recheck is a monorepo for a ReDoS (Regular expression Denial of Service) vulnerability checker, written in Scala 3 and cross-compiled to JVM and JavaScript via Scala.js. The system parses regular expression patterns, builds an execution model, and detects catastrophic backtracking vulnerabilities. It exposes multiple interfaces: a core library (`recheck-core`) with a high-level `ReDoS.check` API, a CLI (`recheck-cli`) with `check` and `batch` subcommands (the latter using JSON-RPC over stdio), JavaScript bindings (`recheck-js`) for browser/Node usage, and an ESLint plugin (`eslint-plugin-redos`) for CI integration. The architecture is a multi-module sbt build with Lerna/pnpm for JS workspace management, featuring clean separation between parsing, execution, unicode data, and platform-specific adapters.
objection is a runtime mobile exploration toolkit powered by Frida, designed for security testing of iOS and Android applications without requiring jailbreak or root access. It provides an interactive REPL (objection explore) that lets security researchers bypass SSL pinning, dump keychain/keystore data, monitor cryptographic operations, inspect heap memory, hook methods, and bypass jailbreak/root detection — all by injecting a Frida agent into the target process. Architecture: The Python backend handles CLI commands, device state management, and patching (injecting Frida gadget into IPA/APK files). The TypeScript agent running inside the mobile app exports RPC methods for platform-specific features (Android: hooking, keystore, intents; iOS: keychain, crypto, biometrics). Communication happens over Frida's bi-directional transport. A Flask API server exposes RPC and script endpoints for remote control. The system uses a centralized state layer (connection, device, jobs) and a plugin system for extensibility. Key entry points: 'objection explore' (REPL), 'objection patchapk'/'objection patchipa' (binary patching), 'objection api' (API server), and the agent entry point in 'agent/src/index.ts'. External dependencies include frida, frida-tools, frida-fs, frida-screenshot, Flask, apktool, and GitHub API for gadget downloads. The codebase is well-structured for mobile security automation but shows some drift with deprecated CLI flags, Python 2 compatibility checks, and TODOs for advanced hooking targets.
This repository is a documentation-focused resource providing security guidelines for SaaS startups organized by company growth phases. It contains no executable code or data processing pipelines, but rather offers educational content in Markdown format covering topics from basic security hygiene (password management, encryption) to advanced compliance and incident response strategies. The material is structured as a practical guide referencing real-world scenarios and external resources, with accompanying images illustrating key concepts. While not a software project, it functions as a reusable knowledge base that engineers can reference when implementing security practices in early-stage startups.
This repository hosts the SLSA (Supply-chain Levels for Software Artifacts) specification, a security framework for software supply chain integrity. It is primarily a documentation and specification project, not a software application or a data pipeline. The repository contains the normative specification documents (e.g., build provenance, source requirements, dependency track), a Jekyll-based website for versioned publication, tooling scripts for linting and version management, and CI/CD workflows for maintaining the site. It defines formal attestation schemas in Protobuf and CUE, provides threat models and security principles, and includes community blog posts and how-to guides. While not a standalone deployable application, it serves as the authoritative reference for SLSA levels, tracks, and verification protocols, and its reusable patterns (provenance predicate formats, site navigation components, assessment prompts) can be adopted by other security specification projects.
envio is a Rust CLI tool for managing environment variables in encrypted profiles. It creates, edits, imports, exports, and deletes profiles stored as `.envio` files in a project's `.envio/profiles` directory. The profiles can be plaintext or encrypted using passphrase (Argon2id + XChaCha20Poly1305), symmetric key (base64-encoded 32-byte key + XChaCha20Poly1305), or GPG (delegates to the system `gpg` CLI). The tool integrates with the OS keyring to store encryption keys and provides both a command-line interface and a TUI (beta) built with ratatui. The architecture cleanly separates library code (profile, cipher, env map) from binary code (CLI, TUI, prompts). The library is reusable for other Rust projects needing profile-based encrypted env management, though cipher types are somewhat coupled to the crate's error types. The encryption implementations demonstrate solid security practices (Argon2id password hashing, XChaCha20Poly1305 AEAD with streaming). The CI/CD pipeline builds for multiple platforms and generates shell completions and man pages at compile time. The project lacks unit tests in the visible source tree, which is a notable gap.
