Nuclei is a template-based vulnerability scanner written in Go. It allows users to define security checks using YAML or JSON templates, which can be executed against a wide range of targets via multiple protocols (HTTP, DNS, network, file, etc.). The scanner features a modular architecture with a core engine that orchestrates template execution, a template system for parsing and compiling checks, and protocol-specific implementations for sending requests and processing responses. Key features include workflow chaining for multi-step attacks, fuzzing capabilities for dynamic application security testing, JavaScript extensibility for custom logic in templates, and integrations with various issue trackers and cloud platforms for result reporting. The project emphasizes performance through optimizations like template clustering (deduplicating identical requests across templates) and connection pooling. The codebase demonstrates strong engineering practices in several areas: a self-contained template clustering system for request deduplication, a JavaScript binding generation system that automates the creation of Goja-compatible libraries, a workflow context propagation system for sharing data between template steps, and a cryptographic template signing mechanism to ensure integrity. These components are designed to be reusable and showcase non-obvious solutions to common problems in security tooling. Maintenance is active with recent commits and a vibrant community. The project keeps pace with its ecosystem, showing low technical drift through regular updates to dependencies and active maintenance of generated code. Its extensive test suite and CI/CD pipelines further indicate a healthy, well-maintained project.

AlterX is a Go CLI tool and library for generating subdomain wordlists using a DSL (Domain-Specific Language) for patterns and an optional pattern mining mode. It ingests a list of known subdomains, extracts variables (sub, suffix, root, etc.), and applies user-defined or automatically discovered patterns to produce permutations. The architecture is modular: a Mutator engine orchestrates either default pattern-based generation (using ClusterBomb cartesian product) or pattern mining (via edit-distance clustering, n-gram analysis, and DFA-based regex generation). Key entry points are the CLI (`cmd/alterx/main.go`) and the library API (`mutator.go`). External dependencies include `fasttemplate` for variable replacement, `publicsuffix` for domain parsing, and `projectdiscovery/utils` for deduplication and other utilities. The pattern mining subsystem (ported from Regulator) uses a three-phase clustering algorithm and Brzozowski's DFA minimization to generate subdomains from observed patterns. The tool supports three modes: default (user patterns), discover (mined patterns only), and both (combined).

cdncheck is a Go library and CLI tool for identifying whether an IP address or domain belongs to a CDN, WAF, or cloud provider. It uses embedded CIDR range data (compiled from ASN, URL, and static CIDR sources) and efficient IP matching via the `bart` radix tree. The library provides a clean `Client` interface with methods like `CheckCDN`, `CheckCloud`, `CheckWAF`, and `CheckDomainWithFallback` that also resolve DNS and check CNAME suffixes. The CLI wraps this with input/output handling, filtering, and JSON output. The codebase is well-structured, with clear separation between core logic, data generation, and CLI runner. It is actively maintained by ProjectDiscovery and used in their security scanning ecosystem.