thehardwarestore.ai

Sunlight is a production-grade, static Certificate Transparency (CT) log implementation written in Go, sponsored by Let's Encrypt. It implements the C2SP Static CT API and provides both a write-path log server (cmd/sunlight) and a read-path static file server (cmd/skylight). The system accepts certificate submissions via the RFC 6962 add-chain/pre-chain endpoints, sequences them into a Merkle tree using the tlog library, and publishes tiles (hash, data, names) along with signed checkpoints. It also supports the tlog-witness and tlog-mirror protocols for transparency and cross-checking. The architecture is modular: the core log engine lives in internal/ctlog with pluggable backends for storage (local filesystem, S3, in-memory) and distributed locking (SQLite, DynamoDB, ETag-based S3). The sequencer uses a pool of pending entries with low-priority eviction, batched sequencing, and staged uploads via tarballs for crash recovery. Deduplication is handled via a SQLite cache with 256-bit hashes. The system includes extensive observability with Prometheus metrics, structured logging, and debug endpoints for heavy hitters and SSL key logging. Key entry points include the main server binaries (cmd/sunlight, cmd/skylight), a key generation tool (cmd/sunlight-keygen), a partial tile garbage collector (cmd/partial-aftersun), a cache recomputation tool (cmd/recompute-cache), and a names tile generator (cmd/names-prism). The client library (client.go) provides a high-level API for fetching and verifying log entries and inclusion proofs. External dependencies include certificate-transparency-go, torchwood, and golang.org/x/mod/sumdb/tlog. The codebase demonstrates high craftsmanship with several reusable internal packages: durable crash-safe file writes, immutable file flag setting, HyperLogLog cardinality estimation, Space Saving heavy hitters, and a custom XAES-256-GCM implementation. Testing is extensive, including in-memory fake backends, synctest for time-dependent rate limits, and deterministic test data generation.

Wait-for-secrets is a GitHub Action designed to pause workflow execution until a user manually inputs required secrets via a web interface. It leverages GitHub's OIDC tokens to authenticate with the StepSecurity API, which temporarily stores secret metadata and provides a unique URL for user interaction. The action polls the API until secrets are submitted, then makes them available as outputs for subsequent workflow steps. Key features include optional Slack notifications and configurable timeouts. The architecture is straightforward: a TypeScript-based action compiled via ncc into a single JavaScript file, with core logic separated into utility functions for environment parsing, URL generation, and secret handling.

JSON::JWT is a Ruby library implementing the JSON Web Token (JWT) family of standards, including JWS (JSON Web Signature), JWE (JSON Web Encryption), and JWK (JSON Web Key). It provides comprehensive cryptographic operations for signing, verifying, encrypting, and decrypting tokens using various algorithms (HMAC, RSA, ECDSA, RSA-PSS, and symmetric encryption). The library also includes JWK Set management with remote fetching and caching capabilities. The architecture is modular: JSON::JWT serves as the main entry point, delegating to JSON::JWS for signing/verification and JSON::JWE for encryption/decryption. JSON::JWK handles key representation and conversion between OpenSSL keys and JWK format. The JWK Set Fetcher provides a configurable HTTP client with pluggable caching, suitable for OpenID Connect discovery. The code demonstrates strong security practices, including constant-time comparison for MAC verification, protection against padding oracle attacks in CBC mode, and proper validation of algorithm headers to prevent algorithm confusion attacks. The test suite covers interop with other JWT libraries (Nimbus JOSE, jsrsasign) and RFC examples, ensuring correctness. Key external dependencies include OpenSSL for cryptographic primitives, Faraday for HTTP, and ActiveSupport for hash extensions. The library is actively maintained with support for Ruby 3.2-4.0 and recent security fixes.