This is an Ansible role and playbook collection that automates the hardened installation of the OpenClaw messaging gateway on Debian/Ubuntu Linux systems. It provisions a dedicated system user, installs Docker CE with UFW-based firewall and DOCKER-USER chain isolation, configures fail2ban and unattended-upgrades, sets up Node.js and pnpm, and installs OpenClaw either from npm (release mode) or from a Git checkout (development mode). The role does not configure the application or install its systemd service—those steps are left to the operator via `openclaw onboard --install-daemon`. It supports remote deployment via inventory and includes CI tests for syntax, linting, and integration. The codebase is well-structured, security-conscious, and actively maintained, though it does not contain independently extractable components suitable for reuse outside this project.
buji-pac4j is a bridge library that integrates pac4j (a comprehensive security library supporting OAuth, CAS, SAML, OpenID Connect, etc.) with Apache Shiro. It automatically pushes pac4j authentication and authorization profiles into the Shiro security context, allowing developers to use pac4j's wide range of authentication mechanisms while leveraging Shiro for authorization and session management. The bridge is implemented as a set of classes that adapt pac4j's session store, profile manager, and framework adapter to Shiro's APIs, plus a custom Realm, SubjectFactory, and Token. It includes sophisticated logic to avoid unnecessary session renewal when the same user's profiles are updated (e.g., after token refresh), demonstrating deep understanding of both frameworks' internals. The library is production-ready, actively maintained, and used in legacy applications that want to adopt pac4j without fully migrating away from Shiro.
SILENTCHAIN AI™ Community Edition is a Burp Suite extension that performs AI-powered passive vulnerability scanning of HTTP traffic. It intercepts requests/responses through Burp's proxy, sends them to configurable AI providers (Burp AI, Ollama, OpenAI, Claude, Gemini, Azure), and generates OWASP Top 10 vulnerability findings. The extension features a modular architecture with a thread pool for background AI processing, Swing-based UI integrated into Burp Suite, and persistence for settings via Burp's preferences API. Key capabilities include bidirectional data sanitization to prevent leaking secrets to AI providers, robust JSON parsing for handling LLM output inconsistencies, layered HTTP filtering (scope, content-type, rate limiting, URL deduplication), and real-time UI updates showing findings, task status, and statistics.
This repository is the core runtime and management infrastructure for the WildFly application server (formerly JBoss AS). It provides a model-driven management interface accessible via CLI, HTTP, and native remoting, enabling configuration, deployment, security, logging, patching, and domain/standalone server lifecycle management. The architecture is modular, with subsystems (controller, server, host-controller, cli, elytron, logging, threads, etc.) built on JBoss Modular Service Container (MSC) for service lifecycle and dependency injection. Key entry points include the CLI (CommandContext, CommandLineMain), management interfaces (HTTP, native remoting), and server bootstrap (Main, BootableJar). Data flows center on management operations processed through OperationContext/OperationStepHandler, configuration persisted as XML, and deployments processed through a DeploymentUnitProcessor chain. External dependencies include JBoss MSC, JBoss Modules, Elytron security library, Aesh CLI framework, and various Java standard libraries. The codebase demonstrates strong engineering practices with extensive use of builder patterns, state machines, strategy patterns, and a comprehensive validation framework, though it carries some technical debt from deprecated APIs and version sprawl across multiple schema versions.
