Ecosyste.ms: Repos

An open API service providing repository metadata for many open source software ecosystems.

GitHub topics: sast

Repositories

0dayInc/pwn

PWN is an open security automation framework that aims to stand on the shoulders of security giants, promoting trust and innovation.

Language: Ruby - Size: 8.2 MB - Last synced: 15 minutes ago - Pushed: about 8 hours ago - Stars: 30 - Forks: 1

ericcornelissen/js-regex-security-scanner

A static analyzer to scan JavaScript code for problematic regular expressions.

Language: JavaScript - Size: 1.14 MB - Last synced: about 9 hours ago - Pushed: about 14 hours ago - Stars: 5 - Forks: 1

alipay/ant-application-security-testing-benchmark

xAST评价体系，让安全工具不再“黑盒”. The xAST evaluation benchmark makes security tools no longer a "black box".

Language: Java - Size: 8.71 MB - Last synced: about 17 hours ago - Pushed: about 17 hours ago - Stars: 235 - Forks: 27

cycodehq/cycode-cli

Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning

Language: Python - Size: 1.14 MB - Last synced: 28 days ago - Pushed: 29 days ago - Stars: 83 - Forks: 41

Correia-jpv/fucking-static-analysis

⚙️ A curated list of static analysis (SAST) tools for all programming languages, config files, build tools, and more. With repository stars⭐ and forks🍴

Language: Rust - Size: 40.1 MB - Last synced: 1 day ago - Pushed: 1 day ago - Stars: 8 - Forks: 0

redhat-plumbers-in-action/differential-shellcheck

🐚 GitHub Action for running ShellCheck differentially

Language: Shell - Size: 1.78 MB - Last synced: 2 days ago - Pushed: 2 days ago - Stars: 46 - Forks: 9

NodeSecure/scanner

⚡️ A package API to run a static analysis of your module's dependencies. This is the CLI engine!

Language: TypeScript - Size: 840 KB - Last synced: 2 days ago - Pushed: 2 days ago - Stars: 27 - Forks: 14

semgrep/semgrep

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

Language: OCaml - Size: 74.9 MB - Last synced: 28 days ago - Pushed: 29 days ago - Stars: 9,668 - Forks: 556

georgealton/iam-sarif-report

Validate your IAM Policies and SCPs with AWS Policy Validator, and convert those results into SARIF documents for reporting.

Language: Python - Size: 882 KB - Last synced: 3 days ago - Pushed: 3 days ago - Stars: 6 - Forks: 1

FiniteStateInc/finite-state-sdk-python

Python SDK for the Finite State Platform API

Language: Python - Size: 1000 KB - Last synced: 3 days ago - Pushed: 3 days ago - Stars: 3 - Forks: 0

ZupIT/horusec

Horusec is an open source tool that improves identification of vulnerabilities in your project with just one command.

Language: Go - Size: 74 MB - Last synced: 4 days ago - Pushed: 4 days ago - Stars: 1,072 - Forks: 172

Checkmarx/sast-to-ast-export

CLI tool to export data from CxSAST and import into Checkmarx Application Security Testing Platform

Language: Go - Size: 29.2 MB - Last synced: 4 days ago - Pushed: 5 days ago - Stars: 2 - Forks: 6

Static Application Security Testing (SAST) engine focused on covering the OWASP Top 10, to make source code analysis to find vulnerabilities right in the source code, focused on a agile and easy to implement software inside your DevOps pipeline. Support the following technologies: Java (Maven and Android), Kotlin (Android), Swift (iOS), .NET Full Framework, C#, and Javascript (Node.js).

Language: Go - Size: 4.39 MB - Last synced: 5 days ago - Pushed: about 2 years ago - Stars: 487 - Forks: 80

NodeSecure/js-x-ray

JavaScript & Node.js open-source SAST scanner. A static analyser for detecting most common malicious patterns 🔬.