This is a Node.js automation tool that deploys and maintains Cloudflare Web Application Firewall (WAF) custom rules across all zones in a Cloudflare account. It runs as a long-lived daemon (via PM2) with scheduled cron jobs: one fetches the latest expressions from the repository (git pull) and another updates the WAF rules via the Cloudflare Rulesets API. The service parses rule expressions from a markdown file, applies user configuration (PHP/WordPress support, custom allowlist/blocklist per zone, external IP threat feeds from SniffCat and AbuseIPDB), and syncs the resulting custom rules and IP lists to Cloudflare. It includes robust error notification via email and Discord webhooks with batched alert delivery. The codebase is well-structured, thoroughly tested (Jest), and actively maintained with frequent updates.

This repository provides a collection of shell scripts to automate the setup and management of an IPsec VPN server on Linux. It supports multiple VPN protocols (IPsec/L2TP, IPsec/XAuth, IKEv2) and a wide range of Linux distributions including Ubuntu, Debian, CentOS, Rocky Linux, AlmaLinux, Oracle Linux, and Alpine Linux. The main entry point is `vpnsetup.sh`, which detects the OS and runs the appropriate installer. The project also includes helper scripts for user management, IKEv2 certificate handling, upgrades, and uninstallation. Additionally, it offers an Azure ARM template for cloud deployment. The code is well-structured with OS-specific installers, common bash utility functions, and extensive documentation in multiple languages. It is a mature, widely-used DevOps tool for system administrators.

This repository is a comprehensive string validation and sanitization library for Node.js and browser environments. It provides a large collection of validator functions (e.g., isEmail, isURL, isMobilePhone, isCreditCard) and sanitizers (e.g., trim, escape, whitelist). The library is designed as a set of small, self-contained modules under src/lib/, each exporting a single function. The main entry point is src/index.js, which aggregates all validators and sanitizers into a single export. The library has no runtime dependencies and can be used both server-side and client-side (via a UMD bundle). It includes extensive locale-specific data for phone numbers, postal codes, tax IDs, etc., making it suitable for international validation. The architecture follows a consistent pattern: each validator imports assertString for type checking and optionally merge for options handling, then performs validation using regex or algorithmic checks. The library is actively maintained with frequent releases and a formal security threat model.

ipatool is a cross-platform command-line tool that acts as an unofficial Apple App Store client. It enables searching, purchasing, and downloading iOS/iPadOS/tvOS/watchOS/visionOS/macOS applications and packages directly from Apple's servers. The tool implements Apple's private SAP authentication and signing protocol by emulating Apple's StoreAgent binary in-process using the Unicorn CPU emulator, allowing it to generate kbsync blobs and decrypt macOS packages. It also includes low-level parsers for Apple's proprietary formats (AEA encrypted archives, APFS filesystems, dyld shared caches) to extract assets from macOS restore images. The architecture is modular: a CLI layer (using cobra) dispatches to domain logic in pkg/appstore, which relies on a generic HTTP client (pkg/http), keychain storage (pkg/keychain), and platform abstractions (pkg/util). An MCP (Model Context Protocol) server subcommand exposes the same functionality over stdio. The codebase is heavily tested with unit and integration tests, and CI builds for macOS, Linux, Windows, and iOS. While primarily an application, it contains significant reverse-engineering and protocol-analysis components, giving it a hybrid character.

WPScan is a Ruby-based CLI security scanner for WordPress sites. It detects vulnerabilities in WordPress core, plugins, and themes, enumerates users and misconfigurations, and supports password brute-force attacks. The architecture follows a controller/finder pattern: controllers orchestrate scan phases (version detection, enumeration, password attack), and finders implement passive/aggressive detection strategies for specific items (plugins, themes, users, backups, etc.). HTTP client is a singleton wrapping Typhoeus with caching, throttling, and proxy support. Vulnerability data is retrieved from the WPScan API or local enterprise database dumps. The codebase is well-structured with clear separation of concerns, extensive test coverage, and support for multiple output formats (CLI, JSON, SARIF). It is actively maintained and regularly updated to keep pace with WordPress ecosystem changes.

