufffuf/ffufReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars16,9352026-09-26Not ratedinferfacebook/inferReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars15,7292026-10-23Not ratedbytecode-viewerkonloch/bytecode-viewerReview coming soon (opens GitHub in a new tab)Reverse engineering / Mobile security / AppSec and DevSecOpsstars15,6882026-07-17Not rateddirsearchmaurosoria/dirsearchReview coming soon (opens GitHub in a new tab)AppSec and DevSecOps / Web securitystars15,0022026-10-20Not ratedstatic-analysisanalysis-tools-dev/static-analysisReview coming soon (opens GitHub in a new tab)AppSec and DevSecOps / Learning and practice labsstars14,8482026-10-21Not ratedawesome-malware-analysisrshipp/awesome-malware-analysisReview coming soon (opens GitHub in a new tab)Malware analysis / AppSec and DevSecOps / Threat intelligencestars14,3232024-06-07Not ratedphpstanphpstan/phpstanReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars14,1342026-10-23Not ratedsecguidetencent/secguideReview coming soon (opens GitHub in a new tab)Learning and practice labs / AppSec and DevSecOpsstars13,4402023-03-20Not ratedgit-secretsawslabs/git-secretsReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars13,4182025-09-17Not ratedmastgowasp/mastgReview coming soon (opens GitHub in a new tab)Network / AppSec and DevSecOpsstars13,2812026-10-23Not ratedgrypeanchore/grypeReview coming soon (opens GitHub in a new tab)Containers and cloud / AppSec and DevSecOpsstars13,0932026-10-24Not ratedoss-fuzzgoogle/oss-fuzzReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars12,7862026-10-23Not ratedsonarqubesonarsource/sonarqubeReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars11,1012026-10-23Not ratedclairquay/clairReview coming soon (opens GitHub in a new tab)Containers and cloud / AppSec and DevSecOpsstars11,0822026-10-14Not ratedcodeqlgithub/codeqlReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars10,2432026-10-23Not ratedsyftanchore/syftReview coming soon (opens GitHub in a new tab)Containers and cloud / AppSec and DevSecOpsstars9,7352026-10-24Not ratedgosecsecurego/gosecReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars8,9832026-10-23Not ratedgixyyandex/gixyReview coming soon (opens GitHub in a new tab)Vulnerability scanning / AppSec and DevSecOpsstars8,5622024-07-28Not ratedfuzzdictsthekingofduck/fuzzdictsReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars8,4462023-11-13Not rateddeepsecvercel-labs/deepsecReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars8,2522026-09-29Not rateddependencycheckdependency-check/dependencycheckReview coming soon (opens GitHub in a new tab)AppSec and DevSecOps / Vulnerability scanningstars7,7382026-10-22Not rateddefending-code-reference-harnessanthropics/defending-code-reference-harnessReview coming soon (opens GitHub in a new tab)AppSec and DevSecOps / Vulnerability scanningstars7,6312026-08-06Not ratedrecafcol-e/recafReview coming soon (opens GitHub in a new tab)Reconnaissance / Reverse engineering / AppSec and DevSecOpsstars7,4412026-10-18Not ratedbrakemanpresidentbeef/brakemanReview coming soon (opens GitHub in a new tab)Vulnerability scanning / AppSec and DevSecOpsstars7,2852026-10-22Not rateddeepauditlintsinghua/deepauditReview coming soon (opens GitHub in a new tab)Web security / AppSec and DevSecOpsstars7,2062026-10-16Not ratedpyre-checkfacebook/pyre-checkReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars7,1772026-06-26Not ratedgo-toolsdominikh/go-toolsReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars6,9162026-10-12Not ratedaflplusplusaflplusplus/aflplusplusReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars6,8242026-10-19Not ratedblackboxstackexchange/blackboxReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars6,7662025-11-05Not ratedzizmorzizmorcore/zizmorReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars6,7662026-10-23Not ratedwfuzzxmendez/wfuzzReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars6,5952026-01-21Not ratedslithercrytic/slitherReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars6,3862026-10-23Not ratedcosignsigstore/cosignReview coming soon (opens GitHub in a new tab)Containers and cloud / AppSec and DevSecOpsstars6,3802026-10-22Not ratedsyzkallergoogle/syzkallerReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars6,3722026-10-23Not ratedapkleaksdwisiswant0/apkleaksReview coming soon (opens GitHub in a new tab)Mobile security / AppSec and DevSecOpsstars6,3652025-08-20Not ratedkeyhacksstreaak/keyhacksReview coming soon (opens GitHub in a new tab)Reconnaissance / AppSec and DevSecOpsstars6,3622026-08-07Not ratedgitrobmichenriksen/gitrobReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars6,1962022-09-20Not ratedawesome-fuzzingsecfigo/awesome-fuzzingReview coming soon (opens GitHub in a new tab)AppSec and DevSecOps / Learning and practice labsstars5,9302024-04-03Not ratedghidra-mcpbethington/ghidra-mcpReview coming soon (opens GitHub in a new tab)Reverse engineering / AppSec and DevSecOpsstars5,8852026-10-23Not ratedscorecardossf/scorecardReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars5,7842026-10-24Not ratedclisnyk/cliReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars5,6862026-10-23Not ratedclusterfuzzgoogle/clusterfuzzReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars5,6192026-10-23Not ratedpmdpmd/pmdReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars5,5162026-10-23Not ratedmobileapp-pentest-cheatsheettanprathan/mobileapp-pentest-cheatsheetReview coming soon (opens GitHub in a new tab)Network / AppSec and DevSecOps / Reverse engineeringstars5,3072024-02-08Not