DevSecOps
147 items from taptuit/awesome-devsecops ★1,745
-
Trivy github.com
Aqua Security's open source simple and comprehensive vulnerability scanner for containers (suitable for CI).
-
bridgecrewio/checkov :fire::fire::fire::fire::fire: github.com
Static analysis for infrastructure as code manifests (Terraform, Kubernetes, Cloudformation, Helm, Dockerfile, Kustomize) find security misconfiguration and fix them.
-
-
sops github.com
An editor of encrypted files that supports YAML, JSON and BINARY formats and encrypts with AWS KMS and PGP.
-
Deepfence Threat Mapper github.com
Powerful runtime vulnerability scanner for kubernetes, virtual machines and serverless.
-
official OWASP ZAP github.com
OWASP - An open-source web application vulnerability scanner, including an API for CI/CD integration.
-
KICS github.com
An infrastructure-as-code scanning tool, find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle. Can be extended for additional policies.
-
-
Gitleaks github.com
A SAST tool for detecting hardcoded secrets like passwords, api keys, and tokens in git repos.
-
-
Hadolint github.com
A Dockerfile linter that checks for best practices, common mistakes, and is also able to lint any bash written in RUN instructions;.
-
Docker bench security github.com
The Docker Bench for Security is a script that checks for dozens of common best-practices around deploying Docker containers in production.
-
syft github.com
A CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems.
-
bandit github.com
Python Code Quality Authority - Find common security vulnerabilities in Python code.
-
gopass github.com
Gopass - Password manager for teams relying on Git and gpg. Manages secrets in encrypted files and repositories.
-
trufflehog github.com
💸 Searches through Git repositories for high entropy strings and secrets, digging deep into commit history.
-
Git Secrets github.com
Amazon AWS - Scan git repositories for secrets committed within code or commit messages.
-
Clair github.com
Clair is an open source project for the static analysis of vulnerabilities in appc and docker containers.
-
OWASP NodeGoat github.com
OWASP - A Node.js web application that demonstrates and provides ways to address common security vulnerabilities.
-
detect-secrets github.com
An enterprise friendly way of detecting and preventing secrets in code. It does this by running periodic diff outputs against heuristically crafted regex statements, to identify whether any new secret has been committed. This way, it avoids the overhead of digging through all…
-
DevSkim github.com
Regex-based static analysis tool for Visual Studio, VS Code, and Sublime Text - C/C++, C#, PHP, ASP, Python, Ruby, Java, and others.
-
Teller github.com
a secrets management tool for devops and developers - manage secrets across multiple vaults and keystores from a single place.
-
RESTler (⭐2.9k) github.com
A stateful REST API fuzzing tool that automatically discovers security and reliability bugs by intelligently inferring producer-consumer dependencies from OpenAPI specifications.
-
cicd-goat github.com
Cider Security - A deliberately vulnerable CI/CD environment. Learn CI/CD security through multiple challenges.
-
Golang Security Checker github.com
securego - CLI tool to scan Go code for potential security flaws.
-
-
Keyscope github.com
Keyscope is an extensible key and secret validation for checking active secrets against multiple SaaS vendors built in Rust
-
-
Tfsec github.com
Liam Galvin - Scan Terraform templates for security misconfiguration and noncompliance with AWS, Azure and GCP security best practice.
-
Kubernetes Goat github.com
Madhu Akula - Intentionally vulnerable cluster environment to learn and practice Kubernetes security.
- next page of items loading…
