Trivy is a comprehensive, production-grade security scanner for container images, filesystems, Git repositories, Kubernetes clusters, cloud infrastructure (IaC), and virtual machines. It detects vulnerabilities in OS packages and language-specific dependencies, scans for IaC misconfigurations (Terraform, CloudFormation, ARM, Ansible, Helm, Dockerfile), secrets, and license compliance. The architecture is modular: a CLI entry point (`cmd/trivy/main.go`) orchestrates scanning via a file analysis engine (`pkg/fanal`), dependency parsers (`pkg/dependency/parser`), vulnerability detectors (`pkg/detector`), IaC scanners with Rego-based policies (`pkg/iac`), and multiple output formats (JSON, SARIF, CycloneDX, SPDX, table, etc.). It supports client-server mode via gRPC, a plugin system, WASM modules, and VEX/SBOM attestation integration. The codebase is well-structured with clear separation of concerns, extensive test coverage, and many reusable utility packages (parallel processing, generic sets, caching, version constraints, license expression parsing). It is actively maintained with frequent releases and a large community.
Nebula is a local-first security assessment workbench designed for penetration testing and red teaming operations. It functions as a desktop application built with a Tauri shell (Rust) wrapping a React/TypeScript frontend and a Python FastAPI backend sidecar. The system manages security engagements, scope policies, evidence collection, and AI-assisted analysis, emphasizing operator control, auditability, and data privacy through local-first execution and content-addressed artifact storage. The architecture follows a sidecar pattern where the Python Core service handles database operations (SQLite with Alembic), containerized command execution (Kali Linux via Docker/Podman), and AI provider integration. The frontend manages the UI state and terminal sessions via WebSocket. Key data flows involve user actions triggering API calls that validate against scope policies before executing commands in isolated containers, with all outputs stored as immutable artifacts for evidence integrity. The codebase demonstrates strong engineering practices with extensive test coverage (Pytest, Vitest, Playwright), a robust diagnostic system with secret redaction, and a policy engine for deterministic scope enforcement. It supports multiple AI providers and includes features for knowledge indexing, mission orchestration, and report generation. The project is actively maintained with recent commits and zero security alerts, though it is currently in alpha release.
This is a Kubernetes-native security operator that automates vulnerability scanning, configuration auditing, secret scanning, RBAC assessment, infrastructure assessment, and compliance reporting for container workloads. It uses Aqua Security's Trivy as the scanning engine and stores results as custom resource definitions (VulnerabilityReport, ConfigAuditReport, ExposedSecretReport, RbacAssessmentReport, InfraAssessmentReport, SbomReport, ClusterComplianceReport). The operator runs as a controller-manager pod, watches Kubernetes resources, and creates scan jobs in-cluster. It supports multiple scan modes (standalone, client/server, filesystem, rootfs) and integrates with Prometheus for metrics, webhooks for alerting, and OPA/Rego for configurable policy evaluation. The codebase is well-structured with a plugin architecture for scanning, builder patterns for report generation, and extensive test coverage including unit, envtest, integration, and e2e tests.
This repository provides a comprehensive Nginx security configuration package to block malicious bots, spam referrers, bad IPs, and vulnerability scanners. It includes curated blocklists (bad user agents, referrers, IPs, fake Googlebots), rate limiting/DDoS protection, and optional fail2ban integration. The core deliverable is a set of modular Nginx include files (bots.d/, conf.d/) and shell scripts (install-ngxblocker, setup-ngxblocker, update-ngxblocker) for automated deployment and daily updates. It also generates Google Analytics ghost spam exclusion lists and a Google Search Console disavow file. The architecture is a collection of configuration templates and deployment tooling, not a standalone application; it is designed to be included into existing Nginx server blocks. The repository is actively maintained with frequent updates to blocklists and CI testing across multiple Linux distributions.
