01Open source
Repos
Open-source repos worth knowing, by the problem they take on.
Security
BugScanner Web Scanner
BugScanner is an advanced web vulnerability scanner with recon, subdomain/port scanning, fingerprinting, endpoint discovery, and checks for XSS, SQLi, CORS, SSRF, open redirects. It includes false-positive reduction, WAF evasion, and HTML reports.
Cyber Resume Reviewer
An agent skill for evidence-led cybersecurity resume reviews, tailoring to job descriptions, exact edits, scoring, and rewrites; produces Markdown report and styled PDF. It does not rank candidates or invent achievements.
ToolReplay AI Audit
ToolReplay audits AI agent tool-call transcripts for non-determinism, redundancy, and out-of-scope calls using hash-chain sealing and deterministic replay. It is a dependency-free Python CLI notable for its novel hash-chain audit approach.
MCP Pentesting Toolbelt
Blitz Strike is an MCP server that provides a structured penetration-testing methodology with reconnaissance, source-to-sink analysis, and live validation. It includes a 130-tool catalog and 57 escalation chains, notable for MCP-native pentest automation.
GitHub Security Extension
gh-secure is a GitHub CLI extension that enables repository security features such as secret scanning, dependency alerts, and private vulnerability reporting according to GitHub Security Lab best practices. It is notable as an org-backed tool.
Decentralized Auth System
minidauth moves the signing/decryption key out of an existing auth system into threshold shares across the Tide network, so no single node can reconstruct it. It adds decentralized governance over decryption and is notable for zero-trust key management.
Red Team Automation
ARES is an open-core platform for authorized red-team engagements, offering campaign scope, module orchestration, OPSEC controls, an encrypted vault, and reporting. It has a dashboard and is notable for adoption with 32 forks.
Threat Intel Aggregator
ThreatIntel-Aggregator is a self-hosted platform that aggregates RSS feeds from 60+ security vendors, performs AI triage, and correlates findings with asset inventory and MITRE ATT&CK. It supports standalone or Azure/Sentinel deployment and is notable for fresh substantive features.
Post-Quantum Cryptography Census
PQCensus statically scans software repositories to inventory cryptographic uses and plan post-quantum migration, with evidence grounding and SARIF/CycloneDX output. It runs locally with zero mandatory runtime dependencies and is notable for novel post-quantum migration planning.
Data Maskit
A local privacy gateway that masks sensitive data in requests to AI coding assistants and restores masked values in streaming responses. It supports tools like Cursor, Claude Code, Codex, Pi, and any configurable Base URL tool.
Compartment Deployment System
A self-hosted Kubernetes deployment system for running small software on infrastructure your team controls. It installs into an existing cluster or provisions a single-node Kubernetes host and provides runtime, URLs, access control, deployment history, and operations surface via repository-first workflow.
CI/CD Beginner Template
A production CI/CD pipeline template for Node.js projects, with a minimal Fastify service and quality gates, container security, SLSA provenance, cosign signing, and automated release management. It includes ESLint, Prettier, TypeScript checks, Vitest coverage, and Node 22/24 test matrix.
Meme Radar
A local, read-only multi-chain meme candidate scanner and manual review tool. It uses GMGN, GoPlus, and DexScreener to surface evidence on contract risk, liquidity, market cap, and official links across Solana, BNB, Base, Ethereum, Robinhood Chain, Arc, and Stable.
DeepSeek Harness Bridge
A plugin that adds multi-channel remote access and security controls to DeepSeek Harness, including LAN QR connections, Cloudflare or self-hosted tunnels, and WeChat/QQ/Feishu/Telegram bots. It provides protocol-wide authentication, anti-tamper protection, and disaster recovery.
Enterprise System Design
An enterprise distributed systems design course and technical reference for building reliable, secure, operable platforms on Azure, from first principles to production AI workloads. It spans enterprise, distributed, AI, cybersecurity, reliability, cloud, HPC, edge, and mission-critical infrastructure.
React Native Secure WebView
A Fabric-native React Native WebView for authentication, checkout, OAuth, and other controlled web flows. It denies by default, validates top-level navigation against an origin allowlist natively, intercepts custom scheme redirects, and exposes a single string-only web-to-native bridge.
KeyCloak Exploit
This exploit for Keycloak CVE-2026-18963 lets an unauthenticated attacker set an arbitrary password on any account knowing only a username or email. It affects 26.0.0–26.7.1, fixed in 26.7.2, and is a valuable PoC for researchers.
Secret Exposure Tracker
RotationLedger reads a committed `git log -p` export offline, detects credential-shaped strings, and reports each secret's exposure days, introduction/removal commits, and HEAD presence. It is a fresh, focused credential hygiene CLI.
AI Red-Team Platform
REDCELL is an AI red-team platform where autonomous LLM agents run end-to-end penetration tests inside a Kali container and generate reports. It is a novel autonomous AI red-team tool with active development, using LangGraph and provider-agnostic models.
Host Container Security
MxCwpp is an open-source, enterprise-grade host and container security platform covering baselines, asset management, vulnerability scanning, antivirus, runtime detection, and compliance auditing. Its free Community Edition shares the internal architecture and targets security operations teams.