Cloudflare's CFSSL is a comprehensive PKI/TLS toolkit written in Go, providing both a command-line interface and an HTTP API server for certificate lifecycle management. It handles certificate signing, chain bundling, revocation (CRL/OCSP), TLS scanning, key generation, CSR creation, and CA initialization. The system is modular, with separate packages for CLI commands, API handlers, signers (local/remote), certificate database abstraction (SQLite/MySQL/PostgreSQL), a bundler with chain optimization, an OCSP responder, a TLS scanner, and a transport layer for automated mutual TLS. It uses interface-based design for pluggable backends (signers, database accessors, key providers, trust stores) and includes features like multi-root CA support, pre-issuance linting via zlint, certificate transparency embedding, ubiquity scoring for chain selection, IP whitelisting, HMAC authentication, Prometheus metrics, and post-quantum cryptography (ML-DSA). The codebase also contains custom cryptographic implementations (MD5, SHA-1, SHA-256, SHA-512) with assembly-optimized blocks for performance. While actively maintained with CI/CD and extensive tests, some components show technical drift (pinned Go 1.27, forked TLS library, legacy algorithm support).
Unicorn Engine is a lightweight, multi-architecture CPU emulation framework derived from QEMU. It provides a pure C API with bindings for Python, Go, Java, Rust, Ruby, .NET, Haskell, Pascal, Zig, and VB6. The engine supports ARM, ARM64, M68K, MIPS, PowerPC, RISC-V, S390X, SPARC, TriCore, and x86 (16/32/64-bit). It is used primarily for security research, reverse engineering, fuzzing, and dynamic analysis of binary code. The architecture is a library with a central C API that exposes memory mapping, register access, hooks (code, block, memory, interrupt, instruction, syscall, TLB), and context save/restore. The core emulation logic is based on QEMU's TCG (Tiny Code Generator) for dynamic binary translation, with a custom glib compatibility layer to eliminate external dependencies. The repository includes extensive regression tests, fuzz targets, and sample programs for each architecture and binding. While the engine is actively maintained and widely used, it carries technical debt from its QEMU fork (based on QEMU 5.0.1) and auto-generated binding constants that may drift from the C API.
Local Deep Research is a self-hosted, privacy-focused AI research assistant that performs deep, agentic research using multiple LLMs and web searches. It provides a full-stack web application (FastAPI + JavaScript), a programmatic API, and a Model Context Protocol (MCP) server. The system ingests user queries, decomposes them, executes parallel searches across web and academic sources (SearXNG, Google, arXiv, PubMed, Semantic Scholar, etc.), fetches and extracts content, evaluates evidence, and synthesizes reports with citations. It features per-user encrypted SQLCipher databases, a settings system with environment variable overrides, a RAG library with FAISS vector store, journal quality scoring, news subscriptions, and extensive security controls (egress policy, SSRF protection, credential scrubbing). The codebase is heavily tested with unit, integration, UI, accessibility, and security tests. It is a hybrid of a web application and a research data pipeline, but the dominant character is a production-grade application.
Flask-AppBuilder is a rapid application development framework built on top of Flask. It provides automatic CRUD generation from SQLAlchemy models, a comprehensive role-based security system with multiple authentication backends (database, LDAP, OAuth, SAML, OpenID, remote user), REST API generation with OpenAPI/Swagger, chart views, i18n, and a widget-based UI system. The architecture follows a Flask extension pattern with an AppBuilder class that registers views, menus, and permissions. It includes a security manager that handles authentication, authorization, and user management. The framework is used by major projects like Apache Superset and Apache Airflow. Key components: The security manager provides a pluggable authentication system with role-based access control, permission discovery, and API key management. The model views (ModelView, ModelRestApi) automatically generate CRUD interfaces and REST endpoints from SQLAlchemy models with filtering, sorting, and pagination. The framework includes a widget system for customizing list/show/form rendering, and a chart view system for Google Charts integration. The codebase is well-structured with clear separation of concerns, but shows some technical drift: outdated Bootstrap 3 UI, vendored JavaScript libraries, deprecated chart classes, and old translation files. The core security and CRUD functionality is actively maintained and production-ready.
