DefectDojo is a Django-based vulnerability management platform that aggregates, deduplicates, and tracks security findings from over 200 security scanners (SAST, DAST, SCA, container, cloud, infrastructure). The system ingests scan reports via a standardized parser interface, normalizes findings into a core data model (Product, Engagement, Test, Finding, Location), and provides advanced features such as risk-based prioritization, SLA management, JIRA/GitHub integration, notifications (Slack, Teams, email), role-based access control, and customizable reporting. The architecture is a Django monolith with a REST API (v2 using DRF, v3 using Ninja in alpha), Celery for async task processing (imports, deduplication, JIRA sync, SLA expiry), PostgreSQL with full-text search and audit logging via pghistory, and a containerized deployment with Docker Compose. Key entry points include the parser factory (dojo/tools/factory.py), API viewsets, and management commands. The codebase demonstrates strong software engineering patterns such as a modular parser contract, an abstract location manager for feature-flag-driven migration, and an authorization filter registry, but carries technical debt from a dual API surface and an incomplete migration to a new location model.
HTTPS-PORTAL is a Docker image that automates HTTPS setup using Nginx and Let's Encrypt. It provides a fully automated reverse proxy that obtains SSL certificates, configures Nginx, and handles renewal. The container runs multiple supervised processes via s6-overlay: Nginx, docker-gen (for automatic container discovery), cron (for certificate renewal), and a dynamic environment watcher. Configuration is driven by environment variables, primarily the `DOMAINS` variable which supports a rich syntax for specifying upstreams, redirects, basic auth, access restrictions, custom ports, and per-domain stages. The codebase is primarily Ruby scripts that parse domain descriptors, generate Nginx configuration from ERB templates, and orchestrate certificate signing via acme-tiny. The architecture is clean and modular, with clear separation between domain parsing, certificate management, and Nginx configuration generation. The repository includes comprehensive integration tests using Docker Compose and RSpec.
ProtonUp-Qt is a Linux desktop GUI built with PySide6/Qt6 for installing, updating, and removing Wine/Proton-based compatibility tools (GE-Proton, Proton-tkg, Wine builds, DXVK/VKD3D, SteamTinkerLaunch, Boxtron, Luxtorpeda, etc.) across Steam, Lutris, Heroic, Bottles, and custom launchers. Architecturally it is a client-side Qt application: the main window orchestrates background download/extraction jobs, a dynamic plugin loader (`ctloader.py`) discovers compatibility-tool modules under `resources/ctmods/`, and per-launcher adapters (`steamutil.py`, `lutrisutil.py`, `heroicutil.py`) read/write local game databases and config files. Release metadata is fetched from GitHub/GitLab/Codeberg REST APIs with rate-limit handling and optional user tokens. There is no server or data-processing component; external anti-cheat/compatibility datasets are only consumed to enrich the game-list dialog. The codebase demonstrates a credible plugin architecture, typed domain data in `datastructures.py`, and reusable network/download utilities. Maintenance is active, but the many tool-specific ctmods duplicate logic (fetch/install/extract), translations lag source strings, and the project depends on third-party release APIs and Steam's local formats, which makes some features inherently fragile.
This repository serves as a pre-commit hook configuration for Ruff, an extremely fast Python linter and formatter. It defines three pre-commit hooks: `ruff-check`, `ruff-format`, and a legacy `ruff` alias. The core operational code is a single Python script (`mirror.py`) that automates version mirroring: it fetches the latest Ruff release from PyPI and updates version strings in `pyproject.toml` and `README.md`. A GitHub Actions workflow runs this script on a schedule (every 4 hours), commits changes, tags releases, and creates GitHub releases. The repository is a minimal, well-structured wrapper that enables installing Ruff via pre-commit hooks. There is no application logic beyond the mirror script; the project's value is in its configuration and automation pipeline for staying in sync with upstream Ruff releases.
