mise is a unified CLI tool for managing development environments. It combines tool version management (like asdf), environment variable injection, task running, dotfiles management, system package bootstrapping, and OCI image building into a single command-line interface. The system is implemented in Rust as a workspace of multiple crates, with a plugin system based on Lua (vfox) and support for many backends (asdf, aqua, npm, cargo, pipx, Homebrew, etc.). It also includes supply-chain security features via Sigstore attestation verification and packslip signing. The architecture is a modular Rust CLI with async I/O (tokio), a plugin system for tool backends, a configuration layer that merges TOML files with environment variables, and a task runner with dependency graphs and file watching. Key entry points include the main binary (src/main.rs), CLI subcommands in src/cli/, backend implementations in src/backend/, and the Lua plugin runtime in crates/vfox/. External dependencies include GitHub API, npm registry, aqua registry, Sigstore TUF repositories, and various system package managers (apt, brew, dnf, etc.). The codebase demonstrates high craftsmanship with clean abstractions (Backend trait, TaskFileProvider, SingleReport), reusable utility crates (mise-util, mise-dotenv, mise-cache-core), and extensive testing (unit, integration, e2e). Notable subsystems include an interactive TOML editor with undo support, a comment-preserving document parser, a remote cache protocol with OIDC authentication, and a documentation showreel generator with custom animation and audio. The project is actively maintained with frequent commits, comprehensive CI/CD, and a large community (34k+ stars).
A Python 3.14+ CLI tool (stdlib only) for detecting malware in packages from the Arch User Repository. It scans currently installed AUR packages, historical pacman logs, systemd services, eBPF rootkit artifacts, and npm/bun/yarn/pnpm caches against configurable campaign-based threat lists (e.g., the June 2026 atomic-lockfile attack, CHAOS RAT 2025, Russian spam campaigns). The architecture is modular: campaign configuration is data-driven (JSON), the scanner is split into focused mixin classes (PackageMixin, SystemMixin, CacheMixin) combined via the AurScanner class, and all results are typed dataclasses. The package runs with zero external dependencies, has comprehensive unit tests, and includes an integration layer (pacman hook + systemd timer) for continuous monitoring. The code demonstrates high craftsmanship: strict typing, defensive I/O, locale-safe date parsing, cache-efficient file scanning, and a clean exit-code scheme based on Nagios conventions.
The OWASP AI Security Verification Standard (AISVS) is a community-driven, open-source framework providing a comprehensive set of verifiable security requirements for AI-enabled systems. Modeled after the OWASP Application Security Verification Standard (ASVS), it defines 12 control families (C01-C12) covering the entire AI lifecycle, from training data integrity and model lifecycle management to adversarial robustness and monitoring/logging. The repository is structured as a living standard with two parallel tracks: a locked, stable release (1.0/) and an active development version (1.01-dev/). Each requirement is backed by an extensive research wiki that details the threat landscape, notable incidents, tooling maturity, verification approaches, and open research questions. This makes the AISVS not just a checklist, but a deeply researched knowledge base for engineers, auditors, and security architects building and evaluating AI systems. It also includes appendices for a glossary, a controls inventory, and AI-assisted secure coding practices. Note: This is a documentation/specification repository, not a software application or data science project. Its quality is measured by the rigor of its research, the clarity of its requirements, and the maintainability of its structure.
sbomqs is a command-line tool and Go library for evaluating the quality and compliance of Software Bill of Materials (SBOM) documents. It parses SBOMs in CycloneDX, SPDX 2.x, and SPDX 3.0 formats and scores them against multiple industry standards: NTIA Minimum Elements (2021/2025/2026), BSI TR-03183-2 (v1.1, v2.0, v2.1), FSCT v3, OpenChain Telco v1.1, and an Interlynk comprehensive profile. The tool outputs scores, detailed compliance reports, and feature lists, and can be integrated with Dependency-Track and policy engines. It is used in production by several platforms and has been cited in academic research evaluating over 78,000 SBOMs. The codebase is well-structured with clean interfaces, extensive test coverage, and a modular architecture that separates parsing, scoring, compliance checking, and reporting. A notable architectural trade-off is the coexistence of two scoring engines (legacy v1 and v2), which adds complexity but allows incremental migration. The library is embeddable as a Go module, and the CLI supports multiple output formats (basic, detailed, JSON).
