Security

Vaultwarden65.1k★

Vaultwarden is a lightweight, unofficial Bitwarden-compatible server written in Rust. It uses the same Bitwarden apps and browser extensions but runs on a fraction of the resources. A Raspberry Pi handles it fine. AGPL v3. Implements the Bitwarden API so all official Bitwarden clients (desktop, mobile, browser extensions, CLI) connect to it without issues. Supports organizations, password sharing, TOTP (two-factor codes), file attachments, and the Send feature, all features that Bitwarden's official server gates behind paid plans. Fully free to self-host. No paid tier. Features that cost $10/year on Bitwarden's hosted service (TOTP, emergency access, vault health reports) are free on Vaultwarden. Premium features unlocked for everyone. Setup: Docker container with a SQLite database. Takes 10 minutes. Runs on 50MB of RAM. Ops: minimal. Update the container occasionally, back up the SQLite file. Solo and family use: this is a no-brainer if you're comfortable with Docker. Small teams: works great with organizations feature. The catch: it's an unofficial implementation. Bitwarden could change their API and break compatibility (hasn't happened in years, but the risk exists). There's no commercial support. And if you lose your server without backups, your passwords are gone. Backups are not optional. Automate them.

Pi-hole60.2k★

Pi-hole blocks ads at the network level before they ever reach your screen, covering every device on your network: phones, smart TVs, tablets, everything. Instead of installing ad blockers on each device, you point your router's DNS to a Pi-hole server and it filters ad domains for your entire network. community-driven, runs on a Raspberry Pi or any Linux box. It works as a DNS sinkhole: when a device tries to load an ad domain, Pi-hole returns nothing. You get a web dashboard showing every DNS query, which devices are chatty, and what's being blocked. Most users see 20-40% of all DNS queries blocked. Fully free. No paid tier, no premium features, no cloud version. Donations accepted but nothing is gated. Setup takes 30 minutes if you've never touched a command line. Ongoing ops: almost zero. It just runs. Updates are a single command. The only real maintenance is occasionally whitelisting a domain that got caught in a blocklist. Solo home users: install it, forget about it. Small offices: works great on a shared network. The catch: it can't block ads embedded in the same domain as content (like YouTube ads served from youtube.com). For that, you still need a browser extension like uBlock Origin. And if you misconfigure it, every device on your network loses DNS resolution, so don't experiment on a Friday night.

Vault36.1k★

Vault is the industry standard for managing secrets: API keys, database passwords, encryption keys, anything that shouldn't live in a config file or an environment variable. It stores secrets, controls who can read them, rotates them automatically, encrypts data in transit and at rest, and logs every access. It's a bank vault for your application's credentials, and it's the most widely deployed tool of its kind in production. Two things changed the picture. HashiCorp relicensed Vault from open source (MPL) to the Business Source License in 2023, so it's now source-available, not true open source: free to self-host for your own use, but you can't offer it as a competing managed service. That move triggered OpenBao, a fully open (MPL-2.0) fork now under the Linux Foundation, which is the route to take if the BUSL bothers you. And as of 2026, Vault is an IBM product (IBM closed its HashiCorp acquisition in early 2025) and jumped to a 2.0 version line under IBM's support lifecycle. Vault is powerful and complex, not a docker-run-and-forget tool. Setting up high availability, configuring auth methods, writing policies, and handling the unseal process all take real infrastructure knowledge. Solo and small teams: self-host the free binary if you have the ops muscle, or look at OpenBao for a cleaner license. Teams that want it managed: HCP Vault starts around $365/mo. Large orgs: this is squarely the tool, just staff it accordingly. The catch is the license and the new owner. BUSL means you're depending on source-available software now run by IBM, and how that stewardship plays out over time is the open question. If a guaranteed-open future matters to you, OpenBao exists for exactly that reason.

Infisical28.6k★

Infisical manages your secrets: API keys, database passwords, environment variables, across all your projects and environments. It replaces scattered .env files with a central platform that has versioning, access control, audit logs, and native integrations with Kubernetes, Docker, and CI/CD pipelines. MIT-licensed, free to self-host. Docker Compose setup with Postgres and Redis. The web UI is genuinely good. CLI syncs secrets to local environments. Native Kubernetes operator handles pod injection. The setup is far less operationally complex than Vault, which is the point. Engineering teams with dozens of services and no secrets management discipline will get immediate value. The free self-hosted tier has no artificial limits. Infisical Cloud starts at around 6 USD/month per user for those who want managed hosting. The catch: for teams that need the full Vault feature set (PKI, dynamic secrets, hardware security modules), Infisical does not cover it. It is the right tool for application secrets; it is not a full secret engine.

