zizmor

🌈 zizmor zizmor is a static analysis tool for CI/CD systems. It can find and fix security issues in common CI/CD setups, including GitHub Actions, Dependabot, and pre-commit. Some of the things zizmor finds: Template injection vulnerabilities, leading to attacker-controlled code execution...

DevSecOpsGuideline

OWASP DevSecOps Guideline The OWASP DevSecOps Guideline explains how we can implement a secure pipeline and use best practices and introduce tools that we can use in this matter. Also, the project is trying to help us promote the shift-left security culture in our development process. This projec...

gvisor

What is gVisor? gVisor provides a strong layer of isolation between running applications and the host operating system. It is an application kernel that implements a Linux-like interface. Unlike Linux, it is written in a memory-safe language Go and runs in userspace. gVisor includes an Open...

api-security-audit-action

GitHub Action: 42Crunch REST API Static Security Testing The REST API Static Security Testing action locates REST API contracts that follow the OpenAPI Specification OAS, formerly known as Swagger and runs thorough security checks on them. Both OAS v2 and v3.0.x are supported, in both JSON and YA...

murphysec

中文 | EN MurphySec CLI is used for detecting vulnerable dependencies from the command-line, and also can be integrated into your CI/CD pipeline. Features 1. Analyze dependencies being used by your project, including direct and indirect dependencies 2. Detect known vulnerabilities in project...

botb

Break out the Box BOtB BOtB is a container analysis and exploitation tool designed to be used by pentesters and engineers while also being CI/CD friendly with common CI/CD technologies. What does it do? BOtB is a CLI tool which allows you to: Exploit common container vulnerabilities Perform commo...

ageverificationbypass

AgeVerificationBypass AVB The Sanctuary Protocol for Sovereign Systems Why do I need to provide an ID to log into a Linux VM? This is not appropriate. 🚨 The Problem: The Archon Age-Gate As of 2026/2027, major distributions Ubuntu and Fedora have begun integrating the...

dnsx-action

dnsx Action makes it easy to orchestrate dnsx with GitHub Action. Example Usage GitHub Action runningdnsx on list of hosts - name: 💥 dnsx - DNS Resolver uses: projectdiscovery/dnsx-action@main with: list: hosts.txt GitHub Action runningdnsx with custom resolvers - name: 💥 dnsx - DNS Resolver uses...

nord-stream

Nord Stream Nord Stream is a tool that allows you extract secrets stored inside CI/CD environments by deploying malicious pipelines. It currently supports Azure DevOps, GitHub and GitLab. Find out more in the following blogpost:...

smokedmeat

SmokedMeat CI/CD Red Team Framework Like Metasploit, but for CI/CD pipelines. From the makers of thepoutine Build Pipeline SAST scanner at BoostSecurity Labs. Warning: This tool is for authorized security testing only. SmokedMeat exists because CI/CD pipeline threats are deeply underestimated...

Web-Cache-Vulnerability-Scanner

Web Cache Vulnerability Scanner WCVS is a fast and versatile CLI scanner for web cache poisoning and web cache deception developed by Hackmanit and Maximilian Hildebrand. The scanner supports many different web cache poisoning and web cache deception techniques, includes a crawler to identify...

cicd-goat

Deliberately vulnerable CI/CD environment. Hack CI/CD pipelines, capture the flags. 🚩 Created by Cider Security Acquired by Palo Alto Networks. Table of Contents Description Download & Run Linux & Mac Windows Powershell Usage Instructions Take the challenge Troubleshooting Solutions Contributing...

Aurea

Aurea Specification Golden Standards for IaC Security HTML Mirror: https://roxanneardary.com/aurea-specification/ Specification Overview Aurea is a fully open-source, AI-powered Infrastructure-as-Code security specification designed to provide continuous security analysis throughout the software...

strix

Strix The open-source AI pentesting tool. Autonomous AI hackers that find and fix your app’s vulnerabilities. !TIP New! Strix integrates seamlessly with GitHub Actions and CI/CD pipelines. Automatically scan for vulnerabilit...

ci-supplychain-guard

CI Supply Chain Guard A static analysis tool for detecting malicious dependencies in CI/CD pipelines before they're merged into your codebase. Author: Otsmane Ahmed Status: Research Prototype v1.0 Quick Start 1. Clone and install git clone https://github.com/Otsmane-Ahmed/ci-supplychain-guard.git...

CVE-2026-4523 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an unauthenticated user to read CI/CD job trace contents containing sensitive variable values due to improper...

Mobile-Security-Framework-MobSF

Mobile Security Framework MobSF Mobile Security Framework MobSF is a security research platform for mobile applications in Android, iOS and Windows Mobile. MobSF can be used for a variety of use cases such as mobile application security, penetration testing, malware analysis, and privacy analysis...

SecuSphere

SecuSphere Your Comprehensive DevSecOps Solution Welcome to SecuSphere, your one-stop solution for all DevSecOps needs. Our centralized platform is expertly designed to manage and optimize your vulnerability management, CI/CD pipeline integration, security assessments, and DevSecOps practices...

azure-sentinel-detection-engineering

Azure Sentinel Detection Engineering Detection engineering on a live Microsoft Sentinel and Defender XDR environment I operate. Nine custom analytics rules span three planes, each mapped to MITRE ATT&CK and proven end to end: a controlled action triggers the rule, the rule raises an incident, and...

muad-dib

Installation | Usage | Features | VS Code | CI/CD Version francaise Why MUAD'DIB? npm and PyPI supply-chain attacks are exploding. Shai-Hulud compromised 25K+ repos in 2025. Existing tools detect threats but don't help you respond. MUAD'DIB combines 22 parallel scanners 278 detection rules, a...