This is a monorepo for Auth.js (formerly NextAuth.js), a framework-agnostic authentication library for web applications. The core engine (`@auth/core`) handles OAuth/OIDC, email/passwordless, credentials, and WebAuthn/Passkey authentication flows. It provides a unified API for session management (JWT or database-backed), CSRF protection, and cookie handling. The library is designed to be integrated into multiple frameworks via separate packages: `@auth/nextjs`, `@auth/sveltekit`, `@auth/express`, `@auth/qwik`, and `@auth/solid-start`. Each framework package adapts the core `Auth` function to the framework's request/response model, offering server-side handlers, middleware, and client-side hooks. The repository also includes over 80 built-in OAuth/OIDC provider definitions (e.g., Google, GitHub, Discord, Auth0) and 20+ database adapters (e.g., Prisma, Drizzle, MongoDB, PostgreSQL, DynamoDB) that implement a standard `Adapter` interface for user persistence. The project is now part of Better Auth, and the README recommends new projects use Better Auth unless specific feature gaps exist. The monorepo contains development apps, example applications, and a comprehensive documentation site built with Nextra.
Nuxt Security is a Nuxt 3+ module that automatically configures applications to follow OWASP security patterns through HTTP headers and middleware. It provides security response headers (including CSP with nonce/hash support for SSR/SSG), request size and rate limiting, XSS validation, CORS support, and optional features like Basic Auth and CSRF protection. The architecture uses Nitro plugins to integrate with Nuxt's server lifecycle, separating concerns between configuration, middleware, build-time plugins, and runtime hooks. The module handles both SSR and SSG modes appropriately, using nonces for CSP in SSR and computed hashes for SSG, with proper strict-dynamic support.
Pikachu is a deliberately vulnerable web application built as a training ground for web penetration testing, covering common security flaws such as SQL injection, XSS, CSRF, RCE, file inclusion, unsafe file upload/download, SSRF, XXE, and deserialization. It is a LAMP stack (PHP + MySQL + Apache) monolith using a legacy Ace Admin template and Bootstrap 3. The codebase is organized into vulnerability categories under `/vul/`, a main application for navigation and configuration, and a separate XSS management backend (`/pkxss/`) for collecting stolen cookies, phishing credentials, and keystrokes. The project intentionally uses insecure coding patterns (e.g., raw SQL concatenation, `eval()`, `unserialize()` on user input) to demonstrate exploitation, and includes some secure alternatives for comparison. The repository is explicitly marked as 'asleep' by its authors, who recommend a successor project. It is not suitable for production deployment but serves as a valuable educational resource for security students and CTF players.