Stars
Automated Exploit Generation for Node.js Packages
Browser automation and computer use for AI agents. One CLI and MCP server for your signed-in browser, native macOS apps, and real iPhones.
High-performance open-source security scanner combining SAST, SCA, Secret Detection, and IaC analysis, built for developers and CI/CD pipelines, using AI for recommendation!
A CI/CD Red Team Framework for demonstrating Build Pipeline security risks.
Secure, fast, efficient, battle-tested at Alibaba's scale. Hybrid architecture code review tool: deterministic pipelines + LLM Agent, precise line-level comments, built-in multi-language ruleset (N…
Top disclosed reports from HackerOne
VIPER -- Vulnerability Instrumentation, Proof & Exploit Runner / Automated AI vulnerability research
Host-agnostic pre-write security hook for coding agent: detects user-input patterns via Semgrep and emits deterministic, no-LLM security guidance.
AI search engine and MCP server for bots and agents. One Rust binary indexes code, docs, logs, JSONL/CSV and PDFs for BM25 full-text, vector and hybrid search, code search without grep, agent memor…
AI Deep SAST - LLM-powered deep static analysis for CI/CD. Combines Semgrep, tree-sitter code indexing and frontier LLMs (e.g. GPT-4o, Claude) for fast and deep vulnerability scanning.
Automagically reverse-engineer REST APIs via capturing traffic
Extract URLs, paths, secrets, and other interesting bits from JavaScript
A tool for auditing endpoints defined in exposed (Swagger/OpenAPI) definition files.
A resources for who want to learn and get deep into client-side bugs
Audit your GitHub Actions workflow runs to see exactly which Actions were downloaded
tool designed for identifying vulnerabilities in open source codebases at scale. It can gather and filter on key repository metrics such as popularity and project size
Mapping from bug bounty and vulnerability disclosure programs to respective GitHub organizations
Static analysis for GitHub Actions (and more)
RESTler is the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services.
An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.
Integrates Semgrep static analysis with AI-powered recommendations to enhance code security and automate remediation.
Available for legacy purposes. New users please see Jalangi2 https://github.com/Samsung/jalangi2
Dynamic analysis framework for JavaScript