ggshield is a production-grade CLI tool for detecting hardcoded secrets in code, git history, Docker images, PyPI packages, archives, and AI coding assistant interactions. It integrates with the GitGuardian API to scan for 500+ secret types, supporting both SaaS and self-hosted instances. The tool is designed for developers and CI/CD pipelines, offering git hooks (pre-commit, pre-push, pre-receive), a plugin system for extensibility, and AI agent hooks for Claude Code, Cursor, Copilot, Codex, Vibe, and Kiro. It also includes HMSL (Has My Secret Leaked) for checking secret exposure via cryptographic queries, honeytoken management, and machine-level setup for comprehensive security coverage. The architecture is a hybrid Python/Rust CLI built with Click. The Python codebase is organized into three layers: `cmd` (CLI commands), `core` (shared infrastructure like config, scan, cache, client, UI, plugin system), and `verticals` (domain logic for secret scanning, AI, HMSL, honeytokens). A Rust native component (`ggshield-hook`) handles AI hook scanning for performance, while a Rust dispatcher delegates non-hook commands to the Python launcher. The plugin system supports dynamic command registration with sigstore signature verification. Configuration is YAML-based with versioned schemas and global/local merging. Key entry points include `ggshield/__main__.py` (CLI root), `ggshield/cmd/secret/scan/` (scan subcommands), `ggshield/cmd/auth/login.py` (authentication), `ggshield/cmd/machine/setup.py` (one-shot protection), and `rust/dispatcher/src/main.rs` (Rust binary). External dependencies include the GitGuardian API (py-gitguardian), keyring for credential storage, and platform-specific utilities for notifications and machine ID derivation. The codebase demonstrates strong engineering practices with lazy command loading, output handler strategy pattern, cache abstractions, and comprehensive test coverage (80%+).
TruffleHog is a comprehensive, actively maintained secret scanning tool written in Go. It detects exposed credentials, API keys, tokens, and other sensitive information across a wide range of sources including Git repositories, cloud storage (S3, GCS), Docker images, CI/CD systems (Jenkins, Travis CI, CircleCI), and many third-party services. The architecture is modular: a core engine orchestrates scanning from various sources, a large library of over 700 detectors (each implementing a standard interface) identifies secrets using regex patterns and Aho-Corasick pre-filtering, and optional HTTP-based verification confirms whether discovered secrets are still valid. The tool also includes a terminal UI (Bubble Tea), a permissions analyzer for deeper credential assessment, and output formats like JSON, SARIF, and GitHub Actions annotations. External dependencies include cloud SDKs, database drivers, and numerous third-party API clients, but the core scanning logic is self-contained and well-structured.
XMap is a high-performance network scanner designed for Internet-wide IPv4 and IPv6 address space scanning. It is a reimplementation and improvement of ZMap, featuring a modular architecture with interchangeable probe modules (ICMP, TCP, UDP, DNS), output modules (CSV, JSON, Redis), and interface identifier (IID) modules for target address generation. The tool uses cyclic groups for efficient, non-sequential address traversal, AES-based validation to prevent response spoofing, and Bloom filters for duplicate packet detection. It is actively used in security research and has been presented at multiple academic conferences. The repository contains significant code duplication among DNS probe modules, which increases maintenance burden.
JSPrintManager is a client-side printing and scanning solution enabling web applications to bypass browser print dialogs by communicating with a native client application via WebSocket. The system consists of a core JavaScript library (JSPrintManager.js) that provides APIs for creating print/scan jobs, managing printer connections, and handling device-specific communication protocols (serial, USB, Bluetooth, TCP/IP, HID, IPP). A React-based demo application showcases features including printing various file formats (PDF, images, Office documents), raw printer command languages (ZPL, ESC/POS), bidirectional device communication, printer monitoring, and scanning functionality. The solution requires installation of a lightweight native client on user machines to establish the WebSocket bridge between browser and hardware devices.
