Havuz

Evidence-driven production readiness checklist for shipping web applications with confidence

Real-time secret-leak guardrails for AI coding agents (Claude Code, Codex), Git hooks, and CI.

Deterministic governance for AI coding agents. Cedar-based policy engine that intercepts every agent action and evaluates it against determi

基于多智能体架构与自主决策机制，配合大语言模型的理解能力，输入自然语言指令，AI 自动完成从目标侦察到漏洞验证的完整渗透测试流程。

Self-hosted CVE triage for your root servers: Trivy scans, LLM-judged exploitability, only the findings that matter.

Concurrent Go CLI that detects hidden prompt-injection content in documents — invisible Unicode, homoglyphs, hidden HTML, and known trigger

Red-team your RAG pipeline for prompt injection, source-document leakage, and cross-document smuggling, in CI. The gap between RAG eval (RAG

Ansible CIS Benchmark Compliance Remediation for DEBIAN13

Official CrowdSec skill for Claude Code & Codex: install, configure, operate and debug the engine, bouncers and WAF/AppSec.

Runtime security platform for LLM agent tool calls on Kubernetes

AI agent skills for the JFrog Platform. Search and download artifacts, query CVEs and exposures, check curation and compliance, trace builds

Open-source AI security tool to scan and fix vulnerabilities in your vibe-coded projects before you ship. AXguard by AwareXone.

Enterprise-ready CI/CD reference for Microsoft Foundry AI agents, with parallel GitHub Actions and Azure DevOps pipelines, evaluation-driven

Automated CLI security auditor for web configuration vulnerabilities.

Engineering best practices that AI coding agents actually apply — 40+ skills, from secure coding and cloud to compliance and UX writing. BUI

AVE - Agentic Vulnerability Enumeration. The open behavioral classification standard for agentic AI components.

Static security scanner and linter for GitLab CI. Finds .gitlab-ci.yml misconfigurations, supply-chain risks, and leaked secrets. Offline, S

Open-source CPG-based interprocedural taint analysis + LLM triage, with a Ghidra-style audit workbench. Runs fully offline.

Git-aware secret & .env leak guard for TypeScript/Node — sub-second pre-commit scanning with the lowest false-positive rate.

NSAuditor AI Community — open-source network security scanner. 27 discovery plugins, structured findings, SARIF/CSV output, MCP integration,

Open-source Supabase security auditor: detects RLS-disabled tables, public buckets, exposed SECURITY DEFINER functions. Active anonymous pro

A Claude / AI security review prompt for shipping safe apps. TRAP (True Readiness Audit Prompt) turns Claude Code, Cursor, or Copilot into a

Vulnerability scanning with your own scanners and threat feeds, plus a coding agent that opens the fix PR. CLI, GitHub Action, or scheduled

Adversarial security testing for AI agents — prompt injection, tool misuse, memory poisoning, and MCP scanning, with CI-ready regression tes

Evidence-backed attack paths, drift, and cost auditing for Hetzner Cloud.

An AI-driven tool designed to automate the detection of security vulnerabilities in Java source code.

Open-source security for AI coding agents: record, detect and block at the tool boundary, with a verifiable audit trail in the SIEM you alre

Evidence-first Codex, Claude plugin for bugs, security, and 10k-to-1M-user scale readiness.

🛡️ AI-powered reconnaissance framework unifying 130+ security tools — subdomain enum, vuln scanning, cloud/IoT recon, dark web monitoring &

gitghost — find secrets in a GitHub account's public repos, including ones 'deleted' but still recoverable from git history. Exposure score

Keep your sensitive credintials out of the agents you build and the coding agent you use. Test any agent with planted fake keys, or see whic

GSC — verified remediation engine: SAST that proves exploits (PoC), verifies fixes (Proof-of-Fix), and self-heals CI. Apache 2.0 + Commercia

Passive attack-surface scanner: turn a domain into a risk grade, copy-paste fixes, and a client-ready report. Safe DNS, HTTP, TLS, email, an

GitFlic is a GitLab and GitHub alternative for Git repository hosting, code review, issues, CI/CD, package registry, SAST/DAST/SCA, availabl

An open-source AppSec agent that reasons like an analyst: real scanners, your org's context, and a conversation instead of 400 findings.

A Collection of Defensive Cyber Security skills designed to harden your Software, Infrastructure and even Game.

Installable Codex/AgentSkills workflow pack for dev, Agent/RAG, API/data, Office artifacts, research diagrams, and authorized security revie

Skill para Claude, Codex, Cursor e outros agentes: check pré-lançamento do seu app com 20 checagens de segurança + 10 de prontidão (Lovable,

Static security scanner for npm/PyPI packages, MCP servers, agent skills and repos. Runs locally, never runs the code, no LLM. CLI, Claude C

Finds what's wrong — and shows you the fix. Code, deps, config & infra — one offline scan, one report.

Deterministic security analysis for Stellar Soroban smart contracts and Rust projects.

An AI-powered Git pre-commit/pre-push security gate

Pre-production checklists for solo founders. 4,685 items, 88% portable to any stack, 26 stack supplements — plus AI/agent security and the b

Trust & security scanner for AI agents and MCP servers — OWASP-mapped findings, Trust Cards (A–F grades), SARIF + CI gate. Free CLI, zero te

Guardrails para desenvolver com agentes de IA: gate de CI bloqueante, hooks determinísticos, supply chain travada e fluxo de task com evidên

Safely run untrusted repos (fake-interview malware, infostealers, RATs) in a locked-down, ephemeral container. No host secrets reachable, ne

Harness-driven terminal AI agent for authorized security assessment, with TUI, headless automation, persistent context, 150 built-in skill

Catch .env secrets leaking into git: a pre-commit hook and CLI that fails when an API key or any value of your env files is staged, tracked

See which external pull requests need context before code review. Deterministic, no login, no AI.

Catch EU regulatory violations at PR time — GDPR, EU AI Act, NIS2, DORA, CRA, DSA, DMA and the Data Act. Runs entirely on your machine or CI