FlexGet is a rule-based media download automation tool written in Python. It manages the acquisition of TV series, movies, and other content from RSS feeds, torrent sites, Usenet indexers, and custom sources. The system uses a plugin architecture where each feature (input, filter, output, notifier, metadata lookup) is a plugin registered via an event system. Tasks are defined in YAML configuration files and executed through a pipeline of phases (input, metainfo, filter, modify, output). It runs as a daemon with a built-in scheduler (APScheduler), provides a REST API (Flask-RESTx) for remote management, and includes both a legacy AngularJS web UI and a modern React-based UI. The codebase is extensive with over 100 plugins, SQLAlchemy-based persistence, and a comprehensive test suite. While primarily an application, it incorporates data engineering patterns such as caching, rate limiting, and metadata enrichment from external APIs (TMDB, Trakt, IMDB, TVDB).
This is a personal Home Assistant configuration repository for automating a smart home. It uses Home Assistant's core automation system supplemented with AppDaemon for complex Python-based automations, HACS for managing community integrations, and Lovelace for custom UI. The configuration controls lighting, climate, security, media players, vacuum robots, and plant monitoring, with integrations for devices like Philips Hue, Xiaomi Aqara, KEF speakers, LG OLED TV, and Roborock. The repository demonstrates good organization through modular includes for reusable configuration snippets, functional separation of automations by domain, and clear separation between YAML-based and Python-based automation approaches.
This repository is primarily an 'awesome list' curating fuzzing (fuzz testing) resources - books, talks, papers, tools - organized by venue and type. The core content lives in a single README.md file. What distinguishes it from a simple list is a set of well-engineered Python scripts (ndss.py, sp.py, usenix.py) that automatically scrape conference accepted-paper pages (NDSS, IEEE S&P, USENIX Security) and match titles containing 'fuzz'. For IEEE S&P, the sp.py script goes further by verifying bibliographic metadata via the Crossref API before proposing entries, ensuring only validated DOIs are suggested. These scripts are triggered manually via GitHub Actions workflows, generating pull requests rather than writing directly. The code exhibits careful HTML parsing with validation, idempotent update logic, comprehensive error handling, and extensive unit tests. While the repository's primary output is a static list, the supporting automation demonstrates production-quality data collection and proposal pipelines that could be reused for maintaining other curated lists.
This repository provides a Docker-based tool for automatically discovering and backing up databases running in Docker containers. The core logic resides in a single Python script (`db-auto-backup.py`) that uses the Docker SDK to list running containers, identifies database containers by image name (PostgreSQL, MySQL/MariaDB, Redis), and executes native backup commands (pg_dumpall, mysqldump, redis-cli SAVE). Backups are written to a configurable directory with optional compression (gzip, lzma, bz2, zstd) and can be scheduled via cron expressions using the pycron library. The tool also supports success hooks (e.g., healthchecks.io, Uptime Kuma) and environment variable configuration. It is designed to run as a standalone Docker container with access to the Docker socket, making it a lightweight, self-contained backup solution for Docker hosts. The codebase is well-structured with type hints, linting, and a comprehensive test suite that validates backup generation and compression across multiple database types.
Gulp is a streaming build system for automating development workflows. It provides a minimal API surface (src, dest, watch, task, series, parallel) that allows developers to define tasks as asynchronous functions and compose them into pipelines. The core library is a thin wrapper around several specialized modules: Undertaker for task orchestration, vinyl-fs for file I/O, glob-watcher for file watching, and gulp-cli for command-line interaction. The architecture is modular and dependency-heavy, with the main index.js file creating a Gulp instance that inherits from Undertaker and delegates file operations to vinyl-fs. The system is designed to be used programmatically or via the CLI, and it supports both CommonJS and ESM imports. The codebase is well-maintained and has recently undergone a major version 5 release with significant updates to stream handling, globbing, and dependency management.
SmsForwarder is an Android application written in Kotlin that monitors SMS messages, incoming calls, and app notifications on a device and forwards them to multiple third-party channels such as DingTalk, WeChat Work, Feishu, Telegram, email, Bark, Webhook, and others. It also provides a local HTTP server for remote control (query/send SMS, call logs, contacts, battery status, location, and Wake-on-LAN) and an automation engine with configurable conditions (cron, battery, network, Bluetooth, location, screen state, etc.) and actions (forward, send SMS, trigger alarm, control frpc tunnels, etc.). The architecture follows a standard Android pattern with Room database, WorkManager for background tasks, XUI for UI components, and a fragment-based navigation system. The codebase is large and feature-rich, with over 15 sender channels and a flexible rule engine, but exhibits some technical debt such as deprecated API usage, hardcoded vendor-specific intents, and a few large monolithic fragments.
