thehardwarestore.ai

QtKeychain is a cross-platform Qt library for securely storing passwords and secrets using platform-native keychain services. It provides a unified QKeychain::Job API (ReadPasswordJob, WritePasswordJob, DeletePasswordJob) that delegates to the appropriate backend: macOS/iOS Keychain, Windows Credential Store (or CryptProtectData), Linux via KWallet, libsecret, or GNOME Keyring, Android Keystore, Haiku's KeyStore, and a WebAssembly bridge using the Credential Management API. The library is primarily a thin abstraction layer with clean separation of platform concerns, an internal job queue for serialization, and a fallback mechanism to store data in plaintext via QSettings when no secure backend is available. It supports Qt 5 and Qt 6, requires C++11/17, and bundles translation files for several languages.

This repository is a comprehensive library of Kyverno policies for Kubernetes, providing a curated collection of Validating, Mutating, Generating, and Cleanup policies. It covers Pod Security Standards (baseline and restricted), best practices, RBAC restrictions, image registry controls, and integrations with ecosystem tools like Istio, Linkerd, Karpenter, and ArgoCD. The policies are written as YAML manifests using Kyverno's CEL-based API (policies.kyverno.io/v1) and are accompanied by extensive test suites using both Chainsaw and Kyverno CLI frameworks. The repository serves as a reference implementation and distribution channel for Kyverno users, with standardized metadata (ArtifactHub), CI/CD pipelines, and contribution guidelines. While not a traditional application, it functions as a policy-as-code library with a strong emphasis on security and operational best practices.

gtklock is a GTK-based lockscreen for Wayland compositors. It locks the screen using the ext-session-lock protocol and authenticates users via PAM. The application creates a window for each monitor displaying a clock, date, and password entry. It supports features like idle hiding, multi-monitor focus following, and running custom commands on lock/unlock events. The architecture is modular, with a core GTK application loop, pluggable modules for extensibility, and isolated subsystems for authentication and configuration. The main entry point is in src/source.c, which initializes the GTK application, loads configuration and modules, and sets up event handlers for screen locking and unlocking.

This repository implements a Linux desktop GUI for managing WireGuard VPN profiles. It is built using the Tauri v2 framework, combining a Rust backend for system-level operations (connection management, encryption, file I/O) with a Next.js 16 (React 19) frontend for the user interface. The application allows users to create, import, export, connect, and disconnect WireGuard tunnels, and provides optional at-rest encryption for profile data using a user-defined PIN. The architecture follows a clean IPC-based separation of concerns. The frontend communicates with the Rust backend exclusively through typed Tauri commands defined in `lib/effects.ts`. The backend in `src-tauri/src/main.rs` manages application state, executes WireGuard commands via shell scripts (`wg.sh`), and handles encryption via a dedicated security module. The UI is built from a comprehensive library of ~40+ composable, accessible components in `components/ui/`, demonstrating a strong commitment to frontend architecture and design system principles. The most reusable assets are the Rust security module (`security.rs`), which implements PIN-based encryption using Argon2id and XChaCha20-Poly1305 in a self-contained manner, and the typed IPC service layer (`lib/effects.ts`), which cleanly decouples the UI from the backend. The UI component library, while styled for this project, follows an architectural pattern (atomic, composable primitives) that is directly transferable to other React projects. The project is actively maintained with CI/CD, E2E testing, and semantic versioning, though it carries some technical drift in its Nix build configuration (targeting Tauri v1) and deprecated plugin permissions.

qs is a JavaScript library for parsing and stringifying URL query strings with support for nested objects, arrays, and custom formatting. It is designed as a drop-in replacement for Node.js's built-in querystring module but with enhanced security features, including protection against prototype pollution, configurable depth limits, and parameter/array size limits. The library exposes three main functions: `parse`, `stringify`, and `formats`, all accessible from the single entry point `lib/index.js`. Internally, it uses a side-channel pattern for cycle detection and overflow tracking, and implements a chunked UTF-8 encoder to handle surrogate pairs safely. The codebase is well-tested with an extensive suite of edge-case tests, and it is distributed as an npm package with browser builds via Browserify. Architecturally, qs is a focused, single-purpose library with a clean separation of concerns: parsing logic in `lib/parse.js`, serialization in `lib/stringify.js`, shared utilities in `lib/utils.js`, and formatting constants in `lib/formats.js`. It follows a functional style with option normalization functions that validate and fill defaults, making the API robust against misuse. The library has a long history (over a decade) and is widely adopted (nearly 9000 stars), but its maintenance shows signs of high release churn and legacy support burdens, including backporting fixes to older Node.js versions (>=0.6) and maintaining outdated packaging artifacts like `bower.json` and `component.json`. Despite these legacy concerns, the core code is well-crafted, security-conscious, and actively maintained with frequent releases and responsive issue triage.

