DevSecOps

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

ASOC, ASPM, DevSecOps, Vulnerability Management Using ArcherySec.

Reconmap is a collaboration-first security operations platform for infosec teams and MSSPs, enabling end‑to‑end engagement management, from reconnaissance through execution and reporting. With built-in command automation, output parsing, and AI‑assisted summaries, it delivers faster, more structured, and high‑quality security assessments.

The independent security agent for AI-written software. Finds issues, investigates whether they are real, and shows you the evidence. Deterministic core, no API key needed, JSON and SARIF output.

GitHub Actions Goat: Deliberately Vulnerable GitHub Actions CI/CD Environment

njsscan is a semantic aware SAST tool that can find insecure code patterns in your Node.js applications.

A GitHub Action for running the ZAP Full scan

A GitHub Action for running the ZAP Baseline scan

⚙️ Scan your Go, Java, Kotlin, PHP, Python, JavaScript, TypeScript, .NET projects at GitHub with Qodana. This repository contains Qodana for Azure, GitHub, CircleCI and Gradle

CLI component of OWASP PurpleTeam

☁️Haven GRC - easier governance, risk, and compliance 👨‍⚕️👮‍♀️🦸‍♀️🕵️‍♀️👩‍🔬

Audit your GitHub Actions workflow runs to see exactly which Actions were downloaded

A GitHub Action for running the ZAP API scan

GitHub action to scan container images with Palo Alto Networks' Prisma Cloud

Schema-driven awesome list of cloud security guardrails powering cloudguardrail.com/tools

A GDPR Data Protection Impact Assessment (DPIA) tool to assist organisations to evaluate data protection risks with respect to the EU's General Data Protection Regulation. 🇪🇺

20-pass adversarial audit for vibe-coded software. Injection, IDOR, races, N+1, idempotency, transactions, memory leaks — then a false-positive verifier.

The self-hosted token, certificate, license, and secret expiration manager with automated CertOps for teams.

Local-first pentest workbench — 5,040 commands with expected output, a box-solving workspace (services, credential vault, timeline, generated report), 16 exam/lab session presets and a Markdown write-up editor. Runs on Node or fully in the browser.

Secure GitHub actions with 1 line of code