SOPS22.7k★

SOPS encrypts secret values in your config files while leaving field names in plain text, so you can safely store secrets in git. You can see that a file has a `database_password` field, but the value is encrypted gibberish until you decrypt it. This is elegant because your secrets live in version control alongside your code. No separate secrets server, no external service, no extra infrastructure. The encrypted files are diffable in git. You can see that someone changed the database password even though you can't read the new value. SOPS supports AWS KMS, GCP KMS, Azure Key Vault, HashiCorp Vault, and age (a simple file-based key) for encryption. It works with YAML, JSON, ENV, and INI files. The workflow: edit the file with `sops secrets.yaml`, it decrypts in your editor, you make changes, it re-encrypts on save. The catch: SOPS is for storing secrets, not managing access to them. There's no audit log of who accessed what, no dynamic credential rotation, no fine-grained permissions. For a team of 3 sharing a dozen secrets, SOPS is perfect. For a team of 50 with compliance requirements, you need Vault. Also, key management is on you; if you lose your encryption key and don't have KMS, your secrets are gone forever.

SafeLine22.3k★

SafeLine is a web application firewall (WAF) that sits in front of your servers and filters malicious requests: SQL injection, XSS, bot traffic, credential stuffing. It's a bouncer for your web traffic that inspects every request before it reaches your app. GPL v3, Go. Uses a semantic analysis engine (not just regex pattern matching) to detect attacks, which means lower false positives than traditional WAFs. Dashboard shows traffic stats, blocked threats, and lets you configure rules. Supports reverse proxy mode. Drop it in front of Nginx or any web server. The community edition is free. Docker install, configure your upstream servers, and it's running. Basic WAF protection, bot detection, rate limiting, and IP blocking included. A pro/enterprise version exists with advanced features like enhanced bot protection, API security, and priority support. Pricing isn't publicly listed. Contact sales. Solo developers: free community edition is solid for protecting personal projects and small apps. Small teams: free edition handles most threats. Medium to large: evaluate the pro version for advanced bot protection and API security, or consider Cloudflare WAF if you're already using their CDN. The catch: you're adding another hop in your request chain. Latency increases slightly. The community edition's rule set is less comprehensive than Cloudflare or AWS WAF. And the GPL v3 license means modifications must be open-sourced, which matters if you're integrating it deeply into proprietary infrastructure.

CrowdSec14.4k★

CrowdSec analyzes your server logs, detects attack patterns, and shares threat intelligence with the community. Basically fail2ban on steroids with a global blocklist that everyone contributes to. MIT license, Go. It reads your logs (Nginx, SSH, WordPress, anything), detects attack patterns using community-written scenarios, and takes action: blocking IPs via your firewall, Cloudflare, AWS Security Groups, or a dozen other bouncers. The crowd-sourced threat intelligence means an IP that attacks someone else gets flagged before it hits you. Free tier: the Security Engine (detection + local decisions) is fully free. The community blocklist (crowd-sourced IP reputation) is free. Self-host everything. Paid: CrowdSec Console premium starts around $20/mo per server for advanced dashboards, custom blocklists, and priority threat feeds. Enterprise pricing is custom. Solo: install the free tier on your VPS, block 90% of automated attacks for $0. Small teams (2-10): free tier covers most needs. Pay $20/server/month when you want centralized dashboards across multiple servers. Large teams: enterprise plan for fleet management and custom threat feeds. The catch: CrowdSec depends on accurate log parsing. If your app logs in a non-standard format, you'll write custom parsers. And the community blocklist, while useful, can produce false positives. A shared hosting IP getting flagged because of one bad tenant affects everyone on that IP.

fscan14.2k★

Fscan is a one-command internal network scanner for security testing. Point it at an IP range and it does host discovery, port and service scanning, web and CMS fingerprinting, weak-credential brute-forcing across dozens of services, and checks for known vulnerabilities like MS17-010. It is the kind of tool a red teamer reaches for to map and probe an internal network fast. Written in Go, MIT licensed, free. Running it is genuinely one command: `./fscan -h 192.168.1.1/24` and it goes. A single static Go binary, no dependencies, cross-platform, with an optional web UI. That simplicity is the whole appeal; there is nothing to install or configure before you are scanning. For anyone doing authorized penetration testing or defending their own network, this is a fast, capable recon tool at zero cost. Solo testers and security teams use it the same way. There is no paid tier and no team story; it is a CLI you run against targets you are allowed to test. The catch is that this is a dual-use offensive tool, and the responsibility is entirely yours. Fscan includes brute-forcing, credential extraction, and exploitation modules that are legal on networks you own or are contracted to test, and a crime everywhere else. It also lights up every IDS in the building. Use it inside a real engagement scope, not because it is easy to point at something.

