devsecops

KeygraphHQ/shannon

An AI agent that pentests code and only reports proven exploits — Shannon is an open-source agent that reads your source code, maps attack paths, and actually executes exploits against web apps and APIs rather than just flagging suspected issues—no exploit, no report. Run it locally via npx for CI/CD or pre-production security checks; useful for appsec and devsecops teams wanting automated, evidence-based pentesting.

Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.

aquasecurity/trivy

An all-in-one scanner for vulnerabilities, misconfigs, secrets and SBOMs — Trivy scans container images, filesystems, git repos, VM images and Kubernetes clusters for CVEs, IaC misconfigurations, exposed secrets, license issues and SBOM data in one tool. It plugs into GitHub Actions, a Kubernetes operator and a VS Code extension, making it useful for DevSecOps teams wanting a single scanner across their pipeline.

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

mukul975/Anthropic-Cybersecurity-Skills

818 cybersecurity skills to turn AI agents into security analysts — A community-built library of 818 structured cybersecurity skills across 34 domains, following the agentskills.io standard. Each skill is mapped to relevant frameworks (MITRE ATT&CK, NIST CSF 2.0, ATLAS, D3FEND, NIST AI RMF, F3) and works with Claude Code, Copilot, Cursor, and 20+ other AI platforms. Useful for red teamers, SOC analysts, and anyone wiring domain expertise into AI agents.

817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0

gitleaks/gitleaks

Gitleaks enters maintenance mode, focus shifts to Betterleaks — Gitleaks scans git repos, files, and stdin for secrets like passwords and API keys using regex-based detection. The maintainer has declared it feature-complete, limiting future releases to security patches while development moves to a new project called Betterleaks. Useful for DevSecOps teams running CI/CD secret scanning today.

Find secrets with Gitleaks 🔑

trufflesecurity/trufflehog

Secret scanning that checks whether leaked credentials actually work — TruffleHog discovers secrets across Git, chats, wikis, logs, and object stores, classifies over 800 credential types, and verifies live validity by attempting authentication. Useful for DevSecOps teams wanting to cut noise from false positives in secret scanning and precommit checks.

Find, verify, and analyze leaked credentials

MobSF/Mobile-Security-Framework-MobSF

All-in-one pen-testing framework for Android, iOS and Windows apps — MobSF combines static and dynamic analysis for APK, IPA and APPX binaries, plus runtime instrumentation and network traffic inspection. REST APIs and CLI tools let it plug into CI/CD pipelines, making it useful for security researchers, pentesters and DevSecOps teams who need repeatable mobile app assessments.

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

bytebase/bytebase

Database governance that now accounts for AI agents, not just humans — Bytebase is an open-source control plane for database change management, access control, and compliance, unifying migration scripts, SQL clients, and ticketing into one platform. It now explicitly governs access for AI agents alongside human users, with JIT access, dynamic data masking, and GitOps workflows across 10+ database engines.

Database governance built for humans and agents — controlling changes and access across every major database.

openai/codex-security

OpenAI brings agentic scanning to app security workflows — A new CLI and TypeScript SDK from OpenAI that uses Codex to find, validate, and patch vulnerabilities. It supports deep repo scans, SARIF/JSON/CSV export, GitHub code scanning import, and CI automation, aimed at devsecops teams wanting agent-driven security reviews.

OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm: https://www.npmjs.com/package/@openai/codex-security

hahwul/dalfox

🌙🦊 Dalfox is a powerful open-source XSS scanner and utility focused on automation.

tmatens/compose-lint

Security-focused linter for Docker Compose files. Catches dangerous misconfigurations before they reach production. Grounded in OWASP and CIS Docker Benchmark.