trivy-action

Trivy Action GitHub Action for Trivy !GitHub Releaserelease-imgrelease !GitHub Marketplacemarketplace-imgmarketplace !Licenselicense-imglicense Table of Contents Usage Scan CI Pipeline Scan CI Pipeline w/ Trivy Config Cache Trivy Setup Scanning a Tarball Using Trivy with templates Using Trivy wit...

Elkeid

Elkeid - Bytedance Cloud Workload Protection Platform English | 简体中文 Elkeid is an open source solution that can meet the security requirements of various workloads such as hosts, containers and K8s, and serverless. It is derived from ByteDance's internal best practices. With the business...

bpflock

bpflock - Lock Linux machines bpflock - eBPF driven security for locking and auditing Linux machines. Note: bpflock is currently in experimental stage , it may break, options and security semantics may change, some BPF programs will be updated to use Cilium ebpf library. Sections 1. Introduction...

cosign

cosign Signing OCI containers and other artifacts using Sigstore! Cosign aims to make signatures invisible infrastructure. Cosign supports: "Keyless signing" with the Sigstore public good Fulcio certificate authority and Rekor transparency log default Hardware and KMS signing Signing with a cosig...

csf

ArmourBird CSF - Container Security Framework Note: The CSF Client is under active development and is getting converted into GoLang for better performace and architecture Table of Contents 1. About 2. Architecture Diagram 3. APIs-CSF Server 4. Installation/Usage 5. Building Docker Images 6. Sneak...

trivy

Trivy GitLab CI Component A GitLab CI component for Trivy — the all-in-one security scanner covering container images, filesystems, repositories, Kubernetes clusters, SBOMs, and license compliance. Plug these templates directly into your pipelines to get repeatable scans, GitLab-native reports, a...

veinmind-tools

veinmind-tools Documentation veinmind-tools is self-developed by chaitin technology ， cloudwalker team incubation，a container security toolset based on veinmind-sdk 🔥 Demo Veinmind has been connected to openai. You can use openai to conduct a user-friendly analysis of the scan results, allowing y...

pisc

Public OCI-Image Security Checker What is it? PISC Public OCI-Image or docker-image Security Checker is command-line tool to assess the security of OCI container images. Exits with code 1 if any of the following conditions are met: malware 🍄 exploits 🐙, hack-tools 👾, backdoors 🐴, crypto-miners 💰,...

hardening-k8s-containers

Intentionally Vulnerable Note Taking Application This repository contains a very simple and vulnerable application used to demonstrate the differences between deploying this application with the default settings to a Kubernetes cluster, versus adding some extra security settings that WILL NOT fix...

FRAGNESIA-Charan-cve-2026-46300

Charantej Architecture: Hardened Container Staging & Syscall Telemetry Lab An enterprise-grade, defense-in-depth container containment and runtime security telemetry framework. Designed from the perspective of a Cisco Lead Cybersecurity Architect, the Charantej Architecture isolates staging...

CVE-2025-23266

CVE-2025-23266 CVE-2025-23266 – Fully Weaponized NVIDIA Container Toolkit Exploit References https://github.com/ctrsploit/ctrsploit/tree/public/vul/cve-2025-23266...

kube-trivy

A Simple and Comprehensive Vulnerability Scanner for Kubernetes Abstract KubeTrivy is a extends trivy for kubernetes. KubeTrivy is a simple and comprehensive vulnerability scanner for Kubernetes. KubeTrivy detects vulnerabilities of OS packages Alpine, RHEL, CentOS, etc. and application...

KubeArmor

KubeArmor es un sistema de aplicación de seguridad en tiempo de ejecución nativo de la nube que restringe el comportamiento como la ejecución de procesos, el acceso a archivos y las operaciones de red de pods, contenedores y nodos VM...

lockc

lockc es un software de código abierto para proporcionar auditoría de seguridad de tipo MAC Control de Acceso Obligatorio para cargas de trabajo en contenedores. La razón principal por la que lockc existe es que los contenedores no contienen. Los contenedores no son tan seguros ni aislados como l...

cnitch

cnitch cnitch snitch o container snitch es un framework simple y una herramienta de línea de comandos para monitorear contenedores Docker con el fin de identificar cualquier proceso que se esté ejecutando como root. ¿Por qué es malo esto? Si aún no has visitado ¿Puedo tener contenedores no...

docker-bench-security

Docker Bench for Security Docker Bench for Security es un script que verifica docenas de buenas prácticas comunes en torno al despliegue de contenedores Docker en producción. Todas las pruebas están automatizadas y se basan en el CIS Docker Benchmark v1.6.0. Lo ponemos a disposición como una...

csf

ArmourBird CSF - Marco de Seguridad para Contenedores Nota: El Cliente CSF está en desarrollo activo y se está convirtiendo a GoLang para un mejor rendimiento y arquitectura Tabla de Contenidos 1. Acerca de 2. Diagrama de Arquitectura 3. APIs del Servidor CSF 4. Instalación/Uso 5. Construcción de...

docf-sec-check

DocF-Sec-Check Description DocF-Sec-Check helps to make your Dockerfile commands more secure. ScreenShot Done First-level security notification in the Dockerfile TODO List Correctly detect the Dockerfile. Second-level security notification in the Dockerfile. Security notification in Docker images...

Threat_Model_Examples

Threat Model Examples This repository contains various threat model examples for different technologies and systems. These resources provide illustrative examples of threat models across different domains, helping security professionals, developers, and researchers better understand how threat...

Azure

Azure Offensive Security Toolkit A collection of Bash and PowerShell scripts for Azure security assessments, covering IAM privilege escalation, container security, Key Vault exposure, Entra ID configuration, and more. Designed to run in Azure Cloud Shell or any authenticated terminal. Scripts IAM...