This repository is a sophisticated build factory for producing hardened, minimal container images. It defines over 100 image recipes (melange.yaml + apko.yaml) covering runtimes, databases, monitoring tools, security scanners, and Kubernetes infrastructure. Each image is built from source or from Wolfi packages, assembled into a distroless (shell-less), non-root OCI image, signed with Cosign, and attested with SLSA v1.0 provenance and SPDX SBOM. The entire pipeline is orchestrated via GitHub Actions: automated version bumps (daily), transitive CVE patching (for Go, Java, Ruby, Rust), vulnerability scanning with Grype, and VEX management. A companion Astro-based static site (minimalcontainers.com) catalogs the images, displays CVE comparisons against competing registries (Minimus, Chainguard, Bitnami), and provides documentation. The repository is not an end-user application but a highly engineered CI/CD system for producing and publishing container images as artifacts.
The RustSec monorepo is a multi-crate workspace that provides the official security audit toolchain for the Rust ecosystem. Its flagship product is `cargo-audit`, a CLI subcommand for Cargo that scans `Cargo.lock` files against the RustSec Advisory Database to detect known vulnerabilities, unmaintained or unsound crates, and yanked packages. The workspace also includes the `rustsec` core library for managing the advisory database (fetched via git, indexed, and queried), `cargo-lock` for parsing and manipulating Cargo.lock files (supporting V1 through V4 format), `cvss` for parsing and scoring CVSS vectors (v2.0, v3.x, v4.0), `platforms` for programmatic access to Rust target triples, and `admin` for maintaining the advisory database and generating the rustsec.org website. Although primarily an application and library toolset, the repository has data-oriented aspects: the advisory database is a curated set of Markdown files with TOML front matter, and `platforms` is auto-generated from rustc target information. The architecture is modular, with each crate independently usable and well-tested, and CI pipelines ensure cross-platform releases and static analysis.
Harbor is an open-source, cloud-native container registry platform for managing OCI/Docker images, Helm charts, and other artifacts. It provides a full-stack solution with a Go backend, Angular web portal, PostgreSQL database, and Redis/ValKey job queue. The system supports artifact storage, vulnerability scanning (Trivy integration), SBOM generation, multi-registry replication (Docker Hub, Quay, JFrog, cloud CRs), tag retention policies, immutable tags, RBAC with LDAP/OIDC, robot accounts, webhook/notification pipelines, P2P preheat, and audit logging. The architecture follows a layered pattern: REST API handlers (v2.0) → controllers → managers → DAOs, with middleware chains for security, quota, and content trust. Key entry points include the core API server, job service for background tasks, registry controller for blob/manifest management, and the Angular portal for administration. External dependencies include PostgreSQL, Redis, Trivy scanner, and various cloud registry APIs. The codebase is well-structured with extensive unit and integration tests, though it exhibits some technical debt from generated mocks and legacy components.
This is a Kubernetes-native security operator that automates vulnerability scanning, configuration auditing, secret scanning, RBAC assessment, infrastructure assessment, and compliance reporting for container workloads. It uses Aqua Security's Trivy as the scanning engine and stores results as custom resource definitions (VulnerabilityReport, ConfigAuditReport, ExposedSecretReport, RbacAssessmentReport, InfraAssessmentReport, SbomReport, ClusterComplianceReport). The operator runs as a controller-manager pod, watches Kubernetes resources, and creates scan jobs in-cluster. It supports multiple scan modes (standalone, client/server, filesystem, rootfs) and integrates with Prometheus for metrics, webhooks for alerting, and OPA/Rego for configurable policy evaluation. The codebase is well-structured with a plugin architecture for scanning, builder patterns for report generation, and extensive test coverage including unit, envtest, integration, and e2e tests.
This is the official curated marketplace and development toolkit for Claude Code plugins, maintained by Anthropic. It contains both first-party plugins (e.g., claude-security, code-modernization, hookify, skill-creator, security-guidance) and third-party channel integrations (Discord, iMessage, Telegram, GitHub, Linear, etc.). The repository serves dual roles: as a plugin registry with standardized packaging (SKILL.md, agent definitions, hooks, commands, MCP servers) and as a meta-development kit providing tools for authoring and validating new plugins. The codebase is predominantly instructional content for Claude Code (markdown workflows, agent system prompts, skill references) orchestrated through hooks, workflows, and commands. While many plugins contain only reference documentation and no executable code, security-critical plugins like claude-security and security-guidance include sophisticated Python/JavaScript logic for vulnerability scanning, patch generation, session state management, and git diff analysis. The CI pipeline enforces licensing (Apache 2.0), validates plugin structure, checks MCP URL liveness, and manages SHA-pinned external plugin versions. The project is actively maintained but exhibits technical drift from duplicated access-control logic across channel servers, hardcoded model references, and reliance on Claude Code CLI internals that may change between versions.
This repository is a curated collection of wordlists for bug bounty hunting and web application security testing. It aggregates URL paths, payloads, and vulnerability probes from multiple public sources (SecLists, OneListForAll, dirsearch, nuclei-templates, etc.) into a unified, organized dataset. The wordlists are categorized by technology (e.g., Apache, WordPress, Nginx) and severity (info, low, medium, high, critical), making them directly usable with tools like Nuclei, ffuf, and dirsearch. The repository includes two automation scripts: a shell script that fetches and deduplicates wordlists from external URLs, and a Go program that parses nuclei-templates YAML files to generate technology-specific wordlists. These scripts are run weekly via GitHub Actions to keep the dataset current. The repository is purely a data asset; it contains no application code, APIs, or services. Its primary value is as a ready-to-use, aggregated wordlist source for security researchers and penetration testers.
This repository is a manually curated awesome-list/registry of open-source security scanners and offensive/defensive tools. It spans traditional security testing categories (web, mobile, binary, smart-contract, IoT, APT) and an actively expanded section for AI/LLM-agent security. The actual content is a set of near-identical English, Chinese, and Spanish README files containing hundreds of one-line tool entries with shields.io badges for language, last commit, stars, and license. There is no application runtime, no build pipeline, and no test suite; the product is a navigable knowledge base rather than software. The repo is therefore classified as data_research only in the sense that it is a structured, human-maintained metadata registry, not a data pipeline. The primary data lineage is manual: maintainers sample external GitHub projects, annotate each with a one-sentence description and category, and publish the result as markdown. The taxonomy serves as an analytical schema, answering questions such as which open-source scanners exist for a given domain, which are active, and what maturity signals (stars, license, last commit) they carry. It does not provide quantitative benchmarks or automated validation, and the data is not exposed in machine-readable form beyond the markdown itself. Reuse is straightforward for human readers, but automation requires parsing the markdown and accepting that some badges or links may be stale or inconsistent. The repository is actively curated, with recent emphasis on AI security, a documented commit convention, and multilingual READMEs. Its main risks are extrinsic: link rot, renamed or abandoned upstream tools, and the CC BY-NC-ND license, which restricts derivative redistribution. Technical drift is moderate because some older categories and tools are outdated even though the overall list is kept current.
The repository contains only documentation files (README-EN.md and README.md) describing a Java-based SAST tool called 'chanzi'. No source code, binaries, or executable artifacts are present. The documentation outlines the tool's features: taint analysis for vulnerability detection, support for Java frameworks (Spring, Dubbo, etc.), built-in Java runtime, and vulnerability reporting. The repository appears to be maintained with recent commits and issue tracking, but lacks any actual implementation code, rendering it non-functional as a software artifact.