opencti9.8k★

OpenCTI is a platform for managing cyber threat intelligence. It structures the messy world of threat data (adversary TTPs, indicators, attribution) into the STIX2 standard, links every piece back to its source with a confidence level, and connects to MISP, TheHive, and MITRE ATT&CK. If your team drowns in threat feeds and spreadsheets, this is where that turns into a queryable knowledge graph. The community edition is Apache-2.0 and free. Self-hosting is a real project. OpenCTI is not a single binary; it runs on a stack (Elasticsearch, a message broker, workers, the GraphQL API and web UI), typically via Docker Compose. Getting it stood up is manageable with the docs, but keeping it healthy (index sizing, connector management, upgrades) is ongoing work that assumes someone owns it. For a security team that needs a real threat-intel backbone, the free edition covers the core platform and costs nothing in licensing. Solo analysts can run it but rarely need this much machinery. Larger orgs are the natural fit, and that is also where Filigran's proprietary Enterprise Edition comes in, adding features on top of the open core for a subscription. The catch is operational weight versus payoff. OpenCTI earns its keep when you have enough threat data and enough analysts to justify a platform; run it for a handful of feeds and you have built a data center to store a filing cabinet. Size the deployment to your actual intel volume, not to how impressive the graph looks.

maltrail8.6k★

Maltrail watches network traffic for connections to known malicious destinations. It pulls public threat feeds (known C2 servers, malware domains, abuse lists) and alerts when a host on your network talks to one of them. Free, MIT-licensed. Setup is moderate. You point it at a network interface or feed it aggregated traffic from your firewall, and let it analyze passively. The web UI shows alerts grouped by severity. Tune the feeds for your environment because public lists generate false positives, especially around shared CDN ranges. For homelabs, small SOCs, and security-conscious dev teams, this is a real tool. It's not a full IDS. Suricata or Zeek do deeper packet inspection. But it answers the simple question: is anything on my network calling out to a known bad place. That's useful even if you also run something heavier. The catch is that it only catches what's already on a public blacklist. Targeted attacks using fresh infrastructure won't trip it. Treat it as one signal in a layered defense, not the whole defense.

deepsec6.6k★

Deepsec is a security scanner that pays AI agents to find vulnerabilities the way a human auditor would. You point it at your repo, the agent reads the codebase, and it reports back with the kind of bugs that pattern-match scanners miss. The scan can cost thousands of dollars on a large codebase because it runs frontier models at maximum thinking depth. Apache 2.0, by Vercel Labs. Setup is `npx deepsec init` and a coding agent prompt to populate a project info file. From there, scans fan out across worker machines (or Vercel Sandbox microVMs for distributed runs). Jobs are idempotent, so an interrupted scan picks up where it left off. The model bill flows through Vercel AI Gateway or your own provider keys. Solo developers: probably overkill, and the model bill scares away curiosity scans. Use Snyk's free tier or Semgrep instead. Small teams shipping high-stakes code: a one-time scan of your auth layer or payment flow is in budget and finds real bugs. Large teams with security budgets: this is what you spend $30K on instead of a security consultant. The catch: the cost. A scan of a 100K-line monorepo with frontier models is real money. Read the FAQ before you launch one.

cloudquery6.5k★

CloudQuery syncs cloud configuration data into your data warehouse so you can query it with SQL. Pull from AWS, Azure, GCP, and 70+ SaaS sources, land it in Postgres, Snowflake, BigQuery, or whatever you run. Build cloud asset inventory, CSPM, FinOps, or vulnerability dashboards on top of clean tables. Run it as a CLI or scheduled job; pick a source and a destination, and CloudQuery handles the sync. Your cloud data never touches CloudQuery's servers, which matters if you're regulated. The plugin model is the differentiator vs Steampipe, which is more SQL-native and proxy-style. Pick this if you want to own your security data layer and run BI queries against it. Solo and small teams self-hosting get most of what Wiz and Lacework charge for, minus the UI polish and curated rule packs. Large teams might pay for premium plugins or the cloud version; the math is whether plugin maintenance time beats per-source cost. The catch: dashboards aren't included. You build security and FinOps views yourself in Grafana, Metabase, or Superset. If you want a turnkey security console with alerts pre-configured, you're paying Wiz.