Certd is a full-stack web application that automates the entire lifecycle of SSL/TLS certificates, from application via the ACME protocol to deployment across 110+ cloud providers, CDNs, and hosting platforms. It utilizes a pipeline engine for orchestrating multi-stage tasks (cert apply, conversion, deploy, notification) with retry, skip-on-success, and cron/webhook triggers. The system features a plugin architecture with decorator-based registration for tasks, access credentials, DNS providers, notifications, and OAuth, making it highly extensible. The monorepo includes a Vue 3 + Vben admin frontend and a Midway.js (Koa) backend with TypeORM and multi-database support (SQLite, MySQL, PostgreSQL). It also supports commercial features like subscription plans, wallet, payments, and enterprise project isolation. While the codebase is well-structured and actively maintained, the large number of cloud provider plugins and legacy auto-generated SDKs (e.g., JDCloud) introduce maintenance overhead and potential API drift.
OVH CDS is an enterprise-grade continuous delivery and DevOps automation platform. The repository contains a set of Go services (API, CDN, hooks, VCS, repositories, hatcheries, worker, elasticsearch) managed via a common engine binary, supported by PostgreSQL, Redis, and OpenSearch/Elasticsearch, plus an Angular web UI, a cdsctl CLI, and gRPC-based action/integration plugins. In production it orchestrates pipelines and workflows, spawns workers on Kubernetes, Swarm, OpenStack, vSphere or local hosts, ingests VCS webhooks, stores job logs and artifacts through a pluggable CDN storage layer, and enforces fine-grained RBAC across projects, regions, workflows, and variable sets. Both legacy v1 workflows and newer as-code v2 workflows are implemented and actively maintained side-by-side.
arkade is a command-line tool that functions as a marketplace and installer for developer tools and Kubernetes applications. It provides two primary workflows: downloading CLI binaries (over 200 tools) and installing Kubernetes Helm charts (over 50 apps) with custom overrides. The tool also supports OCI image installation/publishing, Helm chart image version upgrades, system-level package installation (e.g., Node.js, Caddy), and self-updating with SHA-256 verification. The architecture is a monolithic Go CLI built with Cobra, where each subcommand (get, install, update, system, oci, chart, etc.) is a separate command tree. Entry points include main.go (root command) and the various command files under cmd/. External dependencies include GitHub releases API, Helm CLI, kubectl, Docker (for qemu-static), and OCI registries. The codebase demonstrates solid engineering with reusable patterns such as template-based tool definitions, safe archive extraction, and a builder pattern for installer options, though it suffers from a large manual catalog that requires ongoing maintenance.
HeadlessX is a self-hosted web scraping and browser automation platform with anti-detection capabilities. It provides a Next.js 16 dashboard, an Express 5 API with Prisma/PostgreSQL, a BullMQ queue worker, and a published CLI. The core value proposition is anti-detection scraping via the headfox-js package (Camoufox-compatible Firefox bundles), fingerprint generation, CAPTCHA solving, and LLM-friendly markdown output. The system supports multiple operators: website scraping/crawling/mapping, Google AI Search, Tavily search, Exa search, and YouTube extraction. It includes sidecar services for HTML-to-Markdown (Go) and YouTube extraction (Python FastAPI). The architecture is a monorepo with Nx orchestration, Docker Compose deployment, and an MCP endpoint for AI assistant integration. External dependencies include Redis, Postgres, Playwright, MaxMind GeoIP, and external APIs (Tavily, Exa, Google). The codebase is well-structured with clear separation of concerns, modern TypeScript, and reusable patterns in both frontend and backend.
Pipelight is a Rust-based CLI tool for defining and running automation pipelines. It allows users to create pipelines using TOML, YAML, HCL, or TypeScript configurations, trigger them via git hooks or file system changes, and monitor their execution. The architecture follows a modular design with separate crates for CLI parsing, workflow execution, configuration casting, process management, and utilities. Key features include process detachment for background execution, output capture for post-execution inspection, git hook integration, and file watching capabilities. The project demonstrates strong engineering practices with comprehensive error handling, cross-platform considerations, and thoughtful UX design for terminal interactions.
