5,106 repositories starred since Aug 2015. Mostly AI and language models.

Validated GhostLock CVE-2026-43499 port for NVIDIA Shield TV Pro mdarcy 9.2.4

Agentic AI security scanner that hunts exploitable vulnerabilities like an adversary, proves them with executable PoCs, and fixes them test-first. A maintained fork of Capital One's VulnHunter, rebuilt for any agent harness.

Tools that lower the barrier to security research on Meta's products, for vetted Meta Bug Bounty researchers. Designed to live where researchers work and to be driven by agents.

A deliberately vulnerable Microsoft Entra ID environment. Learn identity security through hands-on, realistic attack challenges.

Deepsec is a security harness for finding vulnerabilities in your codebase powered by coding agents

A skill to help cybersecurity folks update and tweak their resume

Share your Immich photos and albums in a safe way without exposing your Immich instance to the public.

Mirall - Secure large file transfer. No cloud. No middleman

⚡️A native, local-first alternative to Logitech Options+, written in Rust 🦀 — remap buttons, DPI, and SmartShift over HID++. No account, no telemetry.

Free, self-hosted alternative to Burp Suite Pro — MITM proxy + full active scanner (SQLi/XSS/SSRF/XXE/SSTI/smuggling), recon→CVE, OAST, nuclei-style templates, and a CI security gate. Qt6/C++, MIT, no telemetry.

Automated penetration testing & attack surface management platform. Recon, scan, exploit, report - 600+ exploits, 90+ integrations, 10K+ detections.

A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings

Skills for threat modeling, scanning, triage, patching, plus an autonomous scanning harness you can /customize

Stats For Your Focusmate Account [On the Fly, On the UI] [Privacy Centered]

Real-time animated line chart for React.

Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening

Touch ID 🫆for your folders and apps

Trail of Bits skills for security research, vulnerability detection, and audit workflows

Wayback Machine mirror recovery toolkit (archive-friendly, provenance-first).

Open-source plugin for Rock Band 3 providing many enhancements, fixes, and extra features.

Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.

Go security checker

Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.

A web browser extension for Chrome, Firefox, Edge, and Safari 14.

A security auditor for Tailscale configurations. Scans your tailnet for misconfigurations, overly permissive access controls, and security best practice violations.

Ghidra is a software reverse engineering (SRE) framework

Modern networking and security platform providing secure access and connectivity to apps, infrastructure, and AI workloads. Connect and protect your users.

GitHub Action that detects the Shai-Hulud 2.0 (Nov 2025) and ChainDrop (Aug 2026) npm supply-chain attacks. Scans dependencies, lockfiles and CI workflows against a daily-updated database of 1,200+ compromised packages, flags malicious install scripts, TruffleHog secret theft and SHA1HULUD runners. SARIF output for GitHub Code Scanning.

Google's Security extension for the Gemini CLI that finds vulnerabilities in your code changes and pull requests.

evilwaf is a penetration testing tool designed to detect and bypass common Web Application Firewalls (WAFs).

Program for determining types of files for Windows, Linux and MacOS.

An extension for Ghidra that adds support for the PlayStation 2.

🔥🔒 Awesome MCP (Model Context Protocol) Security 🖥️

Protect your SSH keys with your Mac's Secure Enclave

Private, fast, and honest web browser

A multi-threaded PDF password cracking utility equipped with commonly encountered password format builders and dictionary attacks.

CVE-2025-1974

AutoRecon is a multi-threaded network reconnaissance tool which performs automated enumeration of services.

🐀 Small chrome extension to monitor (and optionally block) other extensions' network calls

Search engine for CTF writeups with instant results.

A collection of awesome security hardening guides, tools and other resources

Skynet - IPv4 firewall protection, threat feeds and traffic visibility for Asuswrt-Merlin. Manage your network through the WebUI or SSH.

This repository contains a collection of cheatsheets I have put together for tools related to pentesting organizations that leverage cloud providers.

A smarter web fuzzing tool that combines local LLM models and ffuf to optimize directory and file discovery

A security vulnerability scanner built with MCP plugins

A high-speed tool for passively gathering URLs, optimized for efficient and comprehensive web asset discovery without active scanning.

🔗 Don't know what type of hash it is? Name That Hash will name that hash type! 🤖 Identify MD5, SHA256 and 300+ other hashes ☄ Comes with a neat web app 🔥

Discover and enumerate all subdomains associated with a website, including those not publicly advertised. Use this tool to conduct thorough security assessments, validate your organization's digital footprint, or enhance your reconnaissance capabilities for penetration testing and bug bounty hunting.

Awesome cloud enumerator

AIGoat: A deliberately Vulnerable AI Infrastructure. Learn AI security through solving our challenges.