01Open source
Repos
Open-source repos worth knowing, by the problem they take on.
Security
TRONSEC
A JavaScript read-only TRON security workbench that inspects addresses, contracts, transactions, approvals.
Aegis
A TypeScript self-hosted web application firewall and reverse proxy for inspecting HTTP traffic, enforcing Layer 7 rate limits, and managing routing policies.
VD Google
A Kotlin Android app requiring root that reads on-device RCS, Google Wallet, and Play Integrity attestation data without sending anything over the internet.
box
A Rust sandbox for running AI agents under OS isolation with default-deny Dogwood policies that limit execution, file access, network reach.
jactionlint
Statically checks GitHub Actions workflow syntax and expression types, serving as an actively maintained fork of rhysd/actionlint.
AtlasX
Self-hosted shell-based system for discovering external assets via certificate transparency and passive DNS to monitor corporate exposures.
OpenQodex
Adds pre-push AI code review to Claude Code or Codex by running security scanners on changed lines and verifying each finding.
origin-scoped-fetch
TypeScript fetch wrapper that drops custom authentication, cookie, and API key headers when redirects cross to different origins.
headerscrub
Go http.Client checkRedirect policy that prevents caller-set headers like X-Api-Key from leaking when redirects cross origins.
VulnHunter
VulnHunter is an Apache-2.0 AI security scanner maintained as a harness-portable fork of Capital One's tool and used to prove vulnerabilities with sandboxed
action-dist-verify
action-dist-verify is an MIT-licensed TypeScript utility that rebuilds a pinned action's dist from source and diffs the committed artifact
Witness Vault
Witness Vault is an MIT-licensed Python tool that packages secrets into a self-decrypting offline HTML vault with AES-256-GCM WebCrypto
Hot Cell
HotCell is an MIT-licensed Ruby sidecar for Rails apps to run untrusted code on untrusted inputs in an unprivileged container
Persistent Browser-In-The-Middle
P-BitM is a GPL-3.0 Python platform for controlled browser-in-the-middle security assessments with an admin dashboard, isolated browsers, session viewing
OpenAPPA Guardrails
OpenAPPA is a deterministic guardrail layer that sits between an AI agent and its tools to enforce permission policies on data flows. It is notable for using a formal policy algebra (APPA) to make agent permissions auditable, though validation is still early.
Moria IoT Identification
Moria is a tool for identifying and extracting filesystems, kernels, and other structures embedded in IoT firmware without root privileges. It is notable for its recursive unpacking of many filesystem types and clean JSON output designed for scripting and LLM agents.
Mithril IoT Scanner
mithril is a static scanner for IoT firmware contents that detects secrets, builds SBOMs, finds CVEs, checks licenses, and assesses boot-security posture. It is notable for reporting evidence and confidence per finding and for its JSON-first design aimed at both humans and LLM agents.
Lagune Security Copilot
Lagune is a security copilot that points an AI agent at a codebase to guide developers and auditors through relevant security work without requiring an API key. It is notable for supporting 73 agents and any programming language, though it remains early-stage with low traction.
PCYBox Attack Graph
pcybox-attackgraph is a browser-based lab for building simulated infrastructure and observing attack paths, with explanations of why each step succeeds and which defensive controls would break it. It is notable as an educational and threat-modeling tool that runs entirely in the browser.
Strypt Metadata Remover
strypt is an offline Rust desktop and CLI tool that removes metadata such as GPS coordinates, serial numbers, author names, and timestamps from photos, PDFs, Office documents, audio, and video. It is notable for its memory-safe implementation and strict no-network code paths.
Synapse CE Control
Synapse CE is a governed control plane for the security assessment lifecycle, covering SCA, SAST, secrets scanning, recon, cloud posture, and blue-team agents. It is notable for combining server-side scope enforcement, tamper-evident evidence, and deterministic reporting into a single auditable workflow.
SOC 2 Methodology
Chiaro-HQ/methodology publishes Chiaro's SOC 2 readiness and audit methodology, including controls, evidence standards, and judgment calls. It offers transparent guidance for compliance engineers and auditors working on SOC 2.
Reverse Engineering Plugin
dsh-reverse-skill packages all 88 SKILL.md files from the reverse-skill project as a DeepSeek Harness plugin. It is useful for authorized reverse engineering and pentesting, providing a complete skill pack within the dsh ecosystem.
