Awesome Privacy is a curated directory of privacy-respecting software and services, accessible via a public website and API. The repository centers around a single source of truth YAML file (`awesome-privacy.yml`) that catalogs tools across categories like Essentials, Communication, and Security Tools. This data is processed by a Python-based toolchain (`lib/`) for validation, changelog generation, and README updates, while a modern web frontend (`web/` built with Astro and Svelte) provides interactive browsing and search, and a TypeScript API backend (`api/` using Hono) serves JSON endpoints and enriches service data with metadata from external sources like GitHub, Docker Hub, and app stores. The architecture cleanly separates data, processing, and presentation layers, with robust caching, rate limiting, and authentication in the API, and client-side search via MiniSearch in the web app. The project emphasizes maintainability through automated PR checks, dependency management, and clear contribution guidelines, though it relies on numerous third-party APIs for enrichment, introducing potential external dependency risks.
MSTICpy is a Python library for cybersecurity threat hunting and investigation, primarily designed for use in Jupyter Notebooks. It provides a unified interface to query multiple data sources (Azure Sentinel, Splunk, Kusto, MDE, etc.), enrich data with threat intelligence and geolocation, perform anomaly detection and process tree analysis, and visualize results with interactive timelines, maps, and graphs. The architecture follows a modular, plugin-based design: data drivers abstract away backend-specific protocols, threat intelligence providers are registered via a consistent base class, and a pivot framework dynamically attaches investigation functions to entity types. The library also includes configuration editors, Azure authentication helpers, and notebook widgets to streamline analyst workflows. While the core purpose is security analysis, the repository also contains substantial research-oriented components, such as anomalous sequence detection (Markov models on command sessions), time-series anomaly detection, and event clustering. These are packaged alongside the production-grade query and enrichment infrastructure, making the repo a hybrid of an application library and a data analysis toolkit. The codebase is well-tested with extensive unit and integration tests, though many require mocked or optional external services. Key entry points include the `QueryProvider` class for data acquisition, `TILookup` for threat intelligence, `Pivot` for entity-driven investigations, and the `mp` pandas accessor for inline transformations. External dependencies span Azure SDK, Bokeh, ipywidgets, and multiple third-party APIs, which introduces some maintenance overhead. Overall, MSTICpy is a mature, actively maintained tool that demonstrates strong engineering practices with reusable patterns, but some modules show signs of version drift and compatibility workarounds.
iKy (I Know You) is a modular OSINT (Open Source Intelligence) aggregation platform built with FastAPI, Celery, Redis, and an Angular frontend. The system ingests a username or email and concurrently executes 26+ parallel tasks across social media, data breaches, search engines, and dark web sources, returning a structured JSON contract (module, param, validation, raw, graphic, profile, timeline, tasks) consumed by a visual graph/timeline UI. Key architectural patterns include a dynamic module registry that maps route names to Celery task paths, a decorator-based task wrapper (@iky_task) that centralizes dev-mode golden-file bypass, error classification, and performance logging, and a pluggable search provider orchestration layer. The codebase demonstrates a strong separation of concerns between API routing, task execution, and data enrichment, but suffers from fragile scraping logic (LinkedIn RSC parsing, TikTok SSR regex), heavy reliance on browser session cookies, and several deprecated external APIs (Twitter v1.1, FullContact). The project is actively maintained with an extensive test suite (~4K lines) and Docker Compose deployment, though many tests are heavily mocked and may not detect real API drift.