Language: JavaScript - Size: 1.06 MB - Last synced: 5 days ago - Pushed: 5 days ago - Stars: 197 - Forks: 24

M3Corp-Community/Veracode

Exemplos de código e tutoriais para implementações Veracode

Language: PowerShell - Size: 5.63 MB - Last synced: 5 days ago - Pushed: 5 days ago - Stars: 2 - Forks: 5

VulnPlanet/l3x

AI-driven Static Analyzer. Supports Rust and Smart contracts: Solana based on Rust, Ethereum based on Solidity.

Language: Rust - Size: 6.89 MB - Last synced: 4 days ago - Pushed: 6 days ago - Stars: 37 - Forks: 5

Bearer/bearer

Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.

Language: Go - Size: 22.7 MB - Last synced: 6 days ago - Pushed: 6 days ago - Stars: 1,749 - Forks: 81

gmatuz/sast-efficacy

Real world test cases to evaluate static analyser efficacy

Language: Python - Size: 1.9 MB - Last synced: 7 days ago - Pushed: 7 days ago - Stars: 1 - Forks: 0

ajinabraham/nodejsscan

nodejsscan is a static security code scanner for Node.js applications.

Language: CSS - Size: 5.28 MB - Last synced: 6 days ago - Pushed: 6 days ago - Stars: 2,326 - Forks: 323

htrgouvea/zarn

A lightweight static security analysis tool for modern Perl Apps

Language: Perl - Size: 149 KB - Last synced: 10 days ago - Pushed: 25 days ago - Stars: 37 - Forks: 9

we45/ThreatPlaybook

A unified DevSecOps Framework that allows you to go from iterative, collaborative Threat Modeling to Application Security Test Orchestration

Language: Python - Size: 2.91 MB - Last synced: 3 days ago - Pushed: 4 days ago - Stars: 267 - Forks: 56

fadhilthomas/go-code-scanning-reporter

run detail report of security code scanning to notion and slack

Language: Go - Size: 91.8 KB - Last synced: 6 days ago - Pushed: 6 days ago - Stars: 1 - Forks: 1

AppThreat/joern-lib 📦

Python library for code analysis with CPG and Joern

Language: Jupyter Notebook - Size: 4.39 MB - Last synced: 12 days ago - Pushed: 11 months ago - Stars: 8 - Forks: 0

NeuraLegion/issue-linker

A CLI tool to link between SAST issues and BrightSec issues

Language: Crystal - Size: 54.7 KB - Last synced: 14 days ago - Pushed: 4 months ago - Stars: 0 - Forks: 0

mercedes-benz/sechub

SecHub provides a central API to test software with different security tools.

Language: Java - Size: 30.7 MB - Last synced: 17 days ago - Pushed: 17 days ago - Stars: 242 - Forks: 55

0GiS0/scan-docker-vulnerabilities

Language: Shell - Size: 782 KB - Last synced: 16 days ago - Pushed: 16 days ago - Stars: 1 - Forks: 0

GuillaumeFalourd/stackspot-ai-security-action-poc

StackSpot AI Security Action POC

Language: Python - Size: 49.8 KB - Last synced: 17 days ago - Pushed: 18 days ago - Stars: 1 - Forks: 1

hounddogai/hounddog-webgoats

Sample codebases with deliberate security vulnerabilities for testing HoundDog.ai scanner.

Language: Java - Size: 3.1 MB - Last synced: 18 days ago - Pushed: 18 days ago - Stars: 0 - Forks: 0

ajinabraham/njsscan

njsscan is a semantic aware SAST tool that can find insecure code patterns in your Node.js applications.

Language: JavaScript - Size: 396 KB - Last synced: 10 days ago - Pushed: about 1 month ago - Stars: 344 - Forks: 75

ajinabraham/libsast

Generic SAST Library

Language: Python - Size: 286 KB - Last synced: 10 days ago - Pushed: 7 months ago - Stars: 118 - Forks: 17

xJonah/REPELSEC

CLI Security Tool for SAST & SCA

Language: Python - Size: 428 KB - Last synced: 20 days ago - Pushed: 20 days ago - Stars: 0 - Forks: 0

XargsUK/checkov-prismaless-vscode Fork of bridgecrewio/checkov-vscode

Prevent cloud misconfigurations during build-time for Terraform, Cloudformation, Kubernetes, Serverless framework, and other infrastructure-as-code-languages with Checkov in VS Code.

