DevSecOps
147 items from taptuit/awesome-devsecops ★1,746
-
Phan github.com
Phan - Broad static analysis for PHP applications with some support for security scanning features.
-
Stelligent/cfn_nag :fire::fire::fire::fire: github.com
Stelligent - Scan AWS CloudFormation templates for insecure configuration.
-
Terrascan github.com
Accurics - Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.
-
regula github.com
Evaluates Terraform infrastructure-as-code for potential AWS, Azure, and Google Cloud security misconfigurations and compliance violations prior to deployment.
-
SpotBugs github.com
SpotBugs - Static code analysis for Java applications.
-
Ansible-Lint github.com
Ansible Community - Checks playbooks for practices and behaviour that could potentially be improved. As a community backed project ansible-lint supports only the last two major versions of Ansible.
-
Conftest github.com
Instrumenta - Create custom tests to scan any configuration file for security flaws.
-
Kube-Score github.com
Gustav Westling - Scan Kubernetes object definitions for security and performance misconfiguration.
-
Bad SSL github.com
The Chromium Project - A container running a number of webservers with poor SSL / TLS configuration. Useful for testing tooling.
-
Find Security Bugs github.com
OWASP - SpotBugs plugin for security audits of Java web applications. Supports Eclipse, IntelliJ, Android Studio and SonarQube.
-
Selefra github.com
An open-source policy-as-code software that provides analytics for multi-cloud and SaaS.
-
Vault vaultproject.io
An encrypted datastore secure enough to hold environment and application secrets.
-
SSL Labs Scan github.com
SSL Labs - Automated scanning for SSL / TLS configuration issues.
-
Graudit github.com
Eldar Marcussen - Grep source code for potential security flaws with custom or pre-configured regex signatures.
-
WrongSecrets github.com
OWASP - Vulnerable app with examples showing how to not use secrets
-
Terragoat github.com
Bridgecrew - Terraform templates for creating stacks of intentionally insecure services in AWS, Azure and GCP. Ideal for testing the Terraform Infrastructure as Code Analysis tools above.
-
Harden Runner GitHub Action github.com
StepSecurity - installs a security agent on the GitHub-hosted runner (Ubuntu VM) to prevent exfiltration of credentials, detect compromised dependencies and build tools, and detect tampering of source code during the build.
-
Pinterest Knox github.com
Pinterest - Securely store, rotate and audit secrets.
-
Dagda github.com
Elías Grande - Compares OS and software dependency versions installed in Docker containers with public vulnerability databases, and also performs virus scanning.
-
Gauntlt github.com
Gauntlt - A Behaviour Driven Development framework to run security scans using common security tools and test output, defined using Gherkin syntax.
-
Overlay github.com
A browser extension helping developers evaluate open source packages before picking them.
-
Security Code Scan github.com
Security Code Scan - Static code analysis for C# and VB.NET applications.
-
DawnScanner github.com
Paolo Perego - Security scanning for Ruby scripts and web application. Supports Ruby on Rails, Sinatra and Padrino frameworks.
-
PHPCS Security Audit github.com
Floe - PHP static analysis with rules for PHP, Drupal 7 and PHP related CVEs.
-
Preflight github.com
helps you verify scripts and executables to mitigate supply chain attacks in your CI and other systems.
-
FlawFinder github.com
David Wheeler - Scan C / C++ code for potential security weaknesses.
-
Kubectrl Kubesec github.com
ControlPlane - Plugin for kubesec.io to perform security risk analysis for Kubernetes resources.
-
Automatic API Attack Tool github.com
Imperva - Perform automated security scanning against an API based on an API specification.
-
Puma Scan github.com
Puma Security - A Visual Studio plugin to scan .NET projects for potential security flaws.
-
Chef Vault github.com
Chef - Securely store secrets within Chef.
-
Software Assurance Maturity Model github.com
OWASP - A framework to measure and improve the maturity of the secure development lifecycle.
-
Progpilot github.com
Design Security - Static analysis for PHP source code.
-
Hawkeye github.com
Hawkeyesec - Modularised CLI tool for project security, vulnerability and general risk highlighting.
-
SonarQube Server sonarqube.org
SonarQube empowers development teams with a code quality and security solution that deeply integrates into your enterprise environment; enabling you to deploy clean code consistently and reliably. SonarQube provides a free and open source Community Build.
-
LGTM lgtm.com
copyright: — Find security vulnerabilities, variants, and critical code quality issues using CodeQL queries over source code. Automatic PR code review; free for open source. Formerly semmle. It supports public Git repositories hosted on Bitbucket Cloud, GitHub.com, GitLab.com.
-
Cfngoat github.com
Bridgecrew - Cloud Formation templates for creating stacks of intentionally insecure services in AWS. Ideal for testing the Cloud Formation Infrastructure as Code Analysis tools above.
-
Application Security Education github.com
Duo Security - Training materials created by the Duo application security team, including introductory and advanced training presentations and hands-on labs.
-
Dependabot dependabot.com
GitHub - Automatically scan GitHub repositories for vulnerabilities and create pull requests to merge in patched dependencies.
-
Raindance Project github.com
DevSecOps - Use attack maps to identify attack surface and adversary strategies that may lead to compromise.
-
Secure Coding Guidelines wiki.mozilla.org
Mozilla - A guideline containing specific secure development standards for secure web application development.
-
GitGuardian gitguardian.com
GitGuardian - A web-based solution that scans and monitors public and private git repositories for secrets.
-
ESLint eslint.org
JS Foundation - Linting tool for JavaScript with multiple security linting rules available.
-
Cybrary cybrary.it
Cybrary - Subscription based online courses with dedicated categories for cybersecurity and DevSecOps.
-
Portswigger Web Security Academy portswigger.net
PortSwigger - A set of materials and labs to learn and exploit common web vulnerabilities.
-
repo-supervisor github.com
Auth0 - Secrets scanning tool that can run as a CLI, as a Docker container or in AWS Lambda.
-
OWASP Juice Shop github.com
OWASP - A web application containing the OWASP Top 10 security vulnerabilities and more.
-
PentesterLab pentesterlab.com
Variety of VM and online challenges (paid).
-
Damn Vulnerable Web Application dvwa.co.uk
PHP/MySQL web application that is damn vulnerable.
-
Security Checklist by OWASP owasp.org
A checklist by OWASP for testing web applications based on assurance level. Covers multiple topics like Architecture, IAM, Sanitization, Cryptography and Secure Configuration.
-
Shift Security Left shift-security-left.curated.co
Cossack Labs - A free biweekly newsletter for security-aware developers covering application security, secure architecture, DevSecOps, cryptography, incidents, etc. that can be useful for builders and (to a lesser extent) for breakers.
- next page of items loading…
