cli

Getting started with the Snyk CLI Introduction to the Snyk CLI Snyk is a developer-first, cloud-native security tool to scan and monitor your software development projects for security vulnerabilities. Snyk scans multiple content types for security issues: Snyk Open Source: Find and automatically...

smokedmeat

SmokedMeat CI/CD Red Team Framework Like Metasploit, but for CI/CD pipelines. From the makers of thepoutine Build Pipeline SAST scanner at BoostSecurity Labs. Warning: This tool is for authorized security testing only. SmokedMeat exists because CI/CD pipeline threats are deeply underestimated...

tun2socks

Características Proxy universal : Enruta de forma transparente todo el tráfico de red de cualquier aplicación a través de un proxy...

DevSecOpsGuideline

Directrices DevSecOps de OWASP Las Directrices DevSecOps de OWASP explican cómo podemos implementar un pipeline seguro, utilizar las mejores prácticas e introducir herramientas que podemos emplear en este ámbito. Además, el proyecto intenta ayudarnos a promover la cultura de seguridad de...

CVE-2026-11120-Command-Injection-via-Git-URL-in-CI-CD-Pipeline

CVE-2026-11120 – Inyección de comandos a través de la URL de Git en el pipeline de CI/CD Código del programa Python root@kitploit: cicdbuild.py - Clones repository without sanitizing URL import subprocess, sys def cloneandbuildrepourl: Vulnerability: repourl can contain shell metacharacters cmd =...

Dependency Scanning

Component for Dependency and License Scanning This component generates a CycloneDX Software Bill of Materials, which is used by GitLab to identify a project's dependencies, and their licenses. This CycloneDX Software Bill of Materials is compatible with the GitLab taxonomy. Additionally, this...

azure-sentinel-detection-engineering

Azure Sentinel Detection Engineering Detection engineering on a live Microsoft Sentinel and Defender XDR environment I operate. Nine custom analytics rules span three planes, each mapped to MITRE ATT&CK and proven end to end: a controlled action triggers the rule, the rule raises an incident, and...

raptor

Raptor is a web-based web-serivce + UI github centric source-vulnerability scanner i.e. it scans a repository with just the github repo url. You can setup webhooks to ensure automated scans every-time you commit or merge a pull request. The scan is done asynchonously and the results are available...

gato

!WARNING 此仓库已弃用并归档 Gato 已被 Trajan 取代，后者是 Praetorian 的多平台 CI/CD 漏洞检测与攻击自动化工具。Trajan 将 GitHub Actions（Gato）和 GitLab（Glato）的 CI/CD 攻击能力整合到一个持续维护的项目中。 请迁移至 Trajan： https://github.com/praetorian-inc/trajan 此仓库将不再进行任何更新、错误修复或安全补丁。 Gato（GitHub 攻击工具包） Gato，即 GitHub 攻击工具包，是一款枚举与攻击工具，使蓝队成员和攻击性安全从业者能够识别并利用...

salus

Salus：代码安全与保障的守护者 🔍 概述 Salus（安全自动化轻量级通用扫描器），以罗马保护女神命名，是一个用于协调执行安全扫描器的工具。您可以通过Docker守护进程在仓库上运行Salus，它会确定哪些扫描器相关，运行它们并提供输出。大多数扫描器是我们直接包含在容器中的其他成熟的开源项目。 Salus对于CI/CD流水线特别有用，因为它成为跨大量仓库协调扫描的集中化场所。通常，扫描器在每个项目的仓库级别配置。这意味着当对整个组织范围内扫描器的运行方式进行更改时，每个仓库都必须更新。相反，您可以更新Salus，所有构建将立即继承更改。...

GuardModel

GuardModel Block malicious AI models in your pipeline with one line of YAML. GuardModel is a GitHub Action that automatically scans ML model files for malicious code, vulnerabilities, and security risks in CI/CD pipelines. It blocks dangerous models before they reach production by detecting pickl...

Nest

!Issueshttps://img.shields.io/github/issues/owasp/nest?color=blue&style=...

cifswitch-check

cifswitch-check Un script de shell para comprobar si un sistema Linux está expuesto a CIFSwitch CVE-2026-46243 — una vulnerabilidad de escalada de privilegios local en el cliente CIFS/SMB del kernel de Linux que existe desde 2007. Se ejecuta en hosts de metal desnudo, máquinas virtuales y dentro ...

trivysupplychainanalysis

Análisis Cuantitativo de Ataques a la Cadena de Suministro CI/CD de Múltiples Etapas Una reconstrucción cuantitativa y formalmente verificada del compromiso de la cadena de suministro de GitHub Actions de Trivy / "TeamPCP" de marzo de 2026 CVE-2026-33634 — modelado en TLA+, verificado...

cicd-sensor

This repository does not have a README...

gh-workflow-auditor

GitHub Workflow Auditor Herramientas de auditoría de flujos de trabajo para identificar problemas de seguridad en flujos de trabajo de GitHub Uso root@kitploit: usage: main.py -h --type repo,org,user --log-level debug,info,warning,error,critical input Identify vulnerabilities in GitHub Actions...

CVE-2026-92903 Improper Input Validation in Snowflake CLI Versions Allow Unsanitized User-Controlled Values to be Interpolated into SQL Strings

Improper input validation in Snowflake CLI versions prior to 3.27.0 allowed unsanitized user-controlled values to be interpolated into SQL strings that are executed as multi-statement queries. An attacker who is able to supply a malicious project configuration file or craft command-line input can...

EUVD-2026-81428

Improper input validation in Snowflake CLI versions prior to 3.27.0 allowed unsanitized user-controlled values to be interpolated into SQL strings that are executed as multi-statement queries. An attacker who is able to supply a malicious project configuration file or craft command-line input can...

Exploit for CVE-2020-1472

C...

EUVD-2026-62865

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pullrequest.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. ...