Language: TypeScript - Size: 3.66 MB - Last synced: 6 days ago - Pushed: 6 days ago - Stars: 4 - Forks: 1

Orange-Cyberdefense/grepmarx

A source code static analysis platform for AppSec enthusiasts.

Language: Python - Size: 166 MB - Last synced: 22 days ago - Pushed: 25 days ago - Stars: 182 - Forks: 23

DmitryGaravsky/ILSATools

Simple static analysis(SA) tool to analyze .Net assemblies at the IL-code level.

Language: C# - Size: 1.48 MB - Last synced: 14 days ago - Pushed: 7 months ago - Stars: 9 - Forks: 0

pcfens/sast-parser

Parse GitLab SAST reports into more human readable projects

Language: Python - Size: 50.8 KB - Last synced: 24 days ago - Pushed: 2 months ago - Stars: 53 - Forks: 18

analysis-tools-dev/website-next

Next version of the analysis tools website

Language: TypeScript - Size: 27.8 MB - Last synced: about 20 hours ago - Pushed: 25 days ago - Stars: 2 - Forks: 1

openscanhub/openscanhub

OpenScanHub is a service for static and dynamic analysis.

Language: Python - Size: 6.13 MB - Last synced: about 1 month ago - Pushed: about 1 month ago - Stars: 13 - Forks: 11

analysis-tools-dev/static-analysis

⚙️ A curated list of static analysis (SAST) tools and linters for all programming languages, config files, build tools, and more. The focus is on tools which improve code quality.

Language: Rust - Size: 40.2 MB - Last synced: 28 days ago - Pushed: 28 days ago - Stars: 12,801 - Forks: 1,324

mpast/mobileAudit

Django application that performs SAST and Malware Analysis for Android APKs

Language: HTML - Size: 5.31 MB - Last synced: 2 months ago - Pushed: 2 months ago - Stars: 189 - Forks: 43

securesauce/precli

Precaution CLI

Language: Python - Size: 1.22 MB - Last synced: about 1 month ago - Pushed: about 1 month ago - Stars: 1 - Forks: 2

tenable/terrascan

Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.

Language: Go - Size: 15.4 MB - Last synced: about 2 months ago - Pushed: 2 months ago - Stars: 4,414 - Forks: 488

h4sh5/pypi-auto-scanner 📦

Automatically scan new pypi packages for potentially malicious code

Language: Python - Size: 578 MB - Last synced: 23 days ago - Pushed: about 2 months ago - Stars: 24 - Forks: 7

xfhg/intercept

INTERCEPT / Policy as Code Auditing / SAST for Code & APIs

Language: Go - Size: 44 MB - Last synced: 29 days ago - Pushed: about 1 month ago - Stars: 77 - Forks: 10

marcinguy/betterscan-ce

Code Scanning/SAST/Static Analysis/Linting using many tools/Scanners + OpenAI GPT with One Report (Code, IaC) - Betterscan Community Edition (CE)

Language: Python - Size: 11.9 MB - Last synced: 27 days ago - Pushed: about 1 month ago - Stars: 678 - Forks: 84

ASTTeam/SAST

《深入理解SAST静态应用安全测试》Static Application Security Testing.

Size: 242 MB - Last synced: 28 days ago - Pushed: 29 days ago - Stars: 264 - Forks: 26

POSIdev-community/IAMeter_PHP

Language: PHP - Size: 11.7 KB - Last synced: 24 days ago - Pushed: about 1 year ago - Stars: 7 - Forks: 1

latiotech/LAST

Use AI to Scan Your Code from the Command Line for security and code smells. Bring your own keys. Supports OpenAI and Gemini

Language: Python - Size: 39 MB - Last synced: 25 days ago - Pushed: about 2 months ago - Stars: 130 - Forks: 12

semgrep/semgrep-action 📦

This project is deprecated. Use https://github.com/returntocorp/semgrep instead

Language: Python - Size: 1.24 MB - Last synced: 28 days ago - Pushed: about 1 month ago - Stars: 72 - Forks: 33