Vanadium is a hardened fork of Chromium for Android, developed by GrapheneOS. It serves as both the default browser and the system WebView provider on GrapheneOS devices. The repository contains a large set of patches (over 300) applied to the Chromium source tree, modifying default settings to enhance privacy and security: disabling telemetry, network prediction, third-party cookies, safe browsing, sign-in, media router, background sync, sensors, and many other features. It enables strict security policies like HTTPS-only mode, strict site isolation, partitioned connections, and Do Not Track. The build system uses GN with custom extension files to inject downstream code into Chromium targets. A separate 'config APK' delivers runtime feature flags and ad-blocking filter lists. The repository also includes patches for GrapheneOS-specific OS integration (custom permissions, connectivity checks, seccomp-bpf sandboxing). The codebase is actively maintained with frequent rebases to upstream Chromium, but the high patch count introduces significant merge conflict risk.
OWTF (Offensive Web Testing Framework) is a full-stack web application for automated and manual penetration testing. The Python/Tornado backend exposes a JWT-protected REST API for managing targets, sessions, plugin worklists, workers, reports, and proxy history, while the React/Redux frontend provides dashboards, data tables, plugin marketplace, and proxy controls. The application also includes a customizable intercepting HTTP/HTTPS proxy with SSL certificate generation, an interceptor chain for header/body/URL/delay modification, transaction history, a repeater, and live interception - comparable in scope to a Burp Suite-style tool. Execution is plugin-driven: built-in Python plugins covering web, network, and auxiliary tests, plus wrappers around external tools like Nikto and Arachni, are run by multiprocessing workers. Community plugins can be uploaded after AST-based static validation that blocks dangerous imports and execution patterns. The system stores plugin outputs, deduplicates them via SHA-256 fingerprints, tracks execution metrics, and supports HTML reporting. User authentication includes JWT, email verification, OTP, and admin role management. Architecturally, this is a monolith with modular managers and a REST API, not microservices. Deployment targets Docker Compose, Kubernetes, and cloud Terraform. The codebase contains genuinely reusable components: AST-based plugin validation, cross-platform file locking, output fingerprint deduplication, structured logging, and SQLAlchemy query helpers. However, it also carries significant legacy debt: old frontend patterns (React 16 class components, Redux 3, Redux-Saga 0.16), Python 2 remnants in scripts, hardcoded secrets in compose files, and several stub or placeholder external plugins. The repository is fundamentally an application rather than a data research project; bundled dictionaries and execution metrics serve the security workflow but do not define its primary character.
FoalTS is a full-featured Node.js/TypeScript web framework structured as a monorepo with modular packages (core, CLI, JWT, TypeORM, GraphQL, storage, social auth, etc.). The framework provides declarative routing via decorators, a hook system for middleware/validation/authorization, dependency injection, and built-in support for OpenAPI, GraphQL, WebSockets, and file storage. Under the hood it uses Express, AJV, and TypeORM, with session stores for Redis, MongoDB, and SQL databases. The CLI generates projects, controllers, entities, and REST APIs, and includes upgrade commands across major versions. The codebase demonstrates solid engineering: thorough unit/e2e tests (over 2100 tests), documentation-as-tests, and a consistent pattern of abstract services (Store, Disk, Logger) resolved via configuration. Key reusable patterns include the hook/decorator system for validation and authentication, the abstract OAuth2 provider base class, and the CLI generator template engine. However, some deprecations (e.g., hashPassword→PasswordService) and outdated Docker images in development config indicate moderate technical drift. The project is actively maintained with frequent releases, daily CI on Node 22/24, and a well-documented upgrade path.