This is a production React 18/TypeScript single-page application that serves as a self-custodial crypto wallet and dApp-connect hub for the Unicity network. The codebase implements the full wallet lifecycle (create, restore, backup, password encryption, auto-lock, cross-tab lock synchronization), token/NFT management, payment requests, a Connect protocol for iframe/popup dApp approval flows, network switching, a cross-chain bridge module, subscription/API-key gating, DM and group chat, marketplace browsing, and a desktop-like app launcher for embedded iframe agents. The architecture is a monolith SPA with a provider-based SDK wrapper (`SphereProvider`, `ConnectProvider`, `UpgradeProvider`), TanStack Query for server state, and a runtime-config system that rewrites deployment-specific values in `runtime-config.js` via Docker, enabling build-once/promote-many delivery behind nginx. The application is heavily security-focused: Connect intents go through settle-window shields, duplicate-send guards, verified-origin checks, per-network approval stores, and fail-closed network capability allowlists. Sentry telemetry is deliberately scrubbed to send route patterns rather than URLs or query strings, and NFT loading is fingerprint-verified and privacy-gated by minter-chosen hosts. Testing is extensive, with hundreds of Vitest unit tests covering security invariants, SDK version pins, localStorage corruption tolerance, prototype-pollution resistance, and wallet-lock race conditions, plus Playwright smoke/perf tests. The code is heavily commented with references to historical bugs and SDK contract canaries, which aids maintenance but also creates coupling to the upstream `@unicitylabs/sphere-sdk`. The main external dependencies are the Sphere SDK, bridge-core/plugin packages, a bridge return service, wallet-api backends, a subscription gateway, Nostr relays for chat, and Paymento for paid-plan checkout. The repository is purely an application; there is no data-research or analytics content beyond runtime telemetry and marketplace API consumption. Notable engineering strengths include the runtime-config indirection, isolated module boundaries around bridge logic, and small, well-tested utility modules for storage, URL safety, error humanization, and privacy scrubbing. The main drift risks are the `file:`-linked SDK packages, SDK-version-pinned tests, heavy mock usage, and a very large `ExplorePage.tsx` that is approaching component-split territory.

PrivateBin is a self-hosted, zero-knowledge pastebin web application. The PHP backend (Controller, Model, Data) handles paste/comment lifecycle, expiration, deletion, traffic limiting, and storage backend selection; the JavaScript frontend performs all encryption/decryption in the browser using AES-256-GCM (WebCrypto) with PBKDF2 key derivation and optional zlib/WASM compression. The server only ever stores ciphertext and metadata, never plaintext. Data flows from browser encryption into a pluggable persistence layer (filesystem, PDO database, Google Cloud Storage, S3), then back to the browser for decryption; JSON API endpoints accept and return encrypted bodies. Architecturally it is a classic server-rendered MVC app with a frontend state layer: index.php bootstraps a Controller, which delegates to Paste/Comment models over an AbstractData storage interface. Views are rendered via PHP templates with Bootstrap 3/5 themes, and the frontend is a vanilla-JS module namespace (PrivateBin) with submodules for encryption, editor, viewer, discussion, attachments, and i18n. The feature set includes expiration times, burn-after-reading, password-protected pastes, discussion threads, file attachments, URL shortening proxies (YOURLS/Shlink), QR codes, dark mode, and multi-language support. Engineering practices are strong for a mature open-source project: PHPUnit tests cover backend behavior, fast-check property tests cover frontend utilities, CI includes CodeQL/Snyk scans, and security hardening (DOMPurify, CSP, SRI hashes, HTTPS guidance) is explicit. Maintenance is active with recent commits and issue triage. Technical drift is moderate: the project retains legacy browser support and old Bootstrap 3/darkstrap assets, still supports PHP 7.4, and ships a monolithic JS file without a build step, but pinned frontend libraries (Bootstrap 5.3.8, Showdown 2.1.0, DOMPurify 3.4.17) are current.