This repository provides a comprehensive Nginx security configuration package to block malicious bots, spam referrers, bad IPs, and vulnerability scanners. It includes curated blocklists (bad user agents, referrers, IPs, fake Googlebots), rate limiting/DDoS protection, and optional fail2ban integration. The core deliverable is a set of modular Nginx include files (bots.d/, conf.d/) and shell scripts (install-ngxblocker, setup-ngxblocker, update-ngxblocker) for automated deployment and daily updates. It also generates Google Analytics ghost spam exclusion lists and a Google Search Console disavow file. The architecture is a collection of configuration templates and deployment tooling, not a standalone application; it is designed to be included into existing Nginx server blocks. The repository is actively maintained with frequent updates to blocklists and CI testing across multiple Linux distributions.

This is a Laravel package that integrates the HTMLPurifier library to sanitize and purify HTML input, primarily for XSS protection. It provides a service provider, a facade, a global helper function (`clean()`), and custom Eloquent casts (`CleanHtml`, `CleanHtmlInput`, `CleanHtmlOutput`) for automatic sanitization on model attributes. The core `Purifier` class wraps HTMLPurifier with Laravel's config and filesystem, supporting dynamic configuration, custom HTML definitions, and a non-string bypass option. The package is well-tested and supports Laravel 5.8 through 13.0, with active maintenance and low technical drift.

A Visual Studio extension (VSIX) that integrates SonarQube/SonarCloud static analysis into the IDE. It provides real-time code quality and security analysis for C#, VB.NET, C/C++, JavaScript/TypeScript, CSS, and other languages via an embedded SLCore backend (Java process) and a separate Roslyn analyzer server for .NET. The extension supports both standalone analysis and 'connected mode' that binds to SonarQube/SonarCloud servers, including project binding, credential management, issue visualization with flows and locations, security hotspots, taint vulnerabilities, dependency risks, quick fixes, rule education (HTML-to-XAML rendering), and telemetry. The architecture is modular, heavily relying on MEF for dependency injection, with distinct assemblies for core abstractions, VS integration, connected mode UI, issue visualization, security-specific features, and education. The codebase is well-tested with extensive unit tests and some integration tests, but shows signs of ongoing migration from legacy binding models to a modern SLCore-based protocol, resulting in some technical debt and backward-compatibility code.

This repository provides a WebCrypto API polyfill for Node.js, implementing the W3C Web Cryptography API using Node's native crypto module. It supports a comprehensive set of algorithms including AES (CBC, CTR, GCM, ECB, KW, CMAC), DES (CBC, EDE3-CBC), RSA (SSA, PSS, OAEP, ES), ECDSA, ECDH, EdDSA, ECDH-ES, Ed25519, X25519, HMAC, PBKDF2, HKDF, SHA-1/256/384/512, SHA3-256/384/512, and SHAKE128/256. The architecture follows a provider pattern where each algorithm is implemented as a separate class extending a base provider from the 'webcrypto-core' library. Key management is handled through internal CryptoKey classes with serialization support for JWK, raw, PKCS8, and SPKI formats. The library is designed as a drop-in replacement for the browser's crypto.subtle API, enabling isomorphic JavaScript cryptography.

This is not a conventional software application — it is a curated awesome-list repository (classified as 'application' only because its CI/CD pipeline and shell tooling are the sole executable content). The actual product is README.md: a comprehensive, categorized catalog of Android security resources covering online analyzers, static/dynamic analysis tools, reverse-engineering utilities, fuzzers, vulnerability scanners, intentionally vulnerable practice apps, research papers, malware datasets, exploit lists, and bug bounty programs. The repository ships no libraries, services, or user-facing code; its runtime behavior is limited to link-liveness checking (urlsup) and linting of the repository's own documentation and automation. The repository's engineering value lives in its maintenance infrastructure. GitHub Actions workflows lint Markdown (mdl), shell scripts (shellcheck), YAML (yamllint), and the workflows themselves (actionlint plus a zizmor security scan), while a scheduled job validates all README links weekly using a carefully curated urlsup configuration (.urlsup.toml) that distinguishes dead links (strikethrough-removed from the list) from flaky or bot-protected endpoints (allowed 403/429/503). Dead and archived tools are explicitly marked with strikethrough in the README, keeping the resource list honest without silently deleting historical references. All third-party actions are pinned to commit SHAs, permissions are least-privilege, and the cargo-based link checker is cached for fast CI runs. For an Android security practitioner, the repo serves as the de facto reference index for the ecosystem — many entries point to the actual tools (MobSF, Drozer, Frida, jadx, Androguard, QARK) and malware datasets (AndroZoo, Drebin, Kharon). For an engineer, the reusable assets are the link-liveness pipeline and the CI self-audit pattern, both of which can be transplanted into any link-heavy or automation-heavy repository. The repo is a hybrid: content-curation project with application-grade CI scaffolding around it, rather than either a true application or a data research project.

