Trivy is a comprehensive, production-grade security scanner for container images, filesystems, Git repositories, Kubernetes clusters, cloud infrastructure (IaC), and virtual machines. It detects vulnerabilities in OS packages and language-specific dependencies, scans for IaC misconfigurations (Terraform, CloudFormation, ARM, Ansible, Helm, Dockerfile), secrets, and license compliance. The architecture is modular: a CLI entry point (`cmd/trivy/main.go`) orchestrates scanning via a file analysis engine (`pkg/fanal`), dependency parsers (`pkg/dependency/parser`), vulnerability detectors (`pkg/detector`), IaC scanners with Rego-based policies (`pkg/iac`), and multiple output formats (JSON, SARIF, CycloneDX, SPDX, table, etc.). It supports client-server mode via gRPC, a plugin system, WASM modules, and VEX/SBOM attestation integration. The codebase is well-structured with clear separation of concerns, extensive test coverage, and many reusable utility packages (parallel processing, generic sets, caching, version constraints, license expression parsing). It is actively maintained with frequent releases and a large community.
gosec is a production-grade static analysis security scanner for Go source code. It analyzes Go programs by traversing the AST and SSA representations to detect a wide range of security vulnerabilities, including SQL injection, command injection, path traversal, cross-site scripting (XSS), hardcoded credentials, weak cryptography, TLS misconfigurations, and more. The tool is distributed as a CLI binary, a Docker image, a GitHub Action, and a reusable Go library. The architecture is modular: a core analysis engine loads Go packages, applies AST-based rules and SSA-based analyzers, and runs a configurable taint analysis engine that tracks data flow from user-controlled sources to dangerous sinks. Results are output in multiple formats (text, JSON, SARIF, CSV, JUnit, HTML, SonarQube, golint, YAML). The tool also integrates with AI providers (OpenAI, Claude, Gemini, Atlas) to suggest automated fixes for detected vulnerabilities. Notable design highlights include a generic LRU cache for regex matching, a path-based rule exclusion filter, a comprehensive CWE knowledge base, and a well-abstracted taint analysis configuration system. The codebase demonstrates strong engineering practices with extensive test coverage, performance benchmarks, and CI/CD pipelines for release and scanning.
ggshield is a production-grade CLI tool for detecting hardcoded secrets in code, git history, Docker images, PyPI packages, archives, and AI coding assistant interactions. It integrates with the GitGuardian API to scan for 500+ secret types, supporting both SaaS and self-hosted instances. The tool is designed for developers and CI/CD pipelines, offering git hooks (pre-commit, pre-push, pre-receive), a plugin system for extensibility, and AI agent hooks for Claude Code, Cursor, Copilot, Codex, Vibe, and Kiro. It also includes HMSL (Has My Secret Leaked) for checking secret exposure via cryptographic queries, honeytoken management, and machine-level setup for comprehensive security coverage. The architecture is a hybrid Python/Rust CLI built with Click. The Python codebase is organized into three layers: `cmd` (CLI commands), `core` (shared infrastructure like config, scan, cache, client, UI, plugin system), and `verticals` (domain logic for secret scanning, AI, HMSL, honeytokens). A Rust native component (`ggshield-hook`) handles AI hook scanning for performance, while a Rust dispatcher delegates non-hook commands to the Python launcher. The plugin system supports dynamic command registration with sigstore signature verification. Configuration is YAML-based with versioned schemas and global/local merging. Key entry points include `ggshield/__main__.py` (CLI root), `ggshield/cmd/secret/scan/` (scan subcommands), `ggshield/cmd/auth/login.py` (authentication), `ggshield/cmd/machine/setup.py` (one-shot protection), and `rust/dispatcher/src/main.rs` (Rust binary). External dependencies include the GitGuardian API (py-gitguardian), keyring for credential storage, and platform-specific utilities for notifications and machine ID derivation. The codebase demonstrates strong engineering practices with lazy command loading, output handler strategy pattern, cache abstractions, and comprehensive test coverage (80%+).
Gitleaks is a command-line secret detection tool written in Go that scans for sensitive information like API keys, tokens, and passwords in git repositories, directories, files, and stdin. It features a modular architecture with separate components for configuration loading, source abstraction (file/git/archive handling), detection logic with multi-layer decoding, rule-based matching, and flexible reporting. The tool uses a Cobra-based CLI interface with commands for different scan modes and supports output formats including JSON, CSV, JUnit, SARIF, and custom templates. Key strengths include its pluggable decoder pipeline for handling encoded secrets, configurable rule system with entropy checks and keyword filtering, and sophisticated allowlist mechanism for reducing false positives. While actively maintained for security patches, the project is feature-complete with ongoing dependency management challenges due to its extensive rule set and reliance on unstable packages like golang.org/x/exp.