ratedbumblebeeperplexityai/bumblebeeReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars5,0922026-10-11Not ratedsandsifterxoreaxeaxeax/sandsifterReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars5,0852024-02-20Not rateddetect-secretsyelp/detect-secretsReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars4,6542026-04-02Not ratedapplicationinspectormicrosoft/applicationinspectorReview coming soon (opens GitHub in a new tab)Web security / AppSec and DevSecOpsstars4,3982026-09-15Not rateddependency-trackdependencytrack/dependency-trackReview coming soon (opens GitHub in a new tab)AppSec and DevSecOps / Vulnerability scanningstars4,3352026-10-23Not ratedmythrilconsensysdiligence/mythrilReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars4,2752026-04-27Not ratedaflgoogle/aflReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars4,2012021-07-05Not ratedretire.jsretirejs/retire.jsReview coming soon (opens GitHub in a new tab)AppSec and DevSecOps / Web securitystars4,1892026-10-23Not ratedshhgiteth0izzle/shhgitReview coming soon (opens GitHub in a new tab)Reconnaissance / AppSec and DevSecOpsstars3,9942025-02-28Not ratedintruderpayloads1n3/intruderpayloadsReview coming soon (opens GitHub in a new tab)Web security / AppSec and DevSecOpsstars3,9932021-09-27Not ratedfuzzinggoogle/fuzzingReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars3,7832024-10-24Not ratedembae-m-b-a/embaReview coming soon (opens GitHub in a new tab)Reverse engineering / Web security / AppSec and DevSecOpsstars3,7202026-10-23Not ratedssrfmapswisskyrepo/ssrfmapReview coming soon (opens GitHub in a new tab)Web security / Learning and practice labs / AppSec and DevSecOpsstars3,6392026-08-10Not ratedjoernjoernio/joernReview coming soon (opens GitHub in a new tab)Reverse engineering / AppSec and DevSecOpsstars3,5932026-10-23Not ratedkube-linterstackrox/kube-linterReview coming soon (opens GitHub in a new tab)Containers and cloud / AppSec and DevSecOpsstars3,5252026-10-21Not ratedhonggfuzzgoogle/honggfuzzReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars3,4012026-09-25Not ratedonelistforallsix2dez/onelistforallReview coming soon (opens GitHub in a new tab)AppSec and DevSecOps / Cryptography and passwordsstars3,2792026-09-22Not ratedpacker-fuzzerrtcatc/packer-fuzzerReview coming soon (opens GitHub in a new tab)AppSec and DevSecOps / Web securitystars3,2562024-05-24Not ratedparamspiderdevanshbatham/paramspiderReview coming soon (opens GitHub in a new tab)AppSec and DevSecOps / Reconnaissancestars3,1952026-03-07Not ratedurlfinderpingc0y/urlfinderReview coming soon (opens GitHub in a new tab)Web security / AppSec and DevSecOpsstars3,1922026-06-17Not ratedechidnacrytic/echidnaReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars3,1862026-10-21Not ratedkube-scorezegl/kube-scoreReview coming soon (opens GitHub in a new tab)Containers and cloud / Web security / AppSec and DevSecOpsstars3,1052026-05-20Not ratedsnafflersnaffcon/snafflerReview coming soon (opens GitHub in a new tab)Exploits and PoCs / AppSec and DevSecOpsstars2,9692026-02-27Not ratedrestler-fuzzermicrosoft/restler-fuzzerReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars2,9592026-06-10Not ratedjadx-ai-mcpzinja-coder/jadx-ai-mcpReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars2,9342026-10-19Not ratedphp-static-analysis-toolsexakat/php-static-analysis-toolsReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars2,8772026-05-07Not ratedonefuzzmicrosoft/onefuzzReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars2,8222023-11-01Not ratedvulnhuntrprotectai/vulnhuntrReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars2,8072025-02-06Not ratedweb-fuzzing-boxgh0stkey/web-fuzzing-boxReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars2,7982026-03-23Not ratedbearerbearer/bearerReview coming soon (opens GitHub in a new tab)AppSec and DevSecOps / Vulnerability scanning / Web securitystars2,7722026-10-22Not ratedfuzzingpaperwcventure/fuzzingpaperReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars2,7662026-09-30Not ratedlibaflaflplusplus/libaflReview coming soon (opens GitHub in a new tab)AppSec and DevSecOps / Reverse engineeringstars2,6662026-10-19Not ratedskill-scannercisco-ai-defense/skill-scannerReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars2,6242026-10-22Not ratedwinaflgoogleprojectzero/winaflReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars2,6182026-03-13Not ratedgitdorkerobheda12/gitdorkerReview coming soon (opens GitHub in a new tab)Reconnaissance / AppSec and DevSecOpsstars2,5952024-08-03Not ratednodejsscanajinabraham/nodejsscanReview coming soon (opens GitHub in a new tab)AppSec and DevSecOps / Web securitystars2,5792026-09-21Not ratedascmg1937/ascReview coming soon (opens GitHub in a new tab)Reverse engineering / AppSec and DevSecOpsstars2,5292026-10-21Not ratedsmart-contract-vulnerabilitieskadenzipfel/smart-contract-vulnerabilitiesReview coming soon (opens GitHub in a new tab)Learning and practice labs / AppSec and DevSecOpsstars2,4962026-02-08Not ratedagent-vaultinfisical/agent-vaultReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars2,4192026-10-22Not ratedboofuzzjtpereyda/boofuzzReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars2,3652026-09-21Not ratedfuzzilligoogleprojectzero/fuzzilliReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars2,3592026-10-14Not ratedcoercerp0dalirius/coercerReview coming soon (opens GitHub in a new tab)Exploits and PoCs / AppSec and DevSecOpsstars2,3382026-04-24Not ratednoseyparkerpraetorian-inc/noseyparkerReview coming soon (opens GitHub in a new tab)AppSec and DevSecOpsstars2,3382026-02-21