Kata Containers is an open-source secure container runtime that runs each container inside a lightweight virtual machine (microVM), providing strong workload isolation while maintaining container-like performance and orchestration. The project provides a containerd shim-v2 implementation, a guest-side agent, and supports multiple hypervisors including QEMU, Cloud Hypervisor, Firecracker, and its own built-in VMM (Dragonball). It integrates deeply with Kubernetes (runtime classes, CSI, mutating webhooks, policy generation via Rego) and supports confidential computing features (TDX, SEV-SNP, IBM Secure Execution, ARM CCA). The codebase is dual-language: the primary runtime is written in Go, with a newer Rust rewrite (runtime-rs) that shares core libraries with the agent and Dragonball VMM. The project is actively maintained with extensive CI, multi-architecture support, and a large ecosystem of tools (agent-ctl, kata-ctl, log-parser, trace-forwarder, genpolicy). While the architecture is modular and many components (e.g., safe-path, dbs-allocator, retry library) are independently reusable, the coexistence of two runtime implementations, generated API clients, and architecture-specific code introduce some technical drift and maintenance overhead.

DefectDojo is a Django-based vulnerability management platform that aggregates, deduplicates, and tracks security findings from over 200 security scanners (SAST, DAST, SCA, container, cloud, infrastructure). The system ingests scan reports via a standardized parser interface, normalizes findings into a core data model (Product, Engagement, Test, Finding, Location), and provides advanced features such as risk-based prioritization, SLA management, JIRA/GitHub integration, notifications (Slack, Teams, email), role-based access control, and customizable reporting. The architecture is a Django monolith with a REST API (v2 using DRF, v3 using Ninja in alpha), Celery for async task processing (imports, deduplication, JIRA sync, SLA expiry), PostgreSQL with full-text search and audit logging via pghistory, and a containerized deployment with Docker Compose. Key entry points include the parser factory (dojo/tools/factory.py), API viewsets, and management commands. The codebase demonstrates strong software engineering patterns such as a modular parser contract, an abstract location manager for feature-flag-driven migration, and an authorization filter registry, but carries technical debt from a dual API surface and an incomplete migration to a new location model.

FairEmail is a fully-featured, open-source, privacy-oriented email client for Android. It supports IMAP, POP3, SMTP, OpenPGP, S/MIME, and OAuth for major providers (Gmail, Outlook, Yahoo). The app is built as a standard Android application with Activities, Fragments, Services, and WorkManager workers. It uses Room for local persistence, LiveData for reactive UI, and a custom async pattern (SimpleTask) for background operations. The codebase is notable for its extensive use of vendored libraries: it includes modified copies of JavaMail (javax.mail, com.sun.mail), AndroidX internals (Room, Paging, Emoji2, RecyclerView Selection), Google Protocol Buffers, and native language/encoding detection engines (CLD3, compact_enc_det). This hybrid approach provides deep email protocol support and privacy features like tracker blocking, certificate transparency, and DANE, but also introduces maintenance overhead and potential drift from upstream versions. The app integrates AI features (Gemini, OpenAI) for summarization and rule actions, and includes a full rule/filter engine. Despite the heavy vendoring, the core application code demonstrates solid engineering with clean abstractions, custom views that work around Android platform bugs, and a consistent async pattern. The repository is actively maintained with frequent releases and responsive issue triage.