TruffleHog is a comprehensive, actively maintained secret scanning tool written in Go. It detects exposed credentials, API keys, tokens, and other sensitive information across a wide range of sources including Git repositories, cloud storage (S3, GCS), Docker images, CI/CD systems (Jenkins, Travis CI, CircleCI), and many third-party services. The architecture is modular: a core engine orchestrates scanning from various sources, a large library of over 700 detectors (each implementing a standard interface) identifies secrets using regex patterns and Aho-Corasick pre-filtering, and optional HTTP-based verification confirms whether discovered secrets are still valid. The tool also includes a terminal UI (Bubble Tea), a permissions analyzer for deeper credential assessment, and output formats like JSON, SARIF, and GitHub Actions annotations. External dependencies include cloud SDKs, database drivers, and numerous third-party API clients, but the core scanning logic is self-contained and well-structured.
Yelp/detect-secrets is a production-grade Python library and CLI tool for detecting secrets, API keys, tokens, and other sensitive strings in source code. It operates primarily through a baseline file (`.secrets.baseline`) that records discovered secrets, enabling incremental scanning, pre-commit hook integration, and audit workflows. The tool uses a plugin-driven architecture with over 25 built-in detectors (regex-, entropy-, and keyword-based), plus configurable filters (heuristic, allowlist, word list, gibberish) to reduce false positives. Key operational flows include scanning a codebase to create or update a baseline, running as a pre-commit hook to block new secrets, and an interactive audit mode for labeling secrets as true or false positives. The architecture is modular with clear separation of concerns: plugins define detection logic, filters post-process results, settings manage global configuration, and transformers handle non-standard file formats (YAML, INI). The library also supports network verification for some secret types, automatic baseline upgrades across format versions, and custom plugin/filter injection. It is actively maintained with CI across Python 3.9-3.13 and three operating systems.
This is a Kubernetes-native security operator that automates vulnerability scanning, configuration auditing, secret scanning, RBAC assessment, infrastructure assessment, and compliance reporting for container workloads. It uses Aqua Security's Trivy as the scanning engine and stores results as custom resource definitions (VulnerabilityReport, ConfigAuditReport, ExposedSecretReport, RbacAssessmentReport, InfraAssessmentReport, SbomReport, ClusterComplianceReport). The operator runs as a controller-manager pod, watches Kubernetes resources, and creates scan jobs in-cluster. It supports multiple scan modes (standalone, client/server, filesystem, rootfs) and integrates with Prometheus for metrics, webhooks for alerting, and OPA/Rego for configurable policy evaluation. The codebase is well-structured with a plugin architecture for scanning, builder patterns for report generation, and extensive test coverage including unit, envtest, integration, and e2e tests.
Xonsh is a cross-platform, Python-powered interactive shell that combines Python syntax with shell subprocess commands. The codebase implements a full shell environment with a custom parser (PLY-based with version-specific extensions), an execution engine that compiles xonsh code to Python AST, a rich tab-completion system with multiple backends (bash, git, pip, python, custom completers), a pluggable history backend (JSON, SQLite), a prompt system with git status and virtualenv information, and a subprocess management layer with job control. It also includes CLI tools for formatting, linting, and interactive configuration (xonfig wizard and web UI). The architecture is monolithic with a clear module structure: parsers, executers, completers, prompts, history, procs, and shells. External dependencies include prompt_toolkit, pygments, and PLY (vendored). The repository is actively maintained with frequent releases, supports Python 3.10+, and has an extensive test suite. Some technical drift exists due to deprecated API shims, multiple parser versions, and LLM-generated tests, but the core is well-engineered.
