This is a full-stack web application for performing open-source intelligence (OSINT) analysis on any website. The system runs 40+ checks encompassing DNS, SSL/TLS, HTTP security headers, mail configuration (SPF/DKIM/DMARC), social media presence, trackers, blocklists, threat feeds, carbon footprint, tech stack, and more. The frontend is built with Astro and React, featuring a reactive results view with a masonry grid, advisory panel, and progress bar. The backend is a Node.js Express server (also serverless-friendly) with individual API handlers per check, wrapped in a common middleware layer for error handling, rate limiting, and skip logic. The application is designed for self-hosting and supports deployment to Vercel, Netlify, Docker, Render, and Fly.io. It relies on many external sources (DNS, WHOIS, SSL Labs, HIBP, Google Safe Browsing, Shodan, etc.) and uses Puppeteer/Chromium for headless browser tasks. The codebase demonstrates a clean modular architecture, reusable UI components, and a novel analysis rule system that transforms raw data into structured findings with severity levels.
Shannon is an autonomous, white-box AI penetration testing platform that orchestrates multi-agent workflows via Temporal to analyze source code, identify attack vectors, and execute real exploits against running web applications. The system is structured as a pnpm monorepo with two primary applications: a CLI (`apps/cli`) that provides the user-facing interface for launching scans, and a worker (`apps/worker`) that runs the actual pentest pipeline inside Docker containers. The architecture follows a multi-agent pipeline pattern with 13 specialized agents (pre-recon, recon, 5 vulnerability analyzers, 5 exploiters, and a report generator) coordinated through Temporal workflows for reliability and resumability. The codebase demonstrates strong software engineering practices with a clear separation of concerns between Temporal orchestration (activities/workflows), pure domain logic (services), and infrastructure concerns. The worker implements a sophisticated DI container pattern, comprehensive audit logging with crash-safe append-only streams, and a custom error classification system that maps errors to Temporal retry behavior. The system supports multiple LLM providers (Anthropic direct, AWS Bedrock, Google Vertex AI, custom proxies) and implements defense-in-depth billing detection, git checkpointing for workspace rollback, and parallel agent execution with mutex-protected shared state. Key architectural strengths include the deterministic renderer pattern (MCP tool calls → markdown without LLM in the loop), the injectable provider interfaces for extensibility, and the sophisticated session management that enables resumable workspaces. The codebase uses TypeScript with strict compiler options, implements a Result type for explicit error handling, and maintains comprehensive type definitions. The CI/CD pipeline includes semantic releases, Docker image signing with cosign, and multi-platform builds. The system processes vulnerability queues through Zod-validated structured outputs and maintains forensic audit trails of all agent executions with timing, cost, and model metadata.
MySQLTuner-perl is a single-file Perl script for MySQL/MariaDB/Percona Server performance tuning and advisory. It connects to live database instances, collects metrics via SHOW commands, information_schema, and performance_schema, then provides actionable recommendations for performance, security, and resilience. The tool outputs in multiple formats (console, JSON, YAML, HTML, CSV) and includes advanced features like weighted health scoring (0-100), predictive capacity analysis, CVE vulnerability checking, replication analysis, and AI agent integration via --agent-json or MCP server. The repository enforces strict governance: zero CPAN dependencies in the main script, test-driven development, conventional commits, and automated release processes. Auxiliary scripts handle CVE updates, EOL synchronization, compliance checking, and release generation, all while maintaining high code quality and version consistency.
This repository is the official open-source companion to Anthropic's Claude Code—an agentic AI coding assistant that operates in the terminal. It is not the core Claude Code binary (distributed separately via npm/brew/install scripts), but rather the plugin ecosystem, example configurations, CI automation scripts, and infrastructure-as-code templates that extend and support the tool. The repo contains 13 first-party plugins (e.g., security-guidance, code-review, feature-dev, commit-commands, pr-review-toolkit, hookify, plugin-dev), each defining hooks, commands, agents, and skills that integrate with Claude Code's extensibility framework. It also provides production-grade Terraform modules for deploying a Claude Code Gateway on AWS (ECS Fargate + RDS + Bedrock) and GCP (Cloud Run + Cloud SQL + Vertex AI), along with enterprise MDM settings (macOS plist/mobileconfig, Windows ADMX, Intune scripts) and managed settings templates. A suite of GitHub Actions workflows handles automated issue triage, duplicate detection, lifecycle management, and code review, all using Claude Code itself as the automation engine. The repository is primarily a configuration and extension catalog rather than a standalone application; its value lies in demonstrating the plugin architecture and providing reusable patterns for AI-assisted development workflows.