Bumblebee is a production-grade supply-chain inventory collector for macOS and Linux developer endpoints. It scans the filesystem for package metadata from lockfiles (npm, pnpm, yarn, bun, gomod, rubygems, composer), install receipts (Homebrew, Python dist-info, Go sum), extension manifests (VS Code, browser extensions), and MCP configuration files. The system outputs NDJSON records of installed packages and can optionally match them against operator-supplied threat intelligence catalogs to emit findings for known malicious packages. It is a single Go binary with zero runtime dependencies, designed for offline, read-only operation. Architecturally, it follows a modular scanner pattern with a generic filesystem walker, per-ecosystem scanners, an exposure catalog loader, and a pluggable output sink (stdout, file, or HTTP with bearer/HMAC auth and gzip). The repository also includes a threat_intel directory of curated supply-chain attack data and a tool to convert OSV records into its catalog format. Although primarily an application, it has a strong data component through its structured threat intelligence catalogs, making it a hybrid that leans towards a security scanning tool.
Safety is a commercial CLI tool for software supply chain security, primarily scanning Python (and limited npm) dependencies for known vulnerabilities. It operates as a multi-command CLI built with Click and Typer, offering commands such as `scan`, `check`, `auth`, `firewall`, `init`, and `codebase`. The architecture is modular: a core scanning engine (`safety/scan/`) discovers dependency files (requirements.txt, pyproject.toml, Pipfile.lock, etc.), resolves packages, and matches them against a proprietary vulnerability database fetched from the Safety platform. Results are formatted via a pluggable formatter system (JSON, HTML, screen, text, SPDX) and can be uploaded to the platform for reporting. The tool also includes a firewall mode that intercepts pip/poetry/uv/npm install commands to block malicious packages in real time, using shell aliases (Unix) or registry/autorun (Windows). Authentication is multi-modal: OAuth2 (browser-based), API keys, and machine tokens, with a complex enrollment flow for enterprise MDM. An internal event bus (`safety/events/event_bus/bus.py`) provides async telemetry and audit trail emission, used throughout auth, init, and scan workflows. The codebase demonstrates strong engineering practices: layered configuration resolution (CLI > env > config file > default), a command wrapper pattern for package managers, and a policy file system (YAML) for ignoring vulnerabilities by severity, CVSS score, or expiration. However, there is notable technical drift: the legacy `check` and `license` commands are deprecated but still present, typing is incomplete in several modules, and the Windows firewall interceptor relies on fragile registry manipulation. The test suite is extensive but heavily mocks external services, making integration tests brittle. External dependencies include `httpx`, `authlib`, `tenacity`, `rich`, `pydantic`, `dparse`, `packaging`, `certifi`, `filelock`, and the proprietary `safety-schemas` package. The tool is distributed as a PyPI package and as a GitHub Action, with CI/CD pipelines building platform-specific binaries via PyInstaller and PyApp. Overall, Safety is a mature, feature-rich security tool with a well-architected core, though some areas show signs of rapid feature growth and legacy debt.
This repository hosts the SLSA (Supply-chain Levels for Software Artifacts) specification, a security framework for software supply chain integrity. It is primarily a documentation and specification project, not a software application or a data pipeline. The repository contains the normative specification documents (e.g., build provenance, source requirements, dependency track), a Jekyll-based website for versioned publication, tooling scripts for linting and version management, and CI/CD workflows for maintaining the site. It defines formal attestation schemas in Protobuf and CUE, provides threat models and security principles, and includes community blog posts and how-to guides. While not a standalone deployable application, it serves as the authoritative reference for SLSA levels, tracks, and verification protocols, and its reusable patterns (provenance predicate formats, site navigation components, assessment prompts) can be adopted by other security specification projects.
This repository provides a comprehensive environment for the Certified Kubernetes Security Specialist (CKS) course. It contains shell scripts for setting up Kubernetes clusters (master and worker nodes) on Ubuntu 24.04, along with numerous Kubernetes manifests demonstrating security concepts including network policies, OPA/Gatekeeper admission control, runtime auditing, supply chain security, and system hardening. The repository serves as both instructional material and practical setup tools for learning Kubernetes security practices. The architecture consists of three main components: cluster setup scripts (bash), Kubernetes YAML manifests for various security demonstrations, and documentation files. Key entry points are the install_master.sh and install_worker.sh scripts which automate cluster provisioning. The course-content directory organizes security topics into separate directories with corresponding YAML examples that can be applied via kubectl. While primarily educational, the repository contains several highly reusable components that demonstrate advanced engineering practices, particularly in the area of container security profiles.