AI Security Agent
0 is an open-source AI security agent that finds, exploits, and fixes vulnerabilities across codebases. It is notable for autonomous vulnerability discovery and remediation, with strong momentum as a research preview from a Swiss AI security lab.
Red Team Infrastructure
redStackPRO is a web canvas for designing red team infrastructure and cyber ranges, exporting runnable Terraform and Ansible. It keeps cloud credentials local, filling an infrastructure-as-code gap for security teams.
Secure File Transfer
Mirall is a peer-to-peer application for secure large file transfer without cloud storage or accounts. It uses end-to-end encryption and direct connections, designed for moving terabyte-scale files privately with a small but dedicated user base.
Cybersecurity Learning Platform
AG Cyber Lab is an open-source cybersecurity learning platform with structured lessons, guided labs, and progress tracking. It uses a custom lab engine to build foundational technical skills for beginners, focusing on understanding over tool memorization.
WordPress Path Traversal
This repository provides a proof-of-concept for CVE-2026-87902, an unauthenticated path traversal in WordPress Core enabling local PHP inclusion and conditional RCE. It includes a pinned vulnerable lab, making it timely and practical for testing.
BlueWatch Bluetooth Monitor
Passive Bluetooth neighbourhood monitor for Raspberry Pi and Linux that provides a live radar, device triage, categories, and alerts for new devices. Notable for its physical security assessment use case, surfacing unrecognized devices by filtering out familiar traffic.
Hunt MD Format
Open, portable Markdown format for threat-hunting playbooks that describes hunts as readable, git-diffable documents and typed graphs of steps. Notable as an early-stage specification for detection engineering with a library of 150+ published hunts.
Docker AI Governance
Deterministic execution authority for AI agents and automated workflows running with Docker, adding an explicit boundary between agent intent and consequential execution through policy and human approval. Notable as an early-stage AI governance approach for Docker.
Susanin VPN Routing
Adaptive behavioral VPN routing for MikroTik RouterOS that observes connection behavior and detects paths performing poorly over direct routing, then adjusts accordingly. Notable as a niche, early-stage ARM64 project for MikroTik users needing dynamic routing.
Caddy Log Analyzer
Fast, zero-dependency access log analyzer, security threat inspector, and TUI dashboard for Caddy v2 that scans requests against 26 attack categories with MITRE ATT&CK tagging. Notable for self-hosters and small teams wanting threat detection from Caddy logs.
SmuggleMyPayload Toolkit
HTML smuggling toolkit that generates pages embedding and reconstructing files client-side using JavaScript, with multiple methods, encoding options, and templates. Notable as a practical, niche offensive tool for red teams bypassing perimeter controls.
CISA KEV Orchestrator
Zero-touch pipeline that converts newly weaponized CVEs from the CISA Known Exploited Vulnerabilities catalog into production-ready Sigma detection rules automatically each week. Notable for automating threat intelligence for SOC teams and detection engineers.
RiftX Pentest Tool
RiftX is a local workbench for authorized web security testing that combines agent conversations, controlled local tools, a Playwright browser, multi-agent collaboration, and evidence capture. It aims to reduce manual context switching across terminals, browsers, proxies, and notes.
Netlogon RCE PoC
A proof-of-concept for CVE-2026-41089 Netlogon remote code execution, intended for security research, vulnerability validation, and defensive testing. The README text appears copied from an unrelated AI security tool.
AI Security Tool
Free open-source AI-powered security terminal and vulnerability scanner with CVE/SBOM support, SSH/SFTP/RDP/VNC/serial connections, and 12+ AI agents. It unifies security audit, Red Team, pentest, and CTF workflows in desktop and web interfaces.
Cybersecurity Daily
Automated daily Chinese cybersecurity briefing that aggregates CVE, vulnerability notices, security incidents, and threat intelligence; AI-generated, human-verified, published to GitHub Pages. It selects 5-10 items with analysis and source links.
AITIR Framework
AITIR 2.0 is a vendor-neutral reference architecture for adaptive identity threat intelligence and response, converting identity telemetry into provenance-linked evidence, policy decisions, authorized responses, and reviewable assurance. It separates analytics evidence from enforcement authority.