OpenUBA is a full-stack User and Entity Behavior Analytics (UEBA) platform for security anomaly detection, investigation, and response. It provides a complete lifecycle for ML models (install, train, infer, version, share) via a pluggable registry supporting OpenUBA Hub, GitHub, HuggingFace, and local filesystem. The platform includes a rule engine with a visual DAG-based builder (ReactFlow), case management, real-time dashboards, multi-backend visualization (matplotlib, plotly, bokeh, etc.), and an LLM-powered assistant. The backend is built on FastAPI with PostgreSQL, SQLAlchemy, JWT/RBAC authentication, and optional Spark/Elasticsearch integrations. The frontend uses Next.js 14 (App Router), Apollo Client (GraphQL), shadcn/ui, and Recharts. A Python SDK enables programmatic access to all features. The system runs on Kubernetes with a Kopf operator managing custom resources (UBATraining, UBAInference, UBAWorkspace, UBAPipeline) for containerized model execution in isolated Docker images per ML framework (sklearn, PyTorch, TensorFlow, NetworkX). While primarily an application, it includes research-oriented components like experiment tracking, feature store, and Jupyter notebook workspaces, making it a hybrid tool for both security operations and data science workflows.
androidqf is a Go-based Android forensic data acquisition tool designed to collect various types of data from an Android device via ADB. The tool automates the gathering of device properties, system logs, running processes, services, settings, diagnostic information, installed applications (with optional APK extraction), and device backups. It stores the collected data in a timestamped directory and optionally encrypts and compresses the archive using age encryption if a public key is provided. The application follows a modular architecture where each data collection task is implemented as a separate module adhering to a common interface. The core components include a cross-platform ADB wrapper that automatically deploys platform-specific binaries, an asset embedding mechanism for distributing native dependencies, and an acquisition manager that handles the lifecycle of data collection and secure storage. The tool interacts with the device through ADB commands, collects data into structured files and directories, and provides user prompts for configurable options such as backup scope and APK selection. Despite the README indicating the project is not maintained, the repository shows recent commit activity and the codebase demonstrates solid engineering practices. Dependencies are up to date, and the tool is built for cross-platform use (Windows, macOS, Linux) with automated build and release workflows. The modular design allows for extensibility, and the reusable components (such as the ADB wrapper and asset deployment) could be adapted for other projects requiring Android device interaction.
ClawBands is a security middleware for OpenClaw AI agents that provides runtime interception with human-in-the-loop approval. It hooks into OpenClaw's plugin system to intercept tool executions (file operations, shell commands, network requests) and enforces policy-based decisions before allowing potentially dangerous actions. The system operates in two modes: terminal mode with interactive prompts, and channel mode (WhatsApp/Telegram) using a special response tool. Every decision is logged to an immutable JSON Lines audit trail, and statistics are tracked. The architecture features clean separation of concerns with distinct modules for policy interception, decision arbitration, approval queuing, logging, and storage.
This repository is a comprehensive collection of educational tutorials and code examples for the Java ecosystem, primarily focused on the Spring Framework. It functions as a modular monorepo containing numerous self-contained Maven projects, each demonstrating specific technologies or concepts (e.g., Spring Boot, Spring Security, JPA, Kafka). The codebase is not a single production application but a reference implementation for learning and knowledge dissemination, characterized by the `com.baeldung` package naming convention. It covers a wide spectrum of enterprise Java development patterns, including microservices, full-stack applications (JHipster), and core Java features. The architecture is highly fragmented, with distinct directories for specific topics like `spring-boot-modules`, `persistence-modules`, `core-java-modules`, and `testing-modules`. Each module typically contains an `Application.java` entry point and is designed to be runnable in isolation. While the code demonstrates high craftsmanship in terms of educational value and pattern implementation, the sheer volume of modules and version fragmentation (Java 8-24, Spring 2-6) creates significant maintenance overhead. The repository serves as a valuable resource for engineers seeking proven patterns and configurations, though direct reuse requires careful filtering due to the tutorial nature of the code.