80 matches found
njsscan
njsscan njsscan is a static application testing SAST tool that can find insecure code patterns in your node.js applications using simple pattern matcher from libsast and syntax-aware semantic code pattern search tool semgrep. Made with in India Support njsscan Donate via Paypal: Sponsor the...
salus
Salus: Guardian of Code Safety and Security 🔍 Overview Salus Security Automation as a Lightweight Universal Scanner, named after the Roman goddess of protection, is a tool for coordinating the execution of security scanners. You can run Salus on a repository via the Docker daemon and it will...
mobsfscan
mobsfscan mobsfscan is a static analysis tool that can find insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Android XML, iOS Info.plist, Swift and Objective C Code. mobsfscan uses MobSF static analysis rules and is powered by semgrep and libsast pattern matcher...
vulnhawk
AI-powered code security scanner that finds vulnerabilities Semgrep and CodeQL miss. Quick Start • GitHub Action • Comparison • Languages • FAQ The Problem Traditional SAST tools rely on pattern matching and AST rules. They excel at catching known vulnerability patterns, but they fundamentally...
vibegate
A security checkpoint for AI coding tools. It looks at every file an AI assistant writes, and stops the dangerous ones before they hit disk. What problem does this solve? AI coding assistants Claude Code, Codex, … write code fast — including code that handles things like passwords, emails, API...
nodejsscan
nodejsscan Node.js 应用的静态安全代码扫描器（SAST），基于 libsast 和 semgrep 构建。 用 在印度制作 支持 nodejsscan 通过 PayPal 捐款： 赞助该项目： 在线学习课程与认证 OpSecX Node.js 安全：渗透测试与利用 - NJS 运行 nodejsscan docker pull opensecurity/nodejsscan:latest docker run -it -p 9090:9090 opensecurity/nodejsscan:latest 在本地安装 nodejsscan 安装 Postgres，并在...
nodejsscan
nodejsscan Static security code scanner SAST for Node.js applications powered by libsast and semgrep. Made with in India Support nodejsscan Donate via Paypal: Sponsor the Project: e-Learning Courses & Certifications OpSecX Node.js Security: Pentesting and Exploitation - NJS Run nodejsscan docker...
semgrep-rules
semgrep-rules de elttam Bienvenido al repositorio público de reglas semgrep...
sast-rules
Semgrep rules This is the central Semgrep rule repository that hosts the Semgrep rules for the GitLab semgrep analyzer. The repository is structured as follows: . ├── mappings │ ├── findsecbugs.yml │ ├── eslint.yml │ └── ... ├── rules │ ├── lpgl │ │ ├── java │ │ │ ├── webview │ │ │ │ ├──...
semgrep-rules
semgrep-rules ¡Bienvenido! Este repositorio contiene las reglas de la Community Edition de Semgrep. Además de las reglas de este repositorio, el Semgrep Registry ofrece Pro rules propietarias que amplían la cobertura de lenguajes y desbloquean el análisis de dataflow entre archivos y profundo...
semgrep-rules
semgrep-rules “攻击面就是漏洞。在那里找到漏洞只是一个细节。” —— Mark Dowd “有些细节比其他细节更重要。” —— Fedor G. Pikus 我的 Semgrep 规则集，用于促进漏洞研究。 博客文章 https://hnsecurity.it/blog/semgrep-ruleset-for-c-c-vulnerability-research https://hnsecurity.it/blog/automating-binary-vulnerability-discovery-with-ghidra-and-semgrep...
semgrep
以惊人的速度进行代码扫描。 Semgrep 是一个快速、开源、静态分析工具，用于搜索代码、发现漏洞，并强制执行安全护栏和编码标准。Semgrep 支持 30 多种语言，可在 IDE、作为预提交检查以及作为 CI/CD 工作流的一部分运行。 Semgrep 是面向代码的语义 grep。当运行 grep "2" 只能匹配精确字符串 2 时，Semgrep 可以在搜索 2 时匹配 x = 1; y = x + 1。Semgrep 规则看起来就像你平时编写的代码；无需处理抽象语法树、正则表达式或痛苦的 DSL。 请注意，在安全上下文中，Semgrep...
Callisto
Callisto An Intelligent Automated Binary Vulnerability Analysis Tool Demo: Callisto is an intelligent automated binary vulnerability analysis tool. Its purpose is to autonomously decompile a provided binary and iterate through the psuedo code output looking for potential security vulnerabilities ...
semgrep-rules
Reglas públicas de Semgrep de Trail of Bits Este repositorio contiene reglas de Semgrep desarrolladas por Trail of Bits y puestas a disposición del público. Forman parte de nuestros esfuerzos de desarrollo continuo y se utilizan en nuestras auditorías de seguridad, investigación de vulnerabilidad...
duo-agentflow-auditor
Duo AgentFlow Auditor AI Code Security — catching what SAST misses in AI-generated code Built on the GitLab Duo Agent Platform 40-62% of AI-generated code contains security vulnerabilities. Traditional SAST catches CVEs. We catch what SAST misses — prompt injection, LLM output execution, unsafe M...
SAFE
SAFE SAFE realiza una evaluación de seguridad controlada y consciente del repositorio de los hallazgos de Semgrep y Trivy en artefactos de investigación. Admite dos tareas de clasificación independientes: predicción directa binaria SECURITYRELEVANT o NONSECURITY y la taxonomía contextual detallad...
springshell-rce-poc
CVE-2022-22965 - aplicación vulnerable y PoC Prueba y error $ docker rm -f rce; docker build -t rce:latest . && docker run -d -p 8080:8080 --name rce rce:latest && sleep 5 && python poc.py Ejemplo de salida rce sha256:f626a2190dc0790c610afd4f12a4b2482b6a726d671fdac1432275de89c07cd6...
auth-header-trust-rules
auth-header-trust-rules A small Semgrep rule pack that flags code making authentication, authorization, or trust decisions based on HTTP request headers an attacker controls. The canonical example of the vulnerability class is CVE-2025-29927: Next.js trusted the x-middleware-subrequest header to...