Passbolt6.1k★

Passbolt is a password manager built for teams, with end-to-end encryption and user-owned secret keys. The Community Edition gives you password management, shared folders, browser extensions, mobile apps, CLI access, and 2FA. No user limits, no password limits. Self-hosting runs on PHP with MySQL or PostgreSQL. Docker and VM appliance options are available. The setup is straightforward, and the security model is solid: regular third-party audits with published findings. Ongoing maintenance is light if you keep PHP and the database healthy. Solo and small teams get a capable password manager for free. Once you need LDAP provisioning, SSO (Microsoft, Google, OpenID), or audit logging, you are looking at the Business tier at $4.90/user/month (minimum 10 users). That is a fair paywall. SSO and audit logs are enterprise features that cost real money to build. The catch: the 10-user minimum on the Business plan means small teams pay $49/month even if they only have 3 people who need SSO. If that pricing math does not work, Vaultwarden covers similar ground with a lighter footprint.

T3MP3ST5.5k★

T3MP3ST points a swarm of AI agents at a target and tries to break in, then writes up how. It automates the red-team loop, reconnaissance, exploitation, and reporting, across web apps, CTF challenges, source code, embedded systems, and smart contracts. Instead of asking for its own API keys, it drives coding agents you already run, Claude Code, Codex, or Hermes. AGPL-3.0 and free. Getting it running is light: npm install, npm run server, and a web War Room interface comes up. What is behind that interface is the honest question. The recon operator is production-ready, but the headline, a coordinated multi-agent swarm chaining exploits end to end, is still largely scaffolded. The benchmark numbers (around 90 percent on a web-security challenge suite, most of a held-out CVE set matched) come from a single agent, not the swarm the name promises. To its credit, the repo ships a verify-claims command so you can re-derive them yourself. This is for security people doing authorized work, pentesters, CTF players, researchers probing their own code, not a push-button tool for anything you do not own. Solo researchers and small security teams: worth a look as an AI-assisted recon and triage layer today, with the exploitation swarm as a promising work in progress. Treat the automation as a force multiplier for a human who knows what they are doing, not a replacement for one. The catch is the gap between the pitch and the product. The recon works, the autonomous kill chain does not fully exist yet, and AGPL-3.0 means anything you build on top inherits that copyleft. Judge it on what runs today, not the roadmap in the README.

Modlishka5.4k★

Modlishka is a reverse-proxy tool for phishing simulations and red-team testing. It demonstrates why SMS and TOTP-based 2FA aren't as secure as people think. Fully free. No paid tier. This is a security research tool, not a commercial product. Set it up, point it at a target domain, and it automatically mirrors the real site while capturing everything the user types, including one-time 2FA codes. The catch: this is a double-edged sword. It's designed for authorized penetration testing only. Using it against targets without permission is illegal. The project hasn't been actively maintained, and modern phishing-resistant methods like WebAuthn/passkeys defeat it entirely. If you're a defender, this tool shows you exactly why you should be pushing your org toward hardware security keys instead of SMS codes.

bumblebee4.9k★

Bumblebee answers one question fast: which of my machines have a known-compromised package installed? It's a read-only scanner from Perplexity that inventories what's on a developer's laptop or server, npm, PyPI, Go modules, RubyGems, Composer, browser and editor extensions, MCP configs, and flags anything matching a catalog of known-bad versions. Free, Apache-2.0, written in Go. The read-only part matters. It never runs a package manager, never reads your source, and deliberately won't print credential values out of MCP configs. It just reads lockfiles and metadata. That makes it safe to run across a fleet during an incident, which is exactly the job it's built for: supply-chain incident response, not continuous scanning. The catch: it's narrow on purpose. You supply the catalog of compromised packages, and Bumblebee matches against it. It won't find unknown vulnerabilities or do what a full SCA tool like Snyk does. For 'a bad package just hit the news, who's exposed,' it's perfect. For ongoing dependency security, it's not the whole answer.

coraza3.7k★

Coraza is a web application firewall engine: it inspects HTTP requests for SQL injection, XSS, and the rest of the attack alphabet before they reach your app. It's an OWASP project written in Go, fully compatible with ModSecurity's rule language and the OWASP Core Rule Set, and free under Apache 2.0. You don't run Coraza by itself; you embed it in a proxy. The mature paths are a Caddy build with the Coraza plugin or Envoy via proxy-wasm, then loading the Core Rule Set. The install is the easy half. The work is tuning: every real application trips false positives until you've spent quality time with exclusion rules. Solo and small teams wanting an appliance with a dashboard should use chaitin/SafeLine instead; Coraza has no UI. Platform and infrastructure teams get exactly what they want here: a maintained, embeddable WAF engine without betting on ModSecurity, whose corporate support ended and left it in maintenance mode. The catch: a WAF engine without tuned rules is a false-positive machine. Run it in detection-only mode against production traffic before you even think about blocking.

