MinIO is a high-performance, S3-compatible object storage server implemented in Go. It is a monolithic application that provides a full-featured object storage system supporting erasure coding, bitrot protection, IAM, replication, lifecycle management, and a web console. The codebase is organized around a central `cmd` package containing the server implementation, with extensive `internal` packages for subsystems like erasure coding, encryption, event notifications, and distributed locking. The architecture follows a distributed systems pattern where nodes communicate via custom REST protocols and a proprietary grid messaging system for internode communication. The system implements a sophisticated storage engine using Reed-Solomon erasure coding with support for multiple storage classes, bitrot detection via HighwayHash, and strong consistency guarantees. It supports a wide range of protocols including S3 API, FTP/SFTP, and S3 Select for SQL queries on stored objects. The codebase demonstrates advanced Go patterns including extensive use of build tags for platform-specific code, code generation for serialization (msgp), and a plugin-based architecture for external identity providers and KMS integration. Key architectural components include the erasure coding subsystem (`cmd/erasure*.go`), the object API layer (`cmd/object-api*.go`), the IAM system (`cmd/iam*.go`, `cmd/auth-handler.go`), and the distributed systems infrastructure (`internal/grid`, `internal/dsync`). The codebase shows significant investment in operational features including comprehensive metrics exposure via Prometheus, audit logging, batch jobs for large-scale operations, and extensive debugging tools. The project maintains high code quality with extensive testing, CI/CD pipelines, and support for multiple deployment modes including standalone, distributed, Kubernetes, and various cloud platforms.
Better Auth is a framework-agnostic authentication and authorization framework for TypeScript, designed as a monorepo with a core library, multiple database adapters (Drizzle, Prisma, Kysely, MongoDB, in-memory), client SDKs (React, Vue, Svelte, Solid, Expo, Electron), and a plugin ecosystem. It supports email/password, OAuth2/OIDC, SAML, SCIM, passkeys, 2FA, phone number OTP, and more. The architecture is modular: the core package provides the `betterAuth()` function, which configures plugins, database adapters, and social providers, and exposes a REST API for authentication flows. Client libraries use nanostores for reactive state management. The CLI offers project scaffolding, migration generation, and schema validation. External dependencies include jose for JWT, zod for validation, and various ORMs for database access. The codebase is well-tested with unit, integration, and e2e tests across all packages, and includes a release tooling package with AI-assisted changelog generation.
Pomerium is an identity-aware access proxy enabling zero-trust network access to internal applications without a traditional VPN. It implements a microservices architecture with separate services for authentication, authorization, proxying (via Envoy), configuration synchronization (using Raft), and cluster management. The system integrates with identity providers (OIDC, SAML, LDAP), evaluates context-aware access policies, provides session management, and includes SSH bastion capabilities and Model Context Protocol (MCP) support for AI/LLM tool integration. A React-based administrative dashboard provides management capabilities.
Hanko is a production-grade, self-hostable authentication and identity platform written primarily in Go. The backend exposes public, admin, and management HTTP APIs plus a CLI for migrations, user import/export, JWK/JWT management, and config schema generation. Authentication is implemented as a custom state-machine engine (flowpilot) driving login, registration, password/passkey/MFA/third-party OAuth/SAML flows, backed by JWT sessions, device trust, webhooks, audit logs, and rate limiting. The persistence layer uses gobuffalo/pop with a broad set of per-entity persister interfaces and roughly 65 Fizz migrations covering users, emails, credentials, sessions, tenants, organizations, roles, SAML providers, and webhooks. The frontend is split into a TypeScript SDK (`@teamhanko/hanko-frontend-sdk`) and Preact-based web components (`@teamhanko/hanko-elements`) that render flow states into embeddable `<hanko-auth>` and `<hanko-profile>` elements. The repository also contains a quickstart Go server, framework examples for React, Vue, Angular, Next.js, and Express, Playwright e2e tests, Docker Compose stacks, and Kubernetes manifests. Data flows through Echo routers into flowpilot actions/hooks, which validate inputs, persist state, issue sessions, and trigger webhook events; PostgreSQL, Redis, SMTP, and external OAuth/SAML providers are the primary external dependencies. Overall the codebase is well-structured and heavily tested, with sophisticated security handling around redirect validation, account linking, multi-tenant isolation, and webhook signing. The main friction points are the custom flowpilot framework's learning curve, a very large configuration surface, duplicated example code, and some stale example/e2e toolchains relative to the core Go and Node versions.