This repository provides a standalone shell script for backing up Jenkins home directories. The script archives critical Jenkins configuration including XML files, plugins, user data, secrets, nodes, and job definitions with special handling for CloudBees Folder plugin and jobs containing spaces in their names. It operates as a CLI tool with zero external dependencies beyond standard Unix utilities (bash, find, cp, tar). The implementation demonstrates robust filesystem traversal techniques, proper handling of edge cases (empty directories, special characters in filenames), and recursive backup of nested folder structures. The script is designed to be portable across Linux distributions and includes comprehensive test coverage using Docker and Serverspec to validate functionality across multiple environments.
This repository is a Node.js GitHub Bot that automates tasks in response to GitHub and Jenkins webhooks. It uses an Express.js server to receive webhooks, validates GitHub signatures, and emits normalized events via a central event emitter. Scripts in the `scripts` directory listen for these events to perform actions such as commenting on pull requests, updating GitHub status checks based on Jenkins builds, and enforcing CODEOWNERS reviews. The architecture separates webhook reception from processing, allowing for extensibility through additional scripts.
FLARE-VM is a collection of PowerShell and Python scripts for automating the setup of a Windows-based reverse engineering virtual machine. The core installer (`install.ps1`) uses Chocolatey and Boxstarter to deploy a curated set of malware analysis tools, configure environment variables, registry settings, and taskbar layout. It provides both a GUI and CLI mode for package selection. The repository also includes a set of VirtualBox helper scripts (`virtualbox/`) for building, exporting, and cleaning VM snapshots, as well as monitoring network adapter status. These scripts are well-structured and can be reused independently for VirtualBox automation. The project is actively maintained by Mandiant (Google) and serves the malware analysis community.
FlowGram is a comprehensive, production-grade visual workflow development framework from ByteDance. The codebase implements two distinct editing paradigms — fixed-layout (automatic positioning with composite nodes like loops, branches) and free-layout (node-position-free with lines) — both built on a shared plugin architecture using inversify for dependency injection. The framework includes a form engine with reactive fields, validation, and effects; a variable engine with AST-based type inference and scoped lifecycle; and a runtime engine capable of executing workflows with executors for LLM, HTTP, code (QuickJS sandbox), and conditions. The repository contains over 40 packages managed via Rush monorepo, encompassing core libraries, plugins (history, minimap, auto-layout, group, snap, clipboard, export), UI material libraries (Semi UI, Ant Design), a CLI tool for scaffolding, multiple demo applications, and comprehensive documentation. The system is actively maintained with regular commits, CI workflows, and E2E tests. Notable technical decisions include a local fork of the use-gesture library for canvas interaction, heavy decorator-based IoC, and support for both React 17 and 18. While the architecture is well-structured and extensible, the codebase shows signs of duplication between fixed and free layouts, numerous demo-specific components, and some deprecated APIs that indicate ongoing refactoring.
Witsy is a feature-rich desktop AI assistant built with Electron and Vue 3. It operates as a Bring-Your-Own-Keys (BYOK) client, aggregating dozens of LLM providers (OpenAI, Anthropic, Google, Ollama, etc.) into a unified chat, agent, and automation platform. The architecture follows a standard Electron main/renderer process split, communicating via IPC, with a Vue 3 frontend and a Node.js backend. Beyond basic chat, Witsy provides a sophisticated agent system supporting multi-step workflows, A2A communication, scheduling, and webhooks. It includes a full RAG pipeline (document ingestion, chunking, embedding, vector search), a plugin system for tools (MCP, code execution, web browsing, image generation), and extensive voice capabilities (STT/TTS with multiple providers). Data is persisted locally as JSON files within workspaces, with a vector database for semantic memory and document retrieval. A key differentiator is its automation layer, which can control the desktop (text selection, pasting, app detection) via platform-specific automators (macOS, Windows, nut-js). It exposes a local HTTP API and a CLI for external integration. The MCP (Model Context Protocol) client allows it to connect to a vast ecosystem of third-party tools. While primarily an application, it contains significant data engineering components (RAG pipeline, memory manager, deep research orchestrator) that are tightly integrated into the app's workflow. The codebase is well-structured with a strong emphasis on testing, though its massive feature surface and reliance on external APIs introduce inherent complexity and maintenance challenges.