AppThreat/sast-scan-action 📦

GitHub action for performing SAST scanning using various oss tools such as gitleaks, bandit, findsecbugs etc

Size: 4.88 KB - Last synced: 14 days ago - Pushed: over 4 years ago - Stars: 10 - Forks: 1

CodeThreat/codethreat-jenkins-plugin

CodeThreat with Jenkins, allowing you to identify and rectify security issues effectively. The repository also provides a sample Jenkins Pipeline script for your guidance. To use this tool, you need a CodeThreat account.

Language: Java - Size: 130 KB - Last synced: about 1 month ago - Pushed: about 1 month ago - Stars: 2 - Forks: 4

grolston/guard-action

GItHub Action for cfn-guard and aws-guard-rules-registry

Language: Shell - Size: 36.1 KB - Last synced: 8 days ago - Pushed: about 1 month ago - Stars: 5 - Forks: 1

ShiftLeftSecurity/sast-scan

Scan is a free & Open Source DevSecOps tool for performing static analysis based security testing of your applications and its dependencies. CI and Git friendly.

Language: Python - Size: 5.25 MB - Last synced: about 1 month ago - Pushed: 8 months ago - Stars: 769 - Forks: 114

nxenon/DevSecOps

♾️ Collection of DevSecOps Notes + Resources + Courses + Tools

Size: 110 KB - Last synced: 22 days ago - Pushed: 3 months ago - Stars: 16 - Forks: 1

0xfederama/risk-2024

ICT Risk Assessment Course

Language: Python - Size: 35.1 MB - Last synced: about 1 month ago - Pushed: about 1 month ago - Stars: 0 - Forks: 0

Feysh-Group/corax-community

Corax for Java: A general static analysis framework for java code checking.

Language: Kotlin - Size: 38 MB - Last synced: about 1 month ago - Pushed: about 1 month ago - Stars: 194 - Forks: 16

JoostVoskuil/azure-devops-gitleaks

This is an extension for Azure DevOps that is a wrapper arround gitleaks created by Zachary Rice for easy execution inside your pipeline. Gitleaks is a SAST tool for detecting hardcoded secrets like passwords, api keys, and tokens in git repos. Gitleaks is an easy-to-use, all-in-one solution for finding secrets, past or present, in your code.

Language: TypeScript - Size: 306 KB - Last synced: about 1 month ago - Pushed: about 1 month ago - Stars: 23 - Forks: 15

Zigrin-Security/CakeFuzzer

Cake Fuzzer is a project that is meant to help automatically and continuously discover vulnerabilities in web applications created based on specific frameworks with very limited false positives.

Language: Python - Size: 273 KB - Last synced: about 1 month ago - Pushed: 5 months ago - Stars: 86 - Forks: 9

par-tec/d3fend-tools

Express IaC resources as d3fend graphs.

Language: Python - Size: 12.1 MB - Last synced: about 2 months ago - Pushed: 2 months ago - Stars: 4 - Forks: 0

DariuszPorowski/github-action-gitleaks

This GitHub Action allows you to run Gitleaks in your GitHub workflow.

Language: Shell - Size: 94.7 KB - Last synced: 7 days ago - Pushed: 3 months ago - Stars: 19 - Forks: 9

NJUPT-SAST/approval-system

🖥️ 南京邮电大学审批系统前端

Language: TypeScript - Size: 3.12 MB - Last synced: 18 days ago - Pushed: about 1 month ago - Stars: 2 - Forks: 1

ASTTeam/CodeQL

《深入理解CodeQL》Finding vulnerabilities with CodeQL.

Size: 17.1 MB - Last synced: about 2 months ago - Pushed: 6 months ago - Stars: 1,284 - Forks: 145

Contrast-Security-OSS/contrastscan-action

Contrast Scan GitHub action

Size: 136 KB - Last synced: 11 days ago - Pushed: 3 months ago - Stars: 19 - Forks: 4

italia/api-oas-checker

An OpenAPI 3 checker based on spectral.