This repository is a curated list of resources for learning and using Keycloak, an open source identity and access management solution. It serves as a reference guide, containing links to documentation, books, articles, talks, presentations, videos, client libraries, community extensions, integrations, tools, deployment examples, example projects, benchmarks, help resources, commercial offerings, and miscellaneous resources related to Keycloak. The repository is structured as a single markdown file (README.md) with a detailed table of contents and categorized sections, following the popular 'awesome list' format. There is no executable code; the value lies in the curated collection of links, which is maintained through community contributions. The project includes standard open source files such as a CONTRIBUTING.md file that provides specific guidelines for contributing to the awesome list (referencing the awesome manifesto and detailing requirements for usefulness, formatting, and avoiding duplicates), a CODE_OF_CONDUCT.md based on the Contributor Covenant, and an MIT license. The CONTRIBUTING.md is highlighted as a reusable component for other awesome list projects. The repository is actively maintained, with the most recent commit being recent and ongoing issue activity, indicating a healthy project. Technical drift is low due to the absence of dependencies or code that could become outdated.
MaxKey is an enterprise-grade Identity and Access Management (IAM) / Single Sign-On (SSO) platform written in Java (Spring Boot) with Angular frontends. It supports a comprehensive set of authentication protocols (OAuth 2.0/OpenID Connect, SAML 2.0, CAS, JWT, form-based, token-based) and identity federation standards (SCIM 2.0, LDAP, Active Directory). The codebase is organized as a multi-module Maven project with clear separation between authentication providers, protocol implementations, persistence layer, and web UIs. Architecturally, it follows a service-oriented model with a custom OAuth2 stack (derived from Spring Security OAuth), MyBatis JPA for persistence, and Redis/Caffeine for caching. The frontends are built on NG-ALAIN (Angular 17) and share a common base for user portal and admin console. While the system is functionally rich and actively maintained, it contains some duplicated code across modules and relies on a legacy OAuth2 implementation that has been superseded by Spring Security 5+. The crypto utilities, OTP infrastructure, and adapter patterns are well-structured and demonstrate non-obvious craftsmanship.
This repository provides Terraform modules for managing Google Cloud SQL instances (MySQL, PostgreSQL, SQL Server) with features including backups, high availability, private networking, IAM authentication, and encryption. It follows a modular architecture where each database type and supporting feature (backup, restore, private service access) is implemented as a separate, reusable Terraform module. The root module is deprecated in favor of direct use of the submodules. Key entry points are the module directories (modules/mysql, modules/postgresql, etc.) and the examples directory which contains ready-to-run configurations for common deployment patterns. The system automates database lifecycle management through infrastructure-as-code, integrating with Google Cloud services like Cloud Workflows for backup scheduling, KMS for encryption, and Service Networking for private access. While the modules are well-maintained with frequent updates and comprehensive documentation, they exhibit tight coupling to Google Cloud-specific services and Terraform provider versions, limiting portability outside the GCP ecosystem.
RBAC Lookup is a CLI tool for Kubernetes that enables users to find all RoleBindings and ClusterRoleBindings associated with a specific user, service account, or group. The tool connects to a Kubernetes cluster via kubeconfig, queries the RBAC API, and presents the results in a tabular format. It includes optional GKE integration to show Google Cloud IAM roles alongside native Kubernetes RBAC roles. The architecture follows a standard Cobra-based CLI pattern with command definitions in cmd/, core lookup logic in lookup/, and data structures defined in lookup/rbac_subject.go. The tool requires access to a Kubernetes cluster and optionally Google Cloud credentials for GKE features.
Aaia is a security analysis tool for AWS IAM and Organizations that visualizes identity and access relationships in a Neo4j graph database. It collects AWS data via CLI commands, stores it as JSON, and loads it into Neo4j for graph-based querying and auditing. The architecture consists of a modular Python application with separate components for data collection, loading into Neo4j, and custom auditing modules. Key entry points include the main Aaia.py script, the Aaia_aws_collector.sh shell script for data gathering, and specialized action/module handlers. The data flow moves from AWS CLI → JSON files → Neo4j graph → analysis results via Cypher queries or custom modules. The tool depends on Neo4j (v3.5.17 compatible), AWS CLI, and several Python packages for policy processing and Neo4j interaction.
This repository is a curated list of open-source AWS security tools, organized into categories such as defensive hardening, offensive testing, purple teaming, continuous auditing, DFIR, development security, S3 auditing, and training. It also includes a Packer-based build system to create an Amazon Machine Image (AMI) pre-loaded with many of the listed tools, alongside scripts for cloning tool repositories (install-tools.sh) and generating markdown tables from CSV data (arsenal-kreator.sh). The actual code in the repo is minimal—mainly configuration and simple shell scripts—and the core value is the comprehensive reference list. The AMI build is dated (last manifest from 2018) and many linked tools may have moved or become unmaintained, resulting in significant technical drift. The repo is more of a historic index than an actively developed software project.