Havuz

Safely run untrusted repos (fake-interview malware, infostealers, RATs) in a locked-down, ephemeral container. No host secrets reachable, ne

Harden your package manager configs against supply chain attacks.

Is your lockfile pwned? 5-second scan of npm/PyPI/Maven/Cargo/Go/RubyGems lockfiles for compromised packages — OSV + curated campaign feed,

Find the plaintext secrets on your Mac and move them behind Touch ID, injected just in time without breaking the tools that read them. Free

A Python CLI tool that scans all repositories owned by a GitHub user/org for accidentally committed secrets (API keys, tokens, passwords, pr

Subagent Verification for Claude AI Code Networks 2026

Automated Proof-of-Carrying Change Management for AIOps 2026

DevSecOps for the AI-era CI/CD pipeline. Catches the bugs your AI coding assistant introduces — before they reach production.

Let your AI agent use your passwords and API keys - without ever letting it see them

Hardening Linux automatisé avec Ansible — conformité ANSSI BP-028 (niveaux M/I/R/E). Durcissement système, réseau, SSH, utilisateurs + audit

A deliberately breakable three-tier platform plus a full DevOps / SRE / DevSecOps training curriculum (handbook, capstone assignment, soluti

Application security and governance platform — one check covers code flaws, leaked secrets, and dependency/image vulnerabilities, with merge

Your app is guilty until proven secure: an agent skill whose /hack-me breaks into your own running app, proves each bug with a real request,

Git-native AI code provenance: records which AI agent wrote which line, signs each attribution with ed25519, stores it in your git history.

Hands-off supply-chain watchdog for dev machines: orchestrates multiple security scanners (Perplexity bumblebee + osv-scanner, govulncheck,

Deterministic governance for AI coding agents. Cedar-based policy engine that intercepts every agent action and evaluates it against determi

Self-hosted CVE triage for your root servers: Trivy scans, LLM-judged exploitability, only the findings that matter.

Concurrent Go CLI that detects hidden prompt-injection content in documents — invisible Unicode, homoglyphs, hidden HTML, and known trigger

Red-team your RAG pipeline for prompt injection, source-document leakage, and cross-document smuggling, in CI. The gap between RAG eval (RAG

AI agent skills for the JFrog Platform. Search and download artifacts, query CVEs and exposures, check curation and compliance, trace builds

Enterprise-ready CI/CD reference for Microsoft Foundry AI agents, with parallel GitHub Actions and Azure DevOps pipelines, evaluation-driven

Automated CLI security auditor for web configuration vulnerabilities.

Open-source CPG-based interprocedural taint analysis + LLM triage, with a Ghidra-style audit workbench. Runs fully offline.

Git-aware secret & .env leak guard for TypeScript/Node — sub-second pre-commit scanning with the lowest false-positive rate.

Open-source Supabase security auditor: detects RLS-disabled tables, public buckets, exposed SECURITY DEFINER functions. Active anonymous pro

A Claude / AI security review prompt for shipping safe apps. TRAP (True Readiness Audit Prompt) turns Claude Code, Cursor, or Copilot into a

Vulnerability scanning with your own scanners and threat feeds, plus a coding agent that opens the fix PR. CLI, GitHub Action, or scheduled

An AI-driven tool designed to automate the detection of security vulnerabilities in Java source code.

Evidence-first Codex, Claude plugin for bugs, security, and 10k-to-1M-user scale readiness.

🛡️ AI-powered reconnaissance framework unifying 130+ security tools — subdomain enum, vuln scanning, cloud/IoT recon, dark web monitoring &

Keep your sensitive credintials out of the agents you build and the coding agent you use. Test any agent with planted fake keys, or see whic

Passive attack-surface scanner: turn a domain into a risk grade, copy-paste fixes, and a client-ready report. Safe DNS, HTTP, TLS, email, an

An open-source AppSec agent that reasons like an analyst: real scanners, your org's context, and a conversation instead of 400 findings.

Installable Codex/AgentSkills workflow pack for dev, Agent/RAG, API/data, Office artifacts, research diagrams, and authorized security revie

Skill para Claude, Codex, Cursor e outros agentes: check pré-lançamento do seu app com 20 checagens de segurança + 10 de prontidão (Lovable,

Finds what's wrong — and shows you the fix. Code, deps, config & infra — one offline scan, one report.

An AI-powered Git pre-commit/pre-push security gate

Pre-production checklists for solo founders. 4,685 items, 88% portable to any stack, 26 stack supplements — plus AI/agent security and the b

Trust & security scanner for AI agents and MCP servers — OWASP-mapped findings, Trust Cards (A–F grades), SARIF + CI gate. Free CLI, zero te

Guardrails para desenvolver com agentes de IA: gate de CI bloqueante, hooks determinísticos, supply chain travada e fluxo de task com evidên

Harness-driven terminal AI agent for authorized security assessment, with TUI, headless automation, persistent context, 150 built-in skill

See which external pull requests need context before code review. Deterministic, no login, no AI.

Catch EU regulatory violations at PR time — GDPR, EU AI Act, NIS2, DORA, CRA, DSA, DMA and the Data Act. Runs entirely on your machine or CI

Coding-agent tools on TypeSafe's Jev, measured in public. review-router: caught 13 of 13 CVE fixes a filename rule sent to a quick review. j

Sandboxed multi-scanner security for AI skills, MCP servers, and package trees — coverage honesty, SIE judging, heatmap posture, guided tria

Nephilex is an open-source AI Security Engineer that analyzes repositories, detects vulnerabilities, validates risks, explains findings, gen

Protection against npm supply-chain attacks. One command: Socket Firewall on every package manager, minimum release age, ignore-scripts.

NEXUS REDFOX — Local-first code intelligence and security analysis platform for developers and security researchers.

Autonomous web-app pentest engine — a multi-agent pipeline wielding 30+ offensive-security tools as skills, PoC-validated findings. Built on

MCP security scanner & config linter for AI coding agents. Finds leaked secrets, risky commands, broad permissions and invalid MCP servers i