CLI client (and Golang module) for deps.dev API. Free access to dependencies, licenses, advisories, and other critical health and security signals for open source package versions.

Agentic AI for DevSecOps: Transforming Security with GitHub Advanced Security and GitHub Copilot. GitHub Advanced Security - DevSecOps Guidelines - Unified visibility into DevOps security posture. DevSecOps E2E Demos.

Github Action for security scanning utilizing Salus by Coinbase

This repo contains the technology stack and its usage for software supply chain security of a Java application

How to secure your development pipeline with static application security test (SAST) / Dynamic application security test (DAST), software composition analysis (SCA) using Sonarqube.

Sheriff is a tool to scan repositories and generate security reports.

🛡 Scan GitHub repositories for dependency vulnerabilities using OSV database. Supports npm, PyPI, RubyGems, Go, and PHP.

Static code analysis of software licenses

Open-source local dependency and vulnerability scanner for Maven and Gradle Java projects.

CLI Vulnify - Faz o scan em seus projetos buscando por vulnerabilidades.

CSI Red Alert - Scan your Repository and Docker Images on a daily basis. Create & Close the issues in your Gitlab Instance automatically. Notify on Slack with a summary on all new vulnerabilities.

🏥🛡️ Automated NuGet vulnerability scanner & updater for .NET. Smart dependency patching with compatibility testing. Keep your packages safe & current. 🔒

AI-powered codebase audit tool that scans for dependency vulnerabilities, deprecated API usage & generates comprehensive security reports. Uses MCP connectors for intelligent analysis with automated audit workflows.

SecureFlow-CI-CD demonstrates a CI/CD pipeline using GitHub Actions to perform security checks and analyses on a Python project.

FastHTML app to audit GitHub users/orgs for vulnerable dependencies using OSV data.

A clean, local-first CLI for 100% passive security auditing of JS/TS repos and URLs—secrets, dependency vulns, SAST, TLS/headers/cookies/CORS—built for streamable scan → merge → report workflows.

Automated security auditing CLI for AI agent code — quarantine-first workflow for repos, packages, and agent tooling

Detect slopsquatting attacks — AI-hallucinated packages in your dependencies. Rust CLI + GitHub Action.

No description provided.

VulnScanner is a local-first, open-source vulnerability intelligence toolkit that syncs NVD, KEV, and EPSS data, scans npm and Python lockfiles, and enforces CI policy gates with offline cache mode, baseline diffing, and JSON/CSV/Markdown/SARIF reports.

Scan for vulnerabilities and trace their usage in your source code

Create GitLab compatible dependency scanning report from npm audit

SentinelGuard is a full-featured vulnerability scanner for Python projects. It analyzes source code, dependencies, and secrets in a unified desktop interface.

A reusable GitLab CI/CD template for automated security scanning, including secrets detection (Gitleaks, Trufflehog), dependency vulnerabilities (Trivy), SAST (Semgrep, SonarQube), DAST (OWASP ZAP), and a consolidated security dashboard. Include this in your gitlab-ci.yml for DevSecOps.

🤖 Globomantics Robot Fleet Manager - Educational demo with vulnerable dependencies for GitHub Advanced Security training. Tim Warner's Pluralsight Dependency Review course. Learn more: https://pluralsight.com

One POST, instant CVE impact for your SBOM. Give us a lightweight component list (npm / PyPI today), and get back the exact vulnerabilities and the minimal fixed versions you need to patch. Built for CI pipelines, PR checks, and SRE/AppSec dashboards.

GitHub Action for FOSSA license scanning with detailed PR comments and policy violation reporting. Automates license compliance checks with intelligent violation analysis and actionable feedback.

🔍 Scan .NET applications for vulnerabilities in NuGet dependencies, ensuring secure and reliable software with this professional-grade security tool.

A fast, automated security auditing dashboard that aggregates daily scans from all your projects. PhantomScanner collects results from Semgrep, Bandit, Trivy, and Gitleaks, normalizes them into a unified schema, stores them in a SQLite/Postgres backend, and visualizes them through a simple, responsive dashboard. Designed to scan many repos for free