Cloudflare's CFSSL is a comprehensive PKI/TLS toolkit written in Go, providing both a command-line interface and an HTTP API server for certificate lifecycle management. It handles certificate signing, chain bundling, revocation (CRL/OCSP), TLS scanning, key generation, CSR creation, and CA initialization. The system is modular, with separate packages for CLI commands, API handlers, signers (local/remote), certificate database abstraction (SQLite/MySQL/PostgreSQL), a bundler with chain optimization, an OCSP responder, a TLS scanner, and a transport layer for automated mutual TLS. It uses interface-based design for pluggable backends (signers, database accessors, key providers, trust stores) and includes features like multi-root CA support, pre-issuance linting via zlint, certificate transparency embedding, ubiquity scoring for chain selection, IP whitelisting, HMAC authentication, Prometheus metrics, and post-quantum cryptography (ML-DSA). The codebase also contains custom cryptographic implementations (MD5, SHA-1, SHA-256, SHA-512) with assembly-optimized blocks for performance. While actively maintained with CI/CD and extensive tests, some components show technical drift (pinned Go 1.27, forked TLS library, legacy algorithm support).
reNgine is a Django-based automated security reconnaissance and attack-surface management platform. It orchestrates 20+ external security tools (Subfinder, Amass, Naabu, Nuclei, FFUF, GoSpider, Dalfox, WAFW00f, EyeWitness, theHarvester, h8mail) via Celery task chains to perform subdomain discovery, port scanning, HTTP crawling, directory fuzzing, OSINT gathering, technology fingerprinting, WAF detection, and vulnerability scanning. Results are parsed from tool outputs (nmap XML, nuclei JSON, dalfox JSON, ffuf JSON), persisted in PostgreSQL, and exposed through a Django REST Framework API plus a jQuery/Bootstrap frontend with server-side DataTables, dashboards, and WeasyPrint PDF reports. The system supports multi-project tenancy, role-based access control (sys_admin, penetration_tester, auditor), scheduled scans via Celery Beat, and deep HackerOne bug-bounty integration for program import, bookmarking, and vulnerability report submission. It also integrates LLMs (OpenAI and local Ollama) for vulnerability description enrichment and attack-surface suggestions. Architecturally it is a monolithic Django application with four feature apps (dashboard, scanEngine, startScan, targetApp, recon_note) and a Docker deployment composed of web, celery, celery-beat, redis, postgres, nginx, and ollama services. The orchestration core, web/reNgine/tasks.py (~3000 lines), composes Celery groups/chords/chains, executes shell commands against external tools, parses their structured output, and persists scan results. The frontend is server-rendered Django templates with heavy inline JavaScript and a supplementary DRF API layer in web/api/views.py. Although it collects and aggregates large volumes of scan-derived data, this is fundamentally an operational security application, not a data-research project. The codebase is actively patched (recent CVE fixes for command injection and XSS) and feature-rich, but carries notable technical debt: an end-of-life Django 3.2 base, old vendored JS plugins (DataTables 1.10.16, Lightbox from 2018), hardcoded container filesystem paths, a monolithic task module mixing orchestration/parsing/persistence, and dead or commented code. The strongest reusable pieces are the RengineTask Celery base class (standardized task logging, caching, and notifications), the dual-provider LLM abstraction with OpenAI/Ollama backends, and a custom server-side datatable filtering language applying operators (=, >, <, !, &, |) across subdomain, endpoint, and vulnerability views. It is best characterized as effective, pragmatic, security-tool engineering rather than clean, academically elegant architecture.
This repository contains a C-based frequency scanner for Gqrx, a software-defined radio (SDR) application. The scanner controls Gqrx via its remote TCP protocol to perform sweep or bookmark-based scanning, with integrated voice activity detection (VAD) for distinguishing speech from noise. The system supports interactive controls (skip, ban, pause frequencies) and automatic recording of detected signals. The architecture is a standalone CLI executable built with CMake, featuring two scanning modes: adaptive sweep (fast, with fine-tuning) and bookmark-based (reading Gqrx's bookmarks CSV). VAD is implemented using a G.729B-style pitch-based algorithm with LPC analysis, running on Linux via PipeWire audio capture. The codebase includes a comprehensive test suite using cmocka, with mock socket infrastructure for simulating Gqrx responses. Notable strengths include self-contained VAD modules and a reusable mock Gqrx protocol implementation. However, the code exhibits heavy use of global variables, some known bugs (e.g., unsigned underflow in frequency saving), and platform-specific limitations (VOX and sweep tests are Linux-only).