Safety is a commercial CLI tool for software supply chain security, primarily scanning Python (and limited npm) dependencies for known vulnerabilities. It operates as a multi-command CLI built with Click and Typer, offering commands such as `scan`, `check`, `auth`, `firewall`, `init`, and `codebase`. The architecture is modular: a core scanning engine (`safety/scan/`) discovers dependency files (requirements.txt, pyproject.toml, Pipfile.lock, etc.), resolves packages, and matches them against a proprietary vulnerability database fetched from the Safety platform. Results are formatted via a pluggable formatter system (JSON, HTML, screen, text, SPDX) and can be uploaded to the platform for reporting. The tool also includes a firewall mode that intercepts pip/poetry/uv/npm install commands to block malicious packages in real time, using shell aliases (Unix) or registry/autorun (Windows). Authentication is multi-modal: OAuth2 (browser-based), API keys, and machine tokens, with a complex enrollment flow for enterprise MDM. An internal event bus (`safety/events/event_bus/bus.py`) provides async telemetry and audit trail emission, used throughout auth, init, and scan workflows. The codebase demonstrates strong engineering practices: layered configuration resolution (CLI > env > config file > default), a command wrapper pattern for package managers, and a policy file system (YAML) for ignoring vulnerabilities by severity, CVSS score, or expiration. However, there is notable technical drift: the legacy `check` and `license` commands are deprecated but still present, typing is incomplete in several modules, and the Windows firewall interceptor relies on fragile registry manipulation. The test suite is extensive but heavily mocks external services, making integration tests brittle. External dependencies include `httpx`, `authlib`, `tenacity`, `rich`, `pydantic`, `dparse`, `packaging`, `certifi`, `filelock`, and the proprietary `safety-schemas` package. The tool is distributed as a PyPI package and as a GitHub Action, with CI/CD pipelines building platform-specific binaries via PyInstaller and PyApp. Overall, Safety is a mature, feature-rich security tool with a well-architected core, though some areas show signs of rapid feature growth and legacy debt.
This repository is a manually curated awesome-list/registry of open-source security scanners and offensive/defensive tools. It spans traditional security testing categories (web, mobile, binary, smart-contract, IoT, APT) and an actively expanded section for AI/LLM-agent security. The actual content is a set of near-identical English, Chinese, and Spanish README files containing hundreds of one-line tool entries with shields.io badges for language, last commit, stars, and license. There is no application runtime, no build pipeline, and no test suite; the product is a navigable knowledge base rather than software. The repo is therefore classified as data_research only in the sense that it is a structured, human-maintained metadata registry, not a data pipeline. The primary data lineage is manual: maintainers sample external GitHub projects, annotate each with a one-sentence description and category, and publish the result as markdown. The taxonomy serves as an analytical schema, answering questions such as which open-source scanners exist for a given domain, which are active, and what maturity signals (stars, license, last commit) they carry. It does not provide quantitative benchmarks or automated validation, and the data is not exposed in machine-readable form beyond the markdown itself. Reuse is straightforward for human readers, but automation requires parsing the markdown and accepting that some badges or links may be stale or inconsistent. The repository is actively curated, with recent emphasis on AI security, a documented commit convention, and multilingual READMEs. Its main risks are extrinsic: link rot, renamed or abandoned upstream tools, and the CC BY-NC-ND license, which restricts derivative redistribution. Technical drift is moderate because some older categories and tools are outdated even though the overall list is kept current.
GDA (GJoy Dex Analyzer) is a Windows-native, closed-source Dalvik bytecode decompiler and Android APK reversing tool, written in C++. It provides a GUI for interactive analysis, a CLI for batch operations, and a socket-based server for programmatic access. The open-source components in this repository include Java and Python plugin APIs for scripting analysis tasks (e.g., string decryption, method tracing), example scripts, and skill definitions for LLM-driven automated malware analysis. The core decompiler is not open source, but the plugin interfaces and skill scripts are well-structured and reusable for integrating GDA with other tools or AI agents. The repository also contains color themes, documentation images, and a DEX patching utility.