nono3.5k★

Nono provides that. It's a capability-based sandbox where you explicitly grant each permission an agent gets. Basically, it's a bouncer for your operating system: the agent only gets through the doors you open. Capability-based means instead of blocking bad things (which requires knowing all bad things), you whitelist good things. The agent can only access files, network, and system calls you explicitly allow. Everything else is denied at the kernel level. Apache 2.0 licensed, Rust. The catch: kernel-level enforcement means Linux only, no macOS, no Windows. The capability model requires you to think carefully about what permissions each agent needs, which is more work upfront than just running Docker. And the documentation and community support are thin.

sogen3.5k★

sogen runs Windows and Linux programs without the operating system underneath them. It emulates the CPU and fakes the system calls, loading the real system DLLs so a binary behaves like it is on a real machine. For reverse engineers and malware analysts, that means stepping through a sketchy executable, hooking any instruction, inspecting memory, and snapshotting the entire machine state, all without booting a VM or risking your host. It is open source under GPL-2.0, and there is a browser demo at sogen.dev if you want to try it before installing anything. Running it yourself is reasonable for a tool this deep. It ships Python bindings on pip and several emulation backends (Unicorn, icicle, Hyper-V, KVM), so you trade speed against fidelity depending on what you pick. The usual emulator catch applies: not every Windows API or odd syscall is implemented, so sophisticated malware that probes for an emulated environment or hits an unsupported call can break or detect it. Expect to file the occasional issue and work around gaps. Solo researchers and small security teams: this is a useful free addition to your kit, especially for deterministic, scriptable analysis you cannot get out of a normal sandbox. Larger teams doing heavy malware work will want it alongside commercial dynamic-analysis suites, not instead of them, since those bring broader API coverage and a support contract. The catch is that it is a one-person project. Polished and actively developed, but one maintainer. Before you build analysis workflows on top of it, know that the bus factor is one.

METATRON3.4k★

METATRON runs penetration tests with a local LLM doing the analysis. Point it at a target and it executes nmap, nikto, whois, and other standard security scans, then feeds the results to an LLM running on your machine for vulnerability assessment and exploit suggestions. Everything stays local, nothing hits the cloud. Built specifically for Parrot OS (a Linux pen-testing distro), it stores findings in MariaDB and exports reports as PDF or HTML. The LLM integration means you get natural language explanations of scan results instead of parsing raw nmap output yourself. It's essentially a security analyst copilot that runs offline. Security professionals and pen-testers who want AI assistance without sending scan data to external APIs get the most out of this. Students learning security will appreciate the explanations. Experienced red teamers might find the tool suggestions basic compared to their existing workflow. The catch: Parrot OS only, which limits the audience significantly. The local LLM quality depends entirely on your hardware, and smaller models give vague or wrong security advice.

teller3.2k★

Teller unifies them behind one CLI and one config file. It's a secrets multiplexer. Map your environment variables to any combination of secret stores, and Teller fetches them at runtime. `teller run, node app.js` injects secrets into your process without them ever touching disk. It also syncs between providers: pull from Vault, push to AWS, or vice versa. Apache 2.0, written in Rust. No paid tier, no cloud version. The catch: Teller solves a real problem but it's a niche one. If you only use one secrets manager, you don't need it. Just use that provider's SDK. The value shows up when you have secrets scattered across 3+ providers and need one workflow. The community is small and the tool is emerging. Don't bet critical infrastructure on it without evaluating the bus factor. For a more established approach, look at how Infisical or HashiCorp Vault handle multi-source aggregation.

zeroboot2.4k★

Zeroboot spins up virtual machine sandboxes in under a millisecond using copy-on-write forking. That speed matters because agents need to spin up and tear down environments constantly, and traditional VMs take seconds to minutes. Sub-millisecond means your agent can create a fresh isolated environment for every single command it runs. No leftover state, no risk of one task contaminating another. It's like giving your agent a brand new computer for every action. Apache 2.0 licensed, Rust. The catch: this is Linux-only (it relies on kernel-level VM features). No macOS, no Windows. The sub-millisecond claim is for the VM fork. Actual workload startup depends on what you're running inside. And the community is small. If you hit an edge case, you're likely on your own.