Language: JavaScript - Size: 18.7 MB - Last synced: 28 days ago - Pushed: 7 months ago - Stars: 57 - Forks: 22

securesauce/precli-action

GitHub Action to run Precaution SAST

Size: 8.79 KB - Last synced: 2 months ago - Pushed: 2 months ago - Stars: 0 - Forks: 1

ajinabraham/njsscan-action

nodejsscan Github Action

Language: Dockerfile - Size: 38.1 KB - Last synced: 10 days ago - Pushed: 12 months ago - Stars: 23 - Forks: 3

jeremycook123/devsecops-jenkins

DevSecOps Jenkins Setup

Size: 0 Bytes - Last synced: 21 days ago - Pushed: 2 months ago - Stars: 0 - Forks: 0

Myskiv-Ivan/devsecops-pipeline

Pipeline SAST, DAST, SCA in GitLab CI\CD and push reports to VM

Size: 19.5 KB - Last synced: 2 months ago - Pushed: 2 months ago - Stars: 1 - Forks: 0

j3ssie/sample-semgrep-ci

Github Action Example with Semgrep SAST

Language: Go - Size: 242 KB - Last synced: about 1 month ago - Pushed: 5 months ago - Stars: 1 - Forks: 1

rohitanand7890/CodeQL-Test

CodeQL Test

Language: Java - Size: 64.5 KB - Last synced: 2 months ago - Pushed: about 2 years ago - Stars: 0 - Forks: 0

R3DRUN3/stream

Reference implementation of CI pipeline steps via Dagger modules 🏗️

Language: Go - Size: 54.7 KB - Last synced: 2 months ago - Pushed: 2 months ago - Stars: 0 - Forks: 0

Hexens/piller

Static analysis framework for Polynomial Identity Language (PIL) used in zkEVM for defining state machines

Language: JavaScript - Size: 76.2 KB - Last synced: about 1 month ago - Pushed: about 1 year ago - Stars: 10 - Forks: 0

j3ssie/codeql-docker

Ready to use docker image for CodeQL

Language: Python - Size: 20.5 KB - Last synced: 2 months ago - Pushed: 4 months ago - Stars: 84 - Forks: 11

binarybird/Cascade

Cascade - Dataflow graphing and analysis for C#

Language: C# - Size: 155 KB - Last synced: about 2 months ago - Pushed: almost 5 years ago - Stars: 5 - Forks: 0

syn-4ck/fafnir-sec

fafnir-sec is an open-source tool that allows for the complete automation of launching different security tools detecting vulnerabilities in the application's code.

Language: Python - Size: 14.3 MB - Last synced: 3 months ago - Pushed: 3 months ago - Stars: 2 - Forks: 0

injcristianrojas/swsec-intro-spring-boot

Same vulnerable app as swsec-intro, but in a more modern framework.

Language: Java - Size: 224 KB - Last synced: 3 months ago - Pushed: 3 months ago - Stars: 0 - Forks: 1

IBM/sonarqube

Static Application Security Testing (SAST) using Sonarqube workshop

Language: Shell - Size: 4.32 MB - Last synced: about 1 month ago - Pushed: over 3 years ago - Stars: 4 - Forks: 5

BytecodeDL/ByteCodeDL

A declarative static analysis tool for jvm bytecode based Datalog like CodeQL

Language: Shell - Size: 840 KB - Last synced: 3 months ago - Pushed: 4 months ago - Stars: 295 - Forks: 19

oxsecurity/codetotal

Analyze any snippet, file, or repository to detect possible security flaws such as secret in code, open source vulnerability, code security, vulnerability, insecure infrastructure as code, and potential legal issues with open source licenses.

Language: TypeScript - Size: 42.9 MB - Last synced: 3 months ago - Pushed: 9 months ago - Stars: 66 - Forks: 8

CodeThreat/codethreat-github-action

CodeThreat GitHub Action integrates with GitHub to perform code security tests on your code. It supports a variety of languages and frameworks, providing detailed security scans to identify potential issues.