The RustSec monorepo is a multi-crate workspace that provides the official security audit toolchain for the Rust ecosystem. Its flagship product is `cargo-audit`, a CLI subcommand for Cargo that scans `Cargo.lock` files against the RustSec Advisory Database to detect known vulnerabilities, unmaintained or unsound crates, and yanked packages. The workspace also includes the `rustsec` core library for managing the advisory database (fetched via git, indexed, and queried), `cargo-lock` for parsing and manipulating Cargo.lock files (supporting V1 through V4 format), `cvss` for parsing and scoring CVSS vectors (v2.0, v3.x, v4.0), `platforms` for programmatic access to Rust target triples, and `admin` for maintaining the advisory database and generating the rustsec.org website. Although primarily an application and library toolset, the repository has data-oriented aspects: the advisory database is a curated set of Markdown files with TOML front matter, and `platforms` is auto-generated from rustc target information. The architecture is modular, with each crate independently usable and well-tested, and CI pipelines ensure cross-platform releases and static analysis.
Secureblue is a security-hardened Linux distribution project built on Fedora Atomic (Silverblue, Kinoite, Sericea, Cosmic, IoT, and SecureCore variants). It produces bootable OCI container images via BlueBuild recipes and GitHub Actions CI, applying extensive hardening: kernel module blacklists, hardened kernel arguments, sysctl tuning, SELinux policy enforcement, systemd service lockdowns, setuid removal, secure boot with UKI signing, and DNS hardening. The runtime includes a comprehensive audit tool (audit_secureblue.py) that verifies security posture across ~30 categories with i18n support, plus interactive ujust commands for toggling hardening features.
Sacremoses is a Python 3 library and CLI tool that reimplements the Moses tokenizer, detokenizer, and truecaser for natural language preprocessing. It provides exact, deterministic text segmentation and normalization for over 30 languages, with specific handling for non‑breaking prefixes, Unicode character properties, and protected patterns. The code is structured as a standard Python package with a `click`‑based CLI entry point, modular tokenization/truecasing modules, and a robust test suite that includes security regression tests. The repository also contains an `audit/` directory documenting a formal security review, with attack scripts and fixed vulnerabilities — a sign of strong engineering discipline for a language‑processing library. A notable architectural decision is the `data‑as‑code` pattern: instead of reading non‑breaking prefix lists and Perl Unicode property files at runtime, the package ships auto‑generated Python modules (`_data_nonbreaking_prefixes.py`, `_data_perluniprops.py`) that contain the same data as dictionary and set literals. This eliminates file‑I/O attack surfaces and simplifies distribution. The generation tool (`tools/generate_data_modules.py`) is itself a clean, reusable script that could be adapted to embed any tabular linguistic resource into a library without runtime file access. The library has undergone a security audit, and several fixes (dependency floors tied to CVEs, bounds on protected patterns, safe temp‑file creation) are baked into the codebase. While the core tokenization logic is a direct port of the Moses Perl script, the implementation shows careful attention to edge cases, concurrency support via `joblib`/`tqdm`, and compatibility with both Python 2 (last supported version) and Python 3. The main technical drift risk comes from static Unicode property snapshots that may lag behind the Unicode standard, but the architecture makes updates straightforward by regenerating the modules. Overall, Sacremoses is a well‑engineered, security‑conscious, production‑ready NLP preprocessing library. It is actively maintained (497 stars, no unresolved Dependabot alerts, recent commits), follows modern packaging conventions, and provides a drop‑in replacement for the Moses tokenizer in Python native code. Its reusable patterns — especially the data‑as‑code embedding and the security audit harness — are valuable for any library that must distribute static linguistic data without introducing file‑I/O vulnerabilities.