aur-malware-check2.1k★

aur-malware-check scans your Arch Linux system for traces of the June 2026 AUR supply-chain attack, the one that compromised over 1,600 packages in the Arch User Repository. It checks your installed packages against the known-bad lists and hunts for the attack's fingerprints: systemd persistence, eBPF rootkit traces, and poisoned npm and bun caches. The scripts are tuned to run in a second or two and return exit codes you can wire into automation. There's nothing to host. You download the scripts and run them, and they tell you whether your machine shows signs of compromise. For a security tool this is about as low-friction as it gets, which matters when you need an answer fast and you're worried your box is already infected. Arch users who installed AUR packages during the attack window are exactly who needs this, right now. If you don't run Arch or never touch the AUR, it's not for you. This is a targeted response to a specific incident, not a general antivirus, and that focus is its strength: it knows exactly what to look for. The catch: it's incident-specific community scripts with no formal license and no warranty, the author says as much. A clean result is reassuring but not a guarantee, and a positive result means you've got real cleanup ahead. Use it as a fast first check, then verify anything it flags before you trust the machine again.

ort2.1k★

ORT automates the open-source license-compliance work most teams either do by hand or, more honestly, don't do at all. It's a suite, Analyzer, Scanner, Advisor, Evaluator, Reporter, and Notifier, that walks your dependency tree, identifies licenses and vulnerabilities, enforces policy, and generates the compliance reports auditors ask for. It lives under the Linux Foundation's ACT initiative and carries the OpenSSF badges to match. This is the open source answer to Black Duck, FOSSA, and Snyk's license side, tools that bill enterprises tens of thousands a year. ORT does the core job for free, wired straight into CI. For a team shipping software with real licensing exposure, that's a serious amount of money saved. Solo devs rarely need this; small and larger teams with compliance requirements are the real audience, and self-hosting is the point. The catch is the setup. ORT is heavy. It's a full SCA pipeline in Kotlin and Gradle, and standing it up and tuning the policy rules is a project, not an afternoon. The commercial tools charge partly for making this easy. Budget the engineering time, or the "free" gets expensive in hours.

ggshield2.0k★

Ggshield catches that before it reaches your remote repository. It scans your commits for secrets (API keys, passwords, certificates, private keys) and blocks the push if it finds any. Picture a pre-commit hook that prevents your worst 'oh no' moments. MIT license, Python CLI. Runs as a Git hook, in CI/CD pipelines, or as a standalone scanner. Uses GitGuardian's detection engine which recognizes 400+ types of secrets. Also scans for infrastructure-as-code misconfigurations (Terraform, CloudFormation, Kubernetes). The free tier covers individual developers: unlimited local scanning, up to 25 developers on GitGuardian's platform with basic features. Paid plans start at $60/developer/month for teams, which adds historical scanning, dashboards, incident management, and remediation workflows. Solo developers: free and you should install it today. There's no reason not to have secret detection in your Git hooks. Small teams (2-25): free tier covers you. Growing teams: $60/dev/mo adds value when you need historical scanning and incident workflows. Large orgs: enterprise pricing for SAML SSO, custom detectors, and API access. The catch: the real power is in GitGuardian's cloud platform, not just the CLI. The free CLI scans current commits, but finding secrets already buried in your Git history requires the paid platform. TruffleHog and Gitleaks are fully free alternatives that scan history locally, less polished, but no per-developer pricing.

for-open-source1.9k★

This is not a tool you install. It's 1Password's program that gives free team accounts to open source projects. If you maintain an open source project and need to share API keys, deployment credentials, or service passwords with contributors, this gets you a 1Password Teams account at no cost. The application is straightforward: submit your open source project, demonstrate active maintenance, and 1Password provides a free team account with all the premium features: shared vaults, access controls, and the 1Password CLI for CI/CD integration. This matters because open source projects constantly struggle with credential management. Sharing secrets over Discord DMs or unencrypted emails is how breaches happen. A proper password manager with team vaults is the right answer. The catch: this is a proprietary product offered for free, not open source software. 1Password itself is closed-source. If 1Password changes or ends this program, you'd need to migrate. And the free tier is specifically for open source teams; your startup or side business doesn't qualify. For an actually open source password manager, Vaultwarden (self-hosted Bitwarden) is the alternative. It's more work to set up but you own everything.