Ligolo-ng is a tunneling tool that creates VPN-like connections using TUN interfaces and a custom protocol over yamux-multiplexed connections. It consists of a proxy/server component and agent/client components that establish encrypted tunnels to forward TCP/UDP/ICMP traffic without requiring SOCKS proxies. The proxy creates a TUN interface and uses a modified gVisor network stack to intercept and forward packets, while agents make outbound network connections on behalf of the proxy. Features include WebSocket support for firewall bypass, automatic certificate management (Let's Encrypt/self-signed), auto-route functionality, and a web UI/API for management. The architecture cleanly separates concerns into protocol handling, relay mechanisms, network interface management, and stack layers.

HAITI (HAsh IdenTIfIer) is a Ruby library and CLI tool for identifying hash types from input strings. It matches against a comprehensive database of over 675 hash types (including modern algorithms like SHA3, Blake2, and VeraCrypt) using regex patterns. The library provides concise output with hashcat mode numbers, John the Ripper format names, and example hashes. Multiple CLI entry points exist: the main `haiti` command, `haiti-parsable` for script-friendly output, `haiti-fzf` for interactive selection, and `hashcat-haiti`/`john-haiti` for converting hashes into hashcat/JtR formats. The codebase is well-structured, with clean separation between the identification engine, data definitions, and CLI wrappers. It includes comprehensive documentation (man pages, YARD API docs, a docsify site) and is packaged for numerous Linux distributions and Homebrew. The identification logic is straightforward but effective: iterate over a JSON array of prototypes, apply each regex to the input, and return matching types. The data file (`prototypes.json`) is manually maintained and extended with each release.

Nuxt Security is a Nuxt 3+ module that automatically configures applications to follow OWASP security patterns through HTTP headers and middleware. It provides security response headers (including CSP with nonce/hash support for SSR/SSG), request size and rate limiting, XSS validation, CORS support, and optional features like Basic Auth and CSRF protection. The architecture uses Nitro plugins to integrate with Nuxt's server lifecycle, separating concerns between configuration, middleware, build-time plugins, and runtime hooks. The module handles both SSR and SSG modes appropriately, using nonces for CSP in SSR and computed hashes for SSG, with proper strict-dynamic support.

AgentSkillsHub is a production-grade web application that indexes, grades, and surfaces open-source AI agent skills, MCP servers, and Claude/Codex skills. It operates as a full-stack directory with a trust-layer differentiator: each skill receives a deterministic security grade (SAFE/CAUTION/UNSAFE/REJECT) from a rule-based scanner (35 patterns across 11 categories) and a composite quality score (10 signals). The system is architected as a FastAPI monolith (backend) with a React SPA frontend pre-rendered for SEO via 13+ build-time generators, backed by Supabase (PostgreSQL) and triggered by GitHub Actions every 8 hours. It ingests data from the GitHUB Search API through a 6-phase pipeline (search → metadata → README fetch → scoring → classification → composability), then serves the catalog via static HTML pages, REST API endpoints, an MCP server, and a CLI tool. Monetization includes a Pro tier with paid deep search, a $49 deep-audit per skill, and enterprise subscriptions. The codebase also produces original research: a published dataset of 130k+ graded skills, an arXiv paper on security distributions, a 12-chapter Blue Book, and extensive SEO/GEO strategy documents. Despite its hybrid nature (both a software application and a data research project), the dominant character is application because the running web service is primary; the research outputs are byproducts of the operational pipeline.

This is the official OWASP Cheat Sheet Series repository, providing concise, actionable security guidance for developers. It contains over 150 markdown cheat sheets covering web application security, cloud security, AI security, and more. The repository is primarily a documentation project but includes a sophisticated build system (MkDocs, Docker, CI/CD) and tooling for quality assurance: markdown linting, link checking, text linting, and automated PR review agents. The link checker is a standout reusable component with modular architecture. The project is actively maintained with strict quality gates and a well-defined contribution process.