DSInternals is a comprehensive .NET library and PowerShell module for Active Directory security auditing, forensic analysis, and offline/in-place manipulation of AD databases. It provides the ability to extract password hashes (NT, LM, Kerberos), decrypt DPAPI backup keys, recover LAPS and gMSA secrets, parse FIDO2/Windows Hello key credentials, and query DNS zones and signing keys. The library supports multiple access modes: offline via ESENT/ISAM (ntds.dit), online via RPC replication (DRSR), LDAP/ADSI, and SAM/LSA native APIs. The PowerShell module exposes over 50 cmdlets organized into logical groups (ADDB, ADRepl, ADSI, LSA, SAM, Hash, Encryption). The codebase is heavily oriented toward reverse-engineering of Microsoft's internal AD structures and protocols, with extensive unit tests using real-world binary vectors. While the primary use case is security auditing (e.g., penetration testing, incident response), the library also provides utilities for password quality testing, domain controller recovery, and offline account modifications. The architecture is modular, with clear separation between common data models, data store access, replication, and PowerShell cmdlets, making it a robust toolkit for Windows domain administrators and security professionals.
KubeHound is a security analysis tool for Kubernetes clusters that automatically models and computes attack paths. It collects Kubernetes resources (pods, roles, bindings, endpoints, nodes) via a live API or offline dump, transforms them into a property graph stored in JanusGraph (with MongoDB as an intermediate store), and computes privilege escalation and lateral movement paths mapped to MITRE ATT&CK techniques. The system exposes a CLI for local analysis and a gRPC API (KHaaS) for service-oriented deployments, with optional Jupyter notebooks for querying the graph using a custom Gremlin DSL. The architecture is modular: a collector abstraction handles rate-limited streaming from the Kubernetes API; an ingestion pipeline converts raw objects into normalized store models and graph vertices/edges; an edge registry defines over 20 attack types (e.g., PodExec, TokenSteal, ContainerEscape); and a graph builder executes Gremlin traversals to connect vertices into paths. Storage layers use asynchronous writers with micro-batching for high throughput, and an in-memory cache deduplicates identities and roles. Telemetry (Datadog APM, metrics, logs) is integrated throughout. While primarily an application, the repository includes experimental research components (exp/khaudit) for audit reports and MITRE Attack Flow conversion, plus Jupyter notebooks for interactive graph queries, giving it a hybrid character. The codebase demonstrates strong engineering practices: provider interfaces, test mocking, worker pools, retry logic, and comprehensive system tests against real Kind clusters. However, some areas (large cluster optimizations, experimental code, deprecated flags) indicate ongoing evolution and minor technical debt.
This is the official curated marketplace and development toolkit for Claude Code plugins, maintained by Anthropic. It contains both first-party plugins (e.g., claude-security, code-modernization, hookify, skill-creator, security-guidance) and third-party channel integrations (Discord, iMessage, Telegram, GitHub, Linear, etc.). The repository serves dual roles: as a plugin registry with standardized packaging (SKILL.md, agent definitions, hooks, commands, MCP servers) and as a meta-development kit providing tools for authoring and validating new plugins. The codebase is predominantly instructional content for Claude Code (markdown workflows, agent system prompts, skill references) orchestrated through hooks, workflows, and commands. While many plugins contain only reference documentation and no executable code, security-critical plugins like claude-security and security-guidance include sophisticated Python/JavaScript logic for vulnerability scanning, patch generation, session state management, and git diff analysis. The CI pipeline enforces licensing (Apache 2.0), validates plugin structure, checks MCP URL liveness, and manages SHA-pinned external plugin versions. The project is actively maintained but exhibits technical drift from duplicated access-control logic across channel servers, hardcoded model references, and reliance on Claude Code CLI internals that may change between versions.
testssl.sh is a mature, command-line Bash tool for comprehensive TLS/SSL security auditing of network services. It tests cipher support, protocol versions (SSLv2 through TLS 1.3), cryptographic vulnerabilities (Heartbleed, CCS, ROBOT, BEAST, POODLE, LOGJAM, FREAK, and many others), certificate validation, HTTP security headers, and STARTTLS on a wide range of protocols. The tool works by performing socket-level TLS handshakes and comparing results against embedded data files. It also includes a client simulation feature that replays ClientHellos from over 100 real-world browsers and libraries to detect server behavior differences. The architecture is a single large Bash script (testssl.sh) with supporting data files under etc/ and utility scripts in utils/. It is driven by command-line options and environment variables, producing output in terminal color, JSON, CSV, HTML, and log formats. The project has active maintenance with a thorough test suite and CI pipelines, though some data sources (e.g., SSL Labs API) are deprecated, and the client simulation data requires manual updates.
