Havuz

Security testing that runs inside the coding agent you already use. Source-available, not open source.

DevSecOps for the AI-era CI/CD pipeline. Catches the bugs your AI coding assistant introduces — before they reach production.

Policy-aware static taint analysis for detecting sensitive-data flows into LLM APIs.

Kubernetes security assessment CLI: RBAC, pod-escape, and privilege-escalation path analysis. Cloudsplaining for Kubernetes.

AI-powered SAST scanner that finds auth bypass, IDOR, and logic bugs Semgrep/CodeQL miss. Free GitHub Action. Supports Python, JS/TS, Go, PH

Let your AI agent use your passwords and API keys - without ever letting it see them

Static and dynamic analysis tool for detecting malicious code, suspicious binaries, and privacy violations

Hardening Linux automatisé avec Ansible — conformité ANSSI BP-028 (niveaux M/I/R/E). Durcissement système, réseau, SSH, utilisateurs + audit

A deliberately breakable three-tier platform plus a full DevOps / SRE / DevSecOps training curriculum (handbook, capstone assignment, soluti

The self-hosted token, certificate, license, and secret expiration manager with automated Certificate Lifecycle Management (CertOps) for tea

Application security and governance platform — one check covers code flaws, leaked secrets, and dependency/image vulnerabilities, with merge

Audits AUR PKGBUILD updates before you install: detects structural changes, suspicious commands, typosquatting, and novelty signals, then pr

Your app is guilty until proven secure: an agent skill whose /hack-me breaks into your own running app, proves each bug with a real request,

Git-native AI code provenance: records which AI agent wrote which line, signs each attribution with ed25519, stores it in your git history.

Detect abandoned and end-of-life dependencies that CVE-based scanners don't flag, and rank which ones to remove first.

Measure what a vulnerability is worth to your business, not how severe it is in the abstract. Business Exposure Index scoring over NVD, EPSS

Hands-off supply-chain watchdog for dev machines: orchestrates multiple security scanners (Perplexity bumblebee + osv-scanner, govulncheck,

Evidence-driven production readiness checklist for shipping web applications with confidence

Deterministic governance for AI coding agents. Cedar-based policy engine that intercepts every agent action and evaluates it against determi

Self-hosted CVE triage for your root servers: Trivy scans, LLM-judged exploitability, only the findings that matter.

Enterprise-ready CI/CD reference for Microsoft Foundry AI agents, with parallel GitHub Actions and Azure DevOps pipelines, evaluation-driven

Automated CLI security auditor for web configuration vulnerabilities.

AVE - Agentic Vulnerability Enumeration. The open behavioral classification standard for agentic AI components.

Open-source CPG-based interprocedural taint analysis + LLM triage, with a Ghidra-style audit workbench. Runs fully offline.

Git-aware secret & .env leak guard for TypeScript/Node — sub-second pre-commit scanning with the lowest false-positive rate.

NSAuditor AI Community — open-source network security scanner. 27 discovery plugins, structured findings, SARIF/CSV output, MCP integration,

Open-source Supabase security auditor: detects RLS-disabled tables, public buckets, exposed SECURITY DEFINER functions. Active anonymous pro

Vulnerability scanning with your own scanners and threat feeds, plus a coding agent that opens the fix PR. CLI, GitHub Action, or scheduled

An AI-driven tool designed to automate the detection of security vulnerabilities in Java source code.

Evidence-first Codex, Claude plugin for bugs, security, and 10k-to-1M-user scale readiness.

🛡️ AI-powered reconnaissance framework unifying 130+ security tools — subdomain enum, vuln scanning, cloud/IoT recon, dark web monitoring &

gitghost — find secrets in a GitHub account's public repos, including ones 'deleted' but still recoverable from git history. Exposure score

GSC — verified remediation engine: SAST that proves exploits (PoC), verifies fixes (Proof-of-Fix), and self-heals CI. Apache 2.0 + Commercia

Passive attack-surface scanner: turn a domain into a risk grade, copy-paste fixes, and a client-ready report. Safe DNS, HTTP, TLS, email, an

GitFlic is a GitLab and GitHub alternative for Git repository hosting, code review, issues, CI/CD, package registry, SAST/DAST/SCA, availabl

An open-source AppSec agent that reasons like an analyst: real scanners, your org's context, and a conversation instead of 400 findings.

A Collection of Defensive Cyber Security skills designed to harden your Software, Infrastructure and even Game.

Installable Codex/AgentSkills workflow pack for dev, Agent/RAG, API/data, Office artifacts, research diagrams, and authorized security revie

Skill para Claude, Codex, Cursor e outros agentes: check pré-lançamento do seu app com 20 checagens de segurança + 10 de prontidão (Lovable,

Finds what's wrong — and shows you the fix. Code, deps, config & infra — one offline scan, one report.

An AI-powered Git pre-commit/pre-push security gate

Pre-production checklists for solo founders. 4,685 items, 88% portable to any stack, 26 stack supplements — plus AI/agent security and the b

Guardrails para desenvolver com agentes de IA: gate de CI bloqueante, hooks determinísticos, supply chain travada e fluxo de task com evidên

Safely run untrusted repos (fake-interview malware, infostealers, RATs) in a locked-down, ephemeral container. No host secrets reachable, ne

Harness-driven terminal AI agent for authorized security assessment, with TUI, headless automation, persistent context, 150 built-in skill

See which external pull requests need context before code review. Deterministic, no login, no AI.

Catch EU regulatory violations at PR time — GDPR, EU AI Act, NIS2, DORA, CRA, DSA, DMA and the Data Act. Runs entirely on your machine or CI

Coding-agent tools on TypeSafe's Jev, measured in public. review-router: caught 13 of 13 CVE fixes a filename rule sent to a quick review. j

Sandboxed multi-scanner security for AI skills, MCP servers, and package trees — coverage honesty, SIE judging, heatmap posture, guided tria

Nephilex is an open-source AI Security Engineer that analyzes repositories, detects vulnerabilities, validates risks, explains findings, gen