Safety is a commercial CLI tool for software supply chain security, primarily scanning Python (and limited npm) dependencies for known vulnerabilities. It operates as a multi-command CLI built with Click and Typer, offering commands such as `scan`, `check`, `auth`, `firewall`, `init`, and `codebase`. The architecture is modular: a core scanning engine (`safety/scan/`) discovers dependency files (requirements.txt, pyproject.toml, Pipfile.lock, etc.), resolves packages, and matches them against a proprietary vulnerability database fetched from the Safety platform. Results are formatted via a pluggable formatter system (JSON, HTML, screen, text, SPDX) and can be uploaded to the platform for reporting. The tool also includes a firewall mode that intercepts pip/poetry/uv/npm install commands to block malicious packages in real time, using shell aliases (Unix) or registry/autorun (Windows). Authentication is multi-modal: OAuth2 (browser-based), API keys, and machine tokens, with a complex enrollment flow for enterprise MDM. An internal event bus (`safety/events/event_bus/bus.py`) provides async telemetry and audit trail emission, used throughout auth, init, and scan workflows. The codebase demonstrates strong engineering practices: layered configuration resolution (CLI > env > config file > default), a command wrapper pattern for package managers, and a policy file system (YAML) for ignoring vulnerabilities by severity, CVSS score, or expiration. However, there is notable technical drift: the legacy `check` and `license` commands are deprecated but still present, typing is incomplete in several modules, and the Windows firewall interceptor relies on fragile registry manipulation. The test suite is extensive but heavily mocks external services, making integration tests brittle. External dependencies include `httpx`, `authlib`, `tenacity`, `rich`, `pydantic`, `dparse`, `packaging`, `certifi`, `filelock`, and the proprietary `safety-schemas` package. The tool is distributed as a PyPI package and as a GitHub Action, with CI/CD pipelines building platform-specific binaries via PyInstaller and PyApp. Overall, Safety is a mature, feature-rich security tool with a well-architected core, though some areas show signs of rapid feature growth and legacy debt.

Strelka is a real-time, containerized file scanning system designed for threat hunting, detection, and incident response at enterprise scale. It is built with a Go frontend and manager components that handle gRPC client intake, Redis-based task coordination, and response logging (local, Kafka, S3), while Python backend workers execute over 50 file-format scanners. The system uses YARA rules for initial file classification ('taste'), then dispatches files to specialized scanners for metadata extraction, IOC detection, archive extraction, and malware analysis. It supports multiple client modes: oneshot (CLI), filestream (continuous file monitoring), and a Python client. Deployment is via Docker Compose or Kubernetes, with optional Envoy proxy and OpenTelemetry tracing. The architecture follows a microservices pattern: frontend (gRPC server), coordinator (Redis task queue), gatekeeper (dedup cache), manager (Redis management), and backend (Python scanner workers). Scanners are dynamically loaded and configured via YAML, with positive/negative flavor matching. The codebase includes extensive test fixtures and pytest tests for each scanner, CI/CD pipelines, and pre-commit hooks. While the system is production-ready and well-structured, it exhibits some code duplication across archive scanners, deprecated library usage (pylzma, old protobuf), and brittle subprocess calls for password cracking. Overall, it is a strong, maintainable security analysis platform.

This repository is primarily an 'awesome list' curating fuzzing (fuzz testing) resources - books, talks, papers, tools - organized by venue and type. The core content lives in a single README.md file. What distinguishes it from a simple list is a set of well-engineered Python scripts (ndss.py, sp.py, usenix.py) that automatically scrape conference accepted-paper pages (NDSS, IEEE S&P, USENIX Security) and match titles containing 'fuzz'. For IEEE S&P, the sp.py script goes further by verifying bibliographic metadata via the Crossref API before proposing entries, ensuring only validated DOIs are suggested. These scripts are triggered manually via GitHub Actions workflows, generating pull requests rather than writing directly. The code exhibits careful HTML parsing with validation, idempotent update logic, comprehensive error handling, and extensive unit tests. While the repository's primary output is a static list, the supporting automation demonstrates production-quality data collection and proposal pipelines that could be reused for maintaining other curated lists.

rnsec is a zero-configuration static analysis security scanner for React Native and Expo applications. It scans JavaScript/TypeScript, XML, plist, and JSON files for over 85 security rules covering storage, network, authentication, cryptography, logging, Android/iOS platform issues, and supply chain risks. The tool uses Babel AST parsing and regex pattern matching to detect hardcoded secrets, insecure configurations, and common vulnerabilities. It generates HTML, JSON, and Markdown reports, supports CI/CD integration with changed-files scanning, and can post results as GitHub PR comments. The architecture is a monolith CLI application built with Commander, with a modular rule engine that registers scanner groups. The codebase is well-structured, TypeScript strict, and includes comprehensive tests for all rules.

express-slow-down is an Express.js middleware library that rate-limits clients by slowing down responses instead of blocking them outright. It wraps `express-rate-limit` internally, using a custom handler that computes a delay based on request count and configurable options like `delayAfter`, `delayMs`, and `maxDelayMs`. The middleware increments a per-client counter (via a store, defaulting to an in-memory store), and when the count exceeds a threshold, it delays subsequent responses. It supports custom stores, async functions for dynamic delays, and standard/legacy rate-limit headers. The codebase is well-structured TypeScript with comprehensive unit and integration tests, and follows modern ES module and TypeScript practices.