Checkov is a static analysis tool for Infrastructure as Code (IaC) security and compliance. It scans Terraform, CloudFormation, Kubernetes, Helm, Dockerfile, ARM, Bicep, and many other IaC frameworks against thousands of built-in policies covering AWS, Azure, GCP, and other cloud providers. The tool operates as a CLI application and can also be used as a Python library or integrated into CI/CD pipelines. Its architecture is modular, with separate runners per framework, a graph-based analysis engine for cross-resource checks, and a pluggable check registry system. Checkov also includes software composition analysis (SCA) for container images and packages, secrets detection, and integration with the Bridgecrew/Prisma Cloud platform for policy management and reporting.
sbomqs is a command-line tool and Go library for evaluating the quality and compliance of Software Bill of Materials (SBOM) documents. It parses SBOMs in CycloneDX, SPDX 2.x, and SPDX 3.0 formats and scores them against multiple industry standards: NTIA Minimum Elements (2021/2025/2026), BSI TR-03183-2 (v1.1, v2.0, v2.1), FSCT v3, OpenChain Telco v1.1, and an Interlynk comprehensive profile. The tool outputs scores, detailed compliance reports, and feature lists, and can be integrated with Dependency-Track and policy engines. It is used in production by several platforms and has been cited in academic research evaluating over 78,000 SBOMs. The codebase is well-structured with clean interfaces, extensive test coverage, and a modular architecture that separates parsing, scoring, compliance checking, and reporting. A notable architectural trade-off is the coexistence of two scoring engines (legacy v1 and v2), which adds complexity but allows incremental migration. The library is embeddable as a Go module, and the CLI supports multiple output formats (basic, detailed, JSON).
Firezone is a zero-trust network access platform providing secure remote access through VPN-like tunnels. The production system consists of a cloud-based management portal (Elixir/Phoenix), data-plane components (Rust gateways and relays), and native clients for macOS/iOS, Android, Windows, and Linux. The portal manages multi-tenant accounts, identity (OIDC, SAML, email OTP, X.509), access policies, device posture, and logs. It exposes a REST API (PortalAPI) for CRUD operations and WebSocket channels for real-time client/gateway connectivity. The Rust core (connlib) handles ICE/STUN/TURN connectivity, WireGuard tunnels, and eBPF-accelerated packet routing. PostgreSQL is used for persistence with logical replication for change data capture, Oban for background job processing, and Redis for caching/presence. External dependencies include identity providers (Entra, Okta, Google Workspace), device management systems (Intune, Defender, SentinelOne, etc.), log sinks (Splunk, Datadog, Elastic, S3), and billing (Stripe). The architecture separates the web admin interface (PortalWeb), REST API (PortalAPI), and internal ops (PortalOps) into distinct endpoints. Data-plane components (gateway, relay) communicate via WebSockets with the API to receive policy updates. Clients connect to relays using ICE/STUN/TURN. The system uses Phoenix PubSub for real-time updates and Postgres logical replication to propagate changes to connected clients and gateways. Key entry points: PortalWeb.Endpoint (admin UI), PortalAPI.Endpoint (REST/WebSocket for clients and gateways), PortalOps.Endpoint (ops dashboard). Rust binaries: firezone-gateway, firezone-relay, firezone-headless-client, firezone-gui-client. Mobile apps: Firezone iOS/macOS (Swift), Firezone Android (Kotlin).
DefectDojo is an open-source application security posture management (ASPM) and vulnerability management platform. It ingests scan results from over 100 security tools (SAST, DAST, SCA, container, cloud, secrets, infrastructure) via a consistent parser interface, normalizes findings, deduplicates them, and tracks remediation workflows across engagements and products. The system is a Django monolith with a REST API (Django REST Framework), Celery async workers for imports, SLA enforcement, and JIRA/GitHub sync, PostgreSQL for persistence, and Valkey/Redis as the message broker. Key entry points include the Django admin UI, DRF API viewsets, and Celery task dispatchers. External dependencies are PostgreSQL, Redis/Valkey, and optional integrations with JIRA, Slack, Microsoft Teams, and SSO providers (LDAP, OAuth2, SAML). The repository includes a Pro edition layer with additional features (custom RBAC, audit logging, priority SLA) that coexist with the open-source core via feature flags and conditional imports. The codebase demonstrates strong engineering with a well-defined parser factory pattern, prefetch mixins for API efficiency, SSRF-safe HTTP clients, and a request-level caching system, though it carries some technical debt from an ongoing V3 location model migration and numerous deprecated endpoints slated for removal.
