Security

rfjakob/gocryptfs

A mature, audited FUSE encryption layer born from EncFS's flaws — gocryptfs is a Go-based encrypted overlay filesystem built on go-fuse, created to fix security issues found in EncFS while keeping good performance. It reached 1.0 in 2016, passed a 2017 third-party security audit, and supports signed releases, making it a solid choice for Linux users (with beta macOS support) needing per-file encrypted storage.

Encrypted overlay filesystem written in Go

hashicorp/boundary

Boundary Community Edition archived as HashiCorp shifts focus — HashiCorp has archived Boundary CE as of October 8, 2026, ending active development. The repo is read-only with no new releases, fixes, or security patches planned. Existing users should assess risks and consider migrating to HCP Boundary or Boundary Enterprise for ongoing support.

Boundary enables identity-based access management for dynamic infrastructure.

EthanArbuckle/fairplay-decrypt

Decrypt FairPlay-Protected IPAs Without a Live Device Connection — This tool decrypts FairPlay-encrypted App Store IPAs offline using a 16-byte account credential, deriving page keys itself from SINF/SUPF records rather than relying on a jailbroken device at decrypt time. It supports version-3/5 SUPF and both 440- and 448-byte SINF priv records, running on macOS and Linux, useful for researchers needing offline arm64 binary analysis.

Offline FairPlay App Store IPA decryption with independent key derivation

KillaBoi/StealMyBitcoin-PoC

A single-file Python PoC that replays a Bitcoin CTF exploit chain — This repo publishes a standard-library Python script reproducing the exact request sequence that solved the Steal My Bitcoin CTF, including PHP heap-leak and code-leak OOM stages against a Dockerized Alpine/PHP 8.4.26/nginx lab. It is useful for anyone studying real-world PHP memory-disclosure exploitation or reproducing CTF writeups end to end rather than reading theory.

A public release of the Steal My Bitcoin challenge

suzuki-shunsuke/ghtkn

Swap long-lived GitHub PATs for 8-hour app tokens — ghtkn is a CLI that issues short-lived (8-hour) GitHub App User Access Tokens via Device Flow instead of long-lived PATs or OAuth tokens. It needs no private key or client secret, stores tokens securely in the OS keyring, supports multiple GitHub Apps, and can auto-refresh tokens, reducing risk from local credential leaks.

A CLI to create short-lived (8 hours) GitHub App User Access Token for secure local development

linux-credentials/oo7

A Rust-native Secret Service stack covering daemon, CLI, and git/cargo credentials — oo7 is a Rust implementation of the freedesktop Secret Service spec, bundling a daemon, a secret-tool-like CLI, a client library, git/cargo credential helpers, a portal implementation, and KWallet migration tools. It's aimed at distros and desktop environments wanting to replace gnome-keyring-daemon with a lighter, memory-safe alternative.

James Bond went on a new mission as a Secret Service provider

antropos17/Aegis

Local, Windows-first security dashboard for watching AI agents — AEGIS is an Electron/Svelte desktop app that monitors AI coding agents like Claude Code on your own machine: process trees, file and network activity, token usage, and anomaly scoring against rolling session baselines. It adds opt-in action policies and MCP gateways plus experimental Hyper-V guest execution, aimed at developers who want local-first oversight of agentic tools rather than a cloud service.

Windows-first desktop oversight for AI agents: live monitoring, local security reviews, token usage, audit reports and opt-in action policies/MCP gateways. Experimental Hyper-V guest execution; macOS/Linux experimental.

usestrix/firewall

A local firewall that blocks malicious packages before they install — Strix's dependency firewall screens npm, PyPI, crates.io, Go, and RubyGems installs on-device against a continuously updated malicious-package blocklist, blocking bad packages system-wide before download. It supports machine-wide installs on macOS/Windows and command-prefix mode everywhere, including Linux, with no traffic routed through Strix servers.

Strix Supply Chain Firewall

Akhouri-Systems/ATLOCK

A local-only Windows security suite with no cloud, accounts, or telemetry — ATLOCK bundles system lockdown, file protection, and a password vault into one free Windows 10/11 app that runs entirely offline — no account, subscription, or telemetry. It's aimed at users who want basic security tooling without signing up for a service or sending data anywhere.

Free Windows security suite — System Lockdown, File Guard, Password Vault.

xiao1203/huckme-rails

A Deliberately Vulnerable Rails Shop to Benchmark AI Pentest Tools — HuckMe Shop is a fake e-commerce Rails app seeded with 13 intentional OWASP Top 10 flaws (SQLi, IDOR, mass assignment, stored XSS, SSRF, and more), built to test how well AI pentest agents like Strix and Cairn detect and exploit real-world-style bugs. It runs locally via Docker Compose, binds only to localhost, and ships a VULNERABILITIES.md checklist for scoring detection rates.