docker-bench-security

Docker Bench for Security The Docker Bench for Security is a script that checks for dozens of common best-practices around deploying Docker containers in production. The tests are all automated, and are based on the CIS Docker Benchmark v1.6.0. We are making this available as an open-source utili...

iptables-essentials

Iptables Essentials: Common Firewall Rules and Commands ☑️ TODO Add useful Iptables configuration examples Add useful Kernel Settings sysctl configuration Add links to useful external resources Add advanced configuration examples, commands, rules Table of Contents Tools to help you configure...

scorecard

OpenSSF Scorecard Overview What Is Scorecard? Prominent Scorecard Users View a Project's Score Scorecard's Public Data Using Scorecard Scorecard GitHub Action Scorecard REST API Scorecard Badges Scorecard Command Line Interface Prerequisites Installation Authentication Basic Usage Checks Default...

wstg

OWASP Web Security Testing Guide Welcome to the official repository for the Open Worldwide Application Security Project® OWASP® Web Security Testing Guide WSTG. The WSTG is a comprehensive guide to testing the security of web applications and web services. Created by the collaborative efforts of...

tailsnitch

Tailsnitch A security auditor for Tailscale configurations. Tailsnitch scans your tailnet for 57 misconfigurations, overly permissive access controls, and security best practice violations. Quick Start 1. Set your Tailscale API credentials export TSAPIKEY="tskey-api-..." 2. Run audit tailsnitch 3...

mesh-kridik

mesh-kridik Enhance your Kubernetes service mesh security !! mesh-kridik is an open-source security checker that performs various security checks on a Kubernetes cluster with istio service mesh and outputs a security report The security checks tests are the full implementation of istio security...

popeye

Popeye: Kubernetes Live Cluster Linter Popeye is a utility that scans live Kubernetes clusters and reports potential issues with deployed resources and configurations. As Kubernetes landscapes grows, it is becoming a challenge for a human to track the slew of manifests and policies that orchestra...

coreruleset

分支| 状态 ---|--- main| 🛡️ OWASP CRS OWASP CRS 是一套通用攻击检测规则，用于 OWASP ModSecurity、OWASP Coraza 或其他兼容的 Web 应用防火墙。CRS 旨在保护 Web 应用免受广泛攻击（包括 OWASP Top Ten），同时最大限度减少误报。 📚 CRS 资源、相关项目与工具 请访问 OWASP CRS 页面 了解 CRS 的入门介绍，获取安装、配置及使用 CRS 的资源。该页面还提供了 CRS 相关项目列表 以及适用于开发者和用户的 工具列表。 🤝 为 CRS 做贡献 我们努力让 OWASP CRS...

zaproxy

Checkmarx 的 Zed Attack Proxy ZAP 是全球使用最广泛的 Web 应用程序扫描器。 免费且开源。这是一个社区驱动的 GitHub Top 1000 项目，任何人都可以为其做出贡献。 它可以帮助您在开发和测试应用程序时自动发现 Web 应用程序中的安全漏洞。 对于经验丰富的渗透测试人员来说，它也是一款用于手动安全测试的出色工具。 !https://assets.kitploit.com/production/public/readmes/398/d136b5...

trivy-operator

Kubernetes-native security toolkit. Documentation Introduction The Trivy Operator leverages Trivy to continuously scan your Kubernetes cluster for security issues. The scans are summarised in security reports as Kubernetes Custom Resource Definitions, which become accessible through the Kubernete...

DevSecOpsGuideline

Directrices DevSecOps de OWASP Las Directrices DevSecOps de OWASP explican cómo podemos implementar un pipeline seguro, utilizar las mejores prácticas e introducir herramientas que podemos emplear en este ámbito. Además, el proyecto intenta ayudarnos a promover la cultura de seguridad de...

authelia

!OpenSSF Scorecardhttps://shieldcn.dev/badge/dynamic/json.svg?url=https://img.shields.io/ossf-scorecard/github.com/authelia/authelia.json&query=$.message&label=openssf%20scorecard&logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmc...

aws-security-assessment-solution

自助安全评估解决方案 v2.0 网络安全仍然是许多 CIO、CISO 及其客户非常关注的重要议题和关切点。为了应对这些重要关切，AWS 开发了一套客户应使用的主要服务，以帮助保护其账户。Amazon GuardDuty、AWS Security Hub、AWS Config 和 AWS Well-Architected 审查可帮助客户在其 AWS 账户上维持强大的安全态势。随着越来越多的组织部署到云端，尤其是在快速部署的情况下，如果他们尚未实施推荐的 AWS 服务，可能需要对云环境进行快速安全评估。...

Software-Component-Verification-Standard

OWASP Software Component Verification Standard El Estándar de Verificación de Componentes de Software SCVS es un esfuerzo impulsado por la comunidad para establecer un marco de referencia que permita identificar actividades, controles y mejores prácticas, que pueden ayudar a identificar y reducir...

API-Security

OWASP API Security Top 10 Este proyecto está diseñado para abordar el creciente número de organizaciones que están implementando API potencialmente sensibles como parte de sus ofertas de software. Estas API se utilizan para tareas internas y para interactuar con terceros. Desafortunadamente, much...

IRM

Spanish version Deprecated The Spanish version is available here. These cheat sheets have been written in English and Russian, and translated into Spanish by Francisco Neira from the OAS...

mongoaudit

mongoaudit is a CLI tool for auditing MongoDB servers, detecting poor security settings and performing automated penetration testing. Installing Clone this repository and run the setup: git clone https://github.com/stampery/mongoaudit.git cd mongoaudit python setup.py install mongoaudit...

popeye

Popeye: Kubernetes 实时集群检查工具 Popeye 是一款实用工具，用于扫描实时 Kubernetes 集群，并报告已部署资源和配置中存在的潜在问题。 随着 Kubernetes 生态系统的增长，人类要跟踪编排集群的大量清单和策略变得越来越困难。 Popeye 基于集群中实际部署的内容进行扫描，而非磁盘上的文件。通过对集群进行代码审查，它能够检测配置错误、过时的资源，并帮助您确保遵循最佳实践，从而预防未来的问题。 它旨在减轻操作 Kubernetes 集群时面临的认知超载。 此外，如果您的集群使用了...

AndroBugs_Framework

AndroBugs Framework AndroBugs Framework is an Android vulnerability analysis system that helps developers or hackers find potential security vulnerabilities in Android applications. No splendid GUI interface, but the most efficient less than 2 minutes per scan in average and more accurate. Versio...

CVE-2026-82356

Imprivata EAM =26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key pair indefinitely for certificate generation is against best practices...