darksword-kexploit1.5k★

This is the DarkSword kernel exploit reimplemented in clean Objective-C. It targets iOS 15.0 through 26.0.1 and provides arbitrary kernel read/write, the foundation for jailbreaks, security research, and vulnerability analysis. The original DarkSword exploit chain was used by commercial surveillance vendors targeting multiple countries before being leaked publicly. This reimplementation by opa334 (a well-known jailbreak developer) makes it accessible to researchers in clean, readable code rather than the obfuscated original. No license specified. The catch: this is a kernel exploit. The security implications are real. Apple has patched this in newer iOS versions, so it only affects devices that haven't updated. Using this for anything other than security research or personal device modification puts you in legal and ethical gray areas. No license means no explicit permission to use or modify. And if you're not already deep in iOS internals, the code won't teach you much without significant background knowledge.

eth-phishing-detect1.3k★

This is MetaMask's phishing detection library. It maintains a blocklist of known phishing domains targeting crypto users and a fuzzy-matching algorithm that catches typosquatting attempts. You feed it a domain, it tells you if it's a known phishing site or looks suspiciously similar to a legitimate one. MetaMask uses it internally to warn users before they connect their wallet to a malicious site. The library itself is simple; it's the maintained blocklist that's valuable. Community-contributed and regularly updated as new phishing campaigns appear. The catch: this is narrowly focused on Web3/crypto phishing. It won't help with general phishing detection. The blocklist is only as current as the last update; zero-day phishing domains won't be caught until someone reports them. And the license is listed as 'Other'; check the repo for exact terms before integrating commercially.

probo1.3k★

probo is open source compliance automation for startups, the kind of tool that gets you through a SOC 2, GDPR, or ISO 27001 audit without paying for an expensive platform. It tracks the controls, evidence, and policies those frameworks demand, with HIPAA and newer ISO standards on the list too. Built in Go with a React frontend, MIT licensed, and free to self-host. This is the open alternative to Vanta, Drata, and Secureframe. Self-hosting is real work. It runs via Docker, but the stack is substantial: a Go backend, Postgres, a React frontend, and a full observability layer with Grafana, Prometheus, Loki, and Tempo. Standing it up takes Docker, Node 22, and some patience. This is moderate-to-significant ops burden, not a weekend project, though it is far cheaper than the contracts the commercial GRC platforms charge. Solo founders and small startups facing their first SOC 2 will save real money here, since the commercial tools start in the five figures a year. Small teams with someone technical to run it get most of the value. Larger or less technical orgs that need hand-holding, auditor integrations, and support may still want a paid platform. There is no paid tier from probo; the trade is your time and infrastructure for their subscription fee. The catch is that compliance software is only half the job. probo organizes evidence and controls, but it will not talk to your auditor for you, and the commercial platforms' real value is often the audit relationships and integrations they bring. Self-hosting saves money; it does not save you from the audit itself.

vault-guides1.1k★

This isn't HashiCorp Vault itself; it's the official collection of example code and tutorials for learning Vault. If you're trying to figure out how to store API keys, database passwords, or encryption keys securely, these guides walk you through Vault's features with working code examples. Vault is a secrets management tool: instead of hardcoding passwords in environment variables or config files, your applications request secrets from Vault at runtime. Vault can also generate temporary database credentials, encrypt data, and manage PKI certificates. It's the industry standard for secrets management at scale. The guides cover identity management, secrets engines, encryption as a service, governance policies, and operational patterns. Examples in Shell, Python, Ruby, and Terraform. Useful for getting started but increasingly dated; some guides reference older Vault versions. Vault itself is source-available (BSL license). The open source fork is OpenBao. HCP Vault (managed cloud) starts at $0.03/hr (~$22/mo) for a small cluster. The catch: these are learning guides, not the tool. If you need Vault, go to the main vault repo. And Vault itself is complex; it's designed for organizations with real compliance requirements. For a solo developer or small team, SOPS or doppler.com handles secrets management with 10% of the complexity.

gshark1.0k★

gshark watches public code for your secrets before someone else finds them. It scans GitHub, GitLab, Searchcode, and Postman for leaked API keys, tokens, and credentials that match rules you define, then surfaces the hits in a web dashboard. The job it does is the same one GitGuardian charges for: catching the AWS key an employee pasted into a public gist before it turns into a bill or a breach. It is open source under Apache-2.0. This is a real application to run, not a script. There is a Go backend, a Vue frontend, and a database, plus API tokens for each source you want to scan. Budget an afternoon to stand it up and some ongoing care to tune rules so you are not drowning in false positives. Once it is running, it is yours: your data never leaves your infrastructure, which matters when the thing you are searching for is your own leaked credentials. Solo developers and small teams who mostly need to watch their own org: gshark is a solid free option and the self-hosting is manageable. Larger security teams that want managed coverage, validity checking, and a support line will still find GitGuardian or similar worth paying for. If you only need to scan your own repos in CI, lighter tools like gitleaks or trufflehog may be a better fit than standing up a whole platform. The catch: a tool that hunts for exposed secrets across public code is dual-use by nature, and the docs lean heavily Chinese. Nothing wrong with either, but factor in the reading and the responsibility before you point it at the whole internet.