Safety is a commercial CLI tool for software supply chain security, primarily scanning Python (and limited npm) dependencies for known vulnerabilities. It operates as a multi-command CLI built with Click and Typer, offering commands such as `scan`, `check`, `auth`, `firewall`, `init`, and `codebase`. The architecture is modular: a core scanning engine (`safety/scan/`) discovers dependency files (requirements.txt, pyproject.toml, Pipfile.lock, etc.), resolves packages, and matches them against a proprietary vulnerability database fetched from the Safety platform. Results are formatted via a pluggable formatter system (JSON, HTML, screen, text, SPDX) and can be uploaded to the platform for reporting. The tool also includes a firewall mode that intercepts pip/poetry/uv/npm install commands to block malicious packages in real time, using shell aliases (Unix) or registry/autorun (Windows). Authentication is multi-modal: OAuth2 (browser-based), API keys, and machine tokens, with a complex enrollment flow for enterprise MDM. An internal event bus (`safety/events/event_bus/bus.py`) provides async telemetry and audit trail emission, used throughout auth, init, and scan workflows. The codebase demonstrates strong engineering practices: layered configuration resolution (CLI > env > config file > default), a command wrapper pattern for package managers, and a policy file system (YAML) for ignoring vulnerabilities by severity, CVSS score, or expiration. However, there is notable technical drift: the legacy `check` and `license` commands are deprecated but still present, typing is incomplete in several modules, and the Windows firewall interceptor relies on fragile registry manipulation. The test suite is extensive but heavily mocks external services, making integration tests brittle. External dependencies include `httpx`, `authlib`, `tenacity`, `rich`, `pydantic`, `dparse`, `packaging`, `certifi`, `filelock`, and the proprietary `safety-schemas` package. The tool is distributed as a PyPI package and as a GitHub Action, with CI/CD pipelines building platform-specific binaries via PyInstaller and PyApp. Overall, Safety is a mature, feature-rich security tool with a well-architected core, though some areas show signs of rapid feature growth and legacy debt.
OpenDoor is an advanced CLI security reconnaissance platform for directory discovery, subdomain enumeration, WAF detection, and content fingerprinting. It employs a modular architecture with a plugin-based analysis pipeline (sniffers), network transport abstraction (direct, proxy, VPN), and extensive output formatting (JSON, CSV, SQLite, SARIF). Its core scanning engine, state machine, and plugin systems demonstrate sophisticated engineering, featuring auto-calibration, semantic soft-404 diffing, and a clean exception hierarchy.
OASIS is a CLI-first security analysis tool written in Python. It orchestrates a multi-phase LangGraph pipeline (Discover → Scan → Expand → Deep → Verify → Report) to detect vulnerabilities in source code using local LLMs via Ollama or OpenAI-compatible servers. The tool supports 25+ vulnerability types across multiple languages, produces deterministic verdicts without LLM reliance, and integrates with CI via severity-gated exit codes, suppression registries, and report diffing. It is installed via pipx or Docker and run as `oasis -i /path --models ...`.
This repository is a manually curated awesome-list/registry of open-source security scanners and offensive/defensive tools. It spans traditional security testing categories (web, mobile, binary, smart-contract, IoT, APT) and an actively expanded section for AI/LLM-agent security. The actual content is a set of near-identical English, Chinese, and Spanish README files containing hundreds of one-line tool entries with shields.io badges for language, last commit, stars, and license. There is no application runtime, no build pipeline, and no test suite; the product is a navigable knowledge base rather than software. The repo is therefore classified as data_research only in the sense that it is a structured, human-maintained metadata registry, not a data pipeline. The primary data lineage is manual: maintainers sample external GitHub projects, annotate each with a one-sentence description and category, and publish the result as markdown. The taxonomy serves as an analytical schema, answering questions such as which open-source scanners exist for a given domain, which are active, and what maturity signals (stars, license, last commit) they carry. It does not provide quantitative benchmarks or automated validation, and the data is not exposed in machine-readable form beyond the markdown itself. Reuse is straightforward for human readers, but automation requires parsing the markdown and accepting that some badges or links may be stale or inconsistent. The repository is actively curated, with recent emphasis on AI security, a documented commit convention, and multilingual READMEs. Its main risks are extrinsic: link rot, renamed or abandoned upstream tools, and the CC BY-NC-ND license, which restricts derivative redistribution. Technical drift is moderate because some older categories and tools are outdated even though the overall list is kept current.
This repository is a comprehensive, curated collection of cybersecurity study plans covering 20+ specialized domains such as application security, cloud security (AWS/Azure/GCP), DevSecOps, threat modeling, GRC, GenAI security, and more. It is not a software application or data research project; rather, it is a knowledge base of structured markdown roadmaps designed to guide learners and professionals through role-specific cybersecurity skill development. The plans reference up-to-date frameworks (OWASP Top 10:2025, NIST CSF 2.0, EU AI Act), include curated resources (books, videos, courses, certifications), and are consistently maintained. The repository has high community engagement (5k+ stars) and remains actively updated, though it contains no executable code, data pipelines, or notebooks.