This is a single-file Bash script that performs a comprehensive security and performance audit of a Linux VPS. It checks SSH configuration, firewall status, intrusion prevention systems (Fail2ban/CrowdSec), failed login attempts, system updates, running services, open ports, disk/memory/CPU usage, sudo logging, password policy, and SUID files. The script outputs color-coded PASS/WARN/FAIL results to the console and writes a detailed timestamped report to a file. It is designed for Ubuntu/Debian-based systems and requires root or sudo privileges. The architecture is a monolithic Bash script with no external dependencies beyond standard Linux utilities and optional tools like UFW, Fail2ban, and Docker. The code is well-structured with configurable thresholds and file paths, demonstrating solid Bash scripting practices. However, it is not designed for reuse as a library; it is a standalone tool.
GDA (GJoy Dex Analyzer) is a Windows-native, closed-source Dalvik bytecode decompiler and Android APK reversing tool, written in C++. It provides a GUI for interactive analysis, a CLI for batch operations, and a socket-based server for programmatic access. The open-source components in this repository include Java and Python plugin APIs for scripting analysis tasks (e.g., string decryption, method tracing), example scripts, and skill definitions for LLM-driven automated malware analysis. The core decompiler is not open source, but the plugin interfaces and skill scripts are well-structured and reusable for integrating GDA with other tools or AI agents. The repository also contains color themes, documentation images, and a DEX patching utility.
Aaia is a security analysis tool for AWS IAM and Organizations that visualizes identity and access relationships in a Neo4j graph database. It collects AWS data via CLI commands, stores it as JSON, and loads it into Neo4j for graph-based querying and auditing. The architecture consists of a modular Python application with separate components for data collection, loading into Neo4j, and custom auditing modules. Key entry points include the main Aaia.py script, the Aaia_aws_collector.sh shell script for data gathering, and specialized action/module handlers. The data flow moves from AWS CLI → JSON files → Neo4j graph → analysis results via Cypher queries or custom modules. The tool depends on Neo4j (v3.5.17 compatible), AWS CLI, and several Python packages for policy processing and Neo4j interaction.
This is a single-file Python CLI tool that audits GitHub organizations by fetching repository lists, team structures, team memberships, direct collaborator rights, and deploy keys via the GitHub API. It uses PyGithub for API interaction, requests_cache for caching, and python-decouple for configuration. Output can be directed to stdout, CSV files, or both. The tool is straightforward and functional, with environment variable validation and a clean main function. However, it is monolithic with no modularization, no unit tests, and limited reusability. It serves a specific DevOps/security auditing use case and is actively maintained with CI workflows and semantic versioning.
This repository is the aaPanel (BaoTa) Linux server management panel, a comprehensive web-based administration tool for hosting environments. It manages websites (Nginx/Apache), databases (MySQL, PostgreSQL, MongoDB), Docker containers, SSL certificates, firewalls, FTP, scheduled tasks, backups, and system security auditing. The backend is built with Python (Flask) and follows a modular architecture with a legacy `class/` directory and a newer `mod/` structure, using a dynamic plugin loader for extensibility. The frontend is a Vue 3 single-page application with module federation, incorporating rich text editing (CKEditor), code editing (Monaco/Ace), and real-time task monitoring. The system also includes a comprehensive security compliance framework with over 50 audit check modules, WebAuthn support, and a multi-channel notification system (email, WeChat, DingTalk, Feishu, SMS). Despite its broad functionality and active use, the codebase exhibits significant technical debt including hardcoded paths, dual codebases, vendored third-party assets, and inconsistent error handling, which limits portability and maintainability.