HacxGPT924★

This tool claims to be a GPT-based hacking/security tool. MIT license, Python-based. The homepage URL points to python.org (not a real project page), and the description is blank. Let me be direct: this has every hallmark of a star-farmed or spam repository. Blank description, generic homepage pointing to python.org, unknown provenance, and a name designed to attract clicks from people searching for 'hacking tools.' The GitHub profile and commit history should be scrutinized before running any code from this repo. If you're looking for legitimate security testing tools, look at the alternatives below. Do not run unknown Python scripts from suspicious repositories on your machine. The catch: everything about this. Don't use it.

littlesnitch-linux893★

Objective Development open-sourced the eBPF networking components behind Little Snitch, their macOS firewall, and brought them to Linux. This gives you kernel-level control over outbound network connections: monitor what your system talks to and block what you don't want. Setup is developer-grade. You need Rust, clang, and bpf-linker to build from source. Traffic filtering works through plain text blocklists (domains and hosts), and the web UI is minimal. This is not a consumer product yet. It's the engine room, published for people who know what eBPF is and why they want it. Security-conscious developers and sysadmins running Linux workstations are the audience. Anyone who wants kernel-level visibility into every outbound connection, and is comfortable building Rust projects, will feel right at home. The catch: GPL-2.0 covers the open source parts, but some components remain proprietary. No GUI to speak of, manual blocklist management, and the build process will filter out anyone who isn't already comfortable in a terminal.

fence888★

Fence sandboxes them without containers. It restricts network access and filesystem access at the OS level, so a rogue script can't phone home or delete your files. What's free: Everything. Apache 2.0 license. Single Go binary, no dependencies, no account. The value proposition is simplicity. Docker gives you isolation but requires the Docker daemon, images, and significant overhead. Fence is one binary. Run `fence <command>` and it executes with network and filesystem restrictions. That's it. For AI agent sandboxing, where you're running LLM-generated code and need guardrails, this is exactly the right weight class. The catch: it's brand new and early-stage. Linux only (uses kernel namespaces and seccomp). No macOS or Windows support. The security model is narrower than a full container. It restricts network and filesystem but doesn't provide complete process isolation. For high-security use cases, you still want containers or VMs. For 'don't let this script access the internet or my home directory,' it's perfect.

audit798★

audit is an automated vulnerability-discovery agent from evilsocket. Point it at a codebase and it runs an eight-stage pipeline, recon, hunt, validate, trace, report, using narrow AI agents that deliberately argue with each other: a second agent on a different model tries to disprove the first one's findings. MIT-licensed and free. The design borrows from Cloudflare's research that real bug-hunting needs many focused agents, not one giant model doing everything. It runs on your Claude Code subscription through the official Agent SDK, so there's no separate API key or metered bill if you already pay for Claude. Setup is more involved than a one-liner, and the agents run shell commands, so a disposable VM is the right call for untrusted code. The catch: this drives an LLM to find bugs, which means false positives and missed issues both happen. It's a force multiplier for a security reviewer, not a replacement for one. If you do code audits and already have Claude, it's worth a serious look. If you expect it to certify your code as safe on its own, that's not what this is.

VaultSharp546★

VaultSharp is the .NET client library for HashiCorp Vault. Instead of making raw HTTP calls to Vault's API, you get typed methods and objects. Apache 2.0, C#. Covers the full Vault API: secret engines (KV, Transit, PKI, databases), auth methods (AppRole, Token, LDAP, Kubernetes), and system operations. Supports both Vault Community and Enterprise features. Fully free. This is a client library: no hosting, no service, no paid tier. NuGet install and use. The catch: this is a niche library for a specific integration. You need HashiCorp Vault already running (which has its own cost and ops story). VaultSharp just makes talking to it from C# easier. If you're not in the .NET ecosystem, this isn't relevant. If you are, it's essentially the only maintained Vault client for C#, so the choice is this or raw HTTP. At, the community is small, don't expect instant answers to edge case questions.