Language: JavaScript - Size: 1.9 MB - Last synced: 8 days ago - Pushed: about 1 month ago - Stars: 4 - Forks: 0

austimkelly/swiss-cheese

A demo repository of simple OWASP Top 10 type of vulnerabilities in (mostly) Python. Includes an exploration of GHAS features.

Language: Python - Size: 611 KB - Last synced: 3 months ago - Pushed: 3 months ago - Stars: 2 - Forks: 23

checkmarx-ts/checkmarx-github-action

Checkmarx Scan Github Action

Language: JavaScript - Size: 13.2 MB - Last synced: 24 days ago - Pushed: 7 months ago - Stars: 25 - Forks: 18

AppThreat/sast-scan 📦

Fully open-source SAST scanner supporting a range of languages and frameworks. Integrates with major CI pipelines and IDE such as Azure DevOps, Google CloudBuild, VS Code and Visual Studio. No server required!

Language: Python - Size: 2.27 MB - Last synced: 14 days ago - Pushed: over 3 years ago - Stars: 143 - Forks: 21

FS93/RubyCrypt

Scanner for cryptographic gems & their reverse dependecies in Ruby applications

Language: Ruby - Size: 803 KB - Last synced: 3 months ago - Pushed: 3 months ago - Stars: 0 - Forks: 0

clj-holmes/clj-holmes

A CLI SAST (Static application security testing) tool which was built with the intent of finding vulnerable Clojure code via rules that use a simple pattern language.

Language: Clojure - Size: 155 KB - Last synced: 10 days ago - Pushed: 10 months ago - Stars: 102 - Forks: 11

momosecurity/momo-code-sec-inspector-java

IDEA静态代码安全审计及漏洞一键修复插件

Language: Java - Size: 11.6 MB - Last synced: 3 months ago - Pushed: about 2 years ago - Stars: 914 - Forks: 147

piypil/LUN903

Совместное использование инструментов SAST, DAST и SCA для повышения эффективности обнаружения и устранения уязвимостей программных модулей ─=≡Σ((( つ＞＜)つ📊📊📊

Language: TypeScript - Size: 23.4 MB - Last synced: 24 days ago - Pushed: 3 months ago - Stars: 1 - Forks: 0

jmessiass/devsecops

Exemplo de workflow de segurança que realiza testes SAST, SCA, DAST, Secrets Scan e IaC Scan via GitHub Actions utilizando ferramentas open source.

Language: Python - Size: 359 KB - Last synced: 3 months ago - Pushed: 3 months ago - Stars: 0 - Forks: 0

xlab-steampunk/spotter-action

GitHub Action for Steampunk Spotter

Language: Shell - Size: 43 KB - Last synced: 25 days ago - Pushed: about 2 months ago - Stars: 4 - Forks: 1

oversecured/oversecured-bitrise-step

Oversecured Step for Bitrise

Language: Go - Size: 16.6 KB - Last synced: 4 months ago - Pushed: 4 months ago - Stars: 4 - Forks: 3

VulnPlanet/.github

Size: 27.3 KB - Last synced: 3 months ago - Pushed: 3 months ago - Stars: 0 - Forks: 0

arall/vulnerabilities

Examples of different vulnerabilities, in a variety of languages, shapes and sizes.

Language: HTML - Size: 5.13 MB - Last synced: 2 months ago - Pushed: 2 months ago - Stars: 24 - Forks: 11

Pyronewbic/DevSecOps-Root-CI-CD

Special snowflakes are a main in the posterior - there's times when infra-related changes don't get merged back to earlier branches, causing.. well, different IAC Configurations. Standardize them With helm and conditions - and if you're looking for a way to have Image Promotion figured out (Even for NextsJS - the workaround is a pain because of how it ) - this is all you'll need [Since configmaps wont's work, and https://nextjs.org/docs/basic-features/environment-variables#environment-variable-load-order is.. well, could've been better]

Size: 149 KB - Last synced: 4 months ago - Pushed: over 1 year ago - Stars: 0 - Forks: 0