blackbox by StackExchange

Safely store secrets in Git/Mercurial/Subversion

updated at May 15, 2024, 10:17 p.m.

121 +0

6,630 +3

370 +0

progpilot by designsecurity

A static analysis tool for security

updated at May 16, 2024, 3:18 a.m.

14 -1

314 +1

63 +0

spotbugs by spotbugs

SpotBugs is FindBugs' successor. A tool for static analysis to look for bugs in Java code.

updated at May 16, 2024, 11:23 p.m.

77 +0

3,364 +5

576 +1

git-secrets by awslabs

Prevents you from committing secrets and credentials into git repositories

updated at May 17, 2024, 5:33 a.m.

195 +0

12,063 +14

1,155 +1

detect-secrets by Yelp

An enterprise friendly way of detecting and preventing secrets in code.

updated at May 17, 2024, 11:38 a.m.

48 +0

3,492 +7

435 +2

credstash by fugue

A little utility for managing credentials in the cloud

updated at May 17, 2024, 1:27 p.m.

70 +0

2,055 +1

217 +0

kube-score by zegl

Kubernetes object analysis with recommendations for improved reliability and security. kube-score actively prevents downtime and bugs in your Kubernetes YAML and Charts. Static code analysis for Kubernetes.

updated at May 17, 2024, 1:32 p.m.

23 +0

2,609 +8

173 -1

brakeman by presidentbeef

A static analysis security vulnerability scanner for Ruby on Rails applications

updated at May 17, 2024, 4:39 p.m.

165 -1

6,914 -1

713 +1

rekor by sigstore

Software Supply Chain Transparency Log

updated at May 17, 2024, 4:50 p.m.

18 +0

838 +0

156 +0

terragoat by bridgecrewio

TerraGoat is Bridgecrew's "Vulnerable by Design" Terraform repository. TerraGoat is a learning and training project that demonstrates how common configuration errors can find their way into production cloud environments.

updated at May 17, 2024, 5:56 p.m.

23 +0

1,104 +2

2,339 +3

kics by Checkmarx

Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.

updated at May 17, 2024, 7:47 p.m.

25 +0

1,915 +6

286 +0

wrongsecrets by OWASP

Vulnerable app with examples showing how to not use secrets

updated at May 18, 2024, 5:29 a.m.

NEW!

17 +0

1,156 +0

274 +0

cfn_nag by stelligent

Linting tool for CloudFormation templates

updated at May 18, 2024, 6:54 a.m.

34 +0

1,225 +1

207 +0

cosign by sigstore

Code signing and transparency for containers and binaries

updated at May 18, 2024, 9 a.m.

52 +0

4,129 +14

498 +0

DevSkim by Microsoft

DevSkim is a set of IDE plugins, language analyzers, and rules that provide security "linting" capabilities.

updated at May 18, 2024, 9:34 a.m.

36 +0

886 +2

109 -6

ssllabs-scan by ssllabs

A command-line reference-implementation client for SSL Labs APIs, designed for automated and/or bulk testing.

updated at May 18, 2024, 12:08 p.m.

95 +0

1,682 +1

239 -1

kubectl-kubesec by controlplaneio

Security risk analysis for Kubernetes resources

updated at May 18, 2024, 1:01 p.m.

25 +0

503 +2

37 +0

netz by SpectralOps

Discover internet-wide misconfigurations while drinking coffee

updated at May 18, 2024, 1:55 p.m.

14 +0

375 +1

46 +0

ansible-lint by ansible

ansible-lint checks playbooks for practices and behavior that could potentially be improved and can fix some of the most common ones for you

updated at May 18, 2024, 1:56 p.m.

61 +0

3,355 +8

632 +1

conftest by open-policy-agent

Write tests against structured configuration data using the Open Policy Agent Rego query language

updated at May 18, 2024, 2:34 p.m.

27 +0

2,798 +6

297 +0