Radare2 is a modular reverse engineering framework written in C. It provides a comprehensive set of libraries and command-line tools for binary analysis, disassembly, debugging, emulation, and file format parsing. The architecture is plugin-based: every major subsystem (architectures, binary formats, I/O backends, debuggers, filesystems, crypto, scripting languages) is implemented as a plugin registered via a common RLibStruct pattern. The core library (libr/) contains reusable data structures (RBTrees, RBuffer, RStrBuf, RList, etc.), utilities (base64, ASN.1, regex, event system, thread wrappers), and analysis engines (ESIL emulator, search algorithms, type propagation). The framework supports dozens of CPU architectures (x86, ARM, MIPS, RISC-V, etc.) and binary formats (ELF, PE, Mach-O, DEX, etc.), and can be extended via language bindings (JavaScript, Python, Rust, etc.) and a package manager (r2pm). Despite its large codebase and some legacy components, the project is actively maintained with continuous integration, fuzz testing, and a responsive issue tracker.

This repository is Microsoft's Agent Governance Toolkit, a production-grade multi-language framework (Python, TypeScript, Rust, Go, .NET) for enforcing policy, identity, trust, audit, and sandboxing on autonomous AI agents. In production, it intercepts agent tool calls, messages, and delegations before they reach external services, evaluating them against declarative policies (OPA, Cedar, or custom backends) with deterministic outcomes (allow/deny/escalate/transform). The system provides a full governance plane including a Rust-based policy engine (Agent Control Specification), a service mesh (AgentMesh) with API gateway, trust engine, policy server, and audit collector, a hypervisor for execution rings and sandboxing (Docker, Hyperlight, Nono), compliance verification (OWASP, EU AI Act), SLO monitoring, and a plugin marketplace. Integrations exist for LangChain, CrewAI, AutoGen, OpenAI Agents, Semantic Kernel, MCP, and many other frameworks. The toolkit is deployed as CLI tools (`agt`, `agentmesh`, `agentos`), Docker containers with sidecar patterns, Kubernetes charts, and VS Code/Chrome extensions. The architecture is polyglot with a shared policy engine core written in Rust; the Python SDK is the richest, with the .NET and Go SDKs covering governance middleware and lifecycle management. The codebase is heavily tested with 992 conformance tests across 10 formal specs, fuzzing targets, and CI gates enforcing deterministic policy outcomes, fail-closed behavior, and no-stub registration.

Google2FA is a standalone PHP library implementing the Time-based One-Time Password (TOTP) algorithm as specified in RFC 6238, fully compatible with Google Authenticator and similar authenticator apps. It provides secure secret key generation (base32-encoded), HMAC-based OTP computation with configurable algorithms (SHA1, SHA256, SHA512), and OTP verification with a sliding window to accommodate clock drift. The library also includes a helper for generating otpauth:// URLs for QR code integration. It has zero external runtime dependencies beyond a constant-time base32 encoder and is designed as a single-class library with traits for modularity. The codebase is well-tested across PHP 7.4 to 8.6 (beta), employs static analysis (PHPStan, Psalm), and follows a clean, maintainable architecture with clear exception hierarchies. It is not a framework but can be used in any PHP project.

java-otp is a Java library for generating HOTP (RFC 4226) and TOTP (RFC 6238) one-time passwords. The core functionality resides in two thread-safe classes: HmacOneTimePasswordGenerator for HMAC-based OTPs and TimeBasedOneTimePasswordGenerator for time-based OTPs. The library depends only on the Java standard library, with JUnit and JMH used solely for testing and benchmarking. Entry points include the constructors and methods like generateOneTimePassword and validateOneTimePassword. Data flow involves passing a SecretKey and counter/timestamp to generate or validate OTPs. The architecture is a simple, focused library with no external services or complex dependencies.