An awesome list of OSS developer-first security tools
-
Updated
May 15, 2025
#
developer-security
Here are 39 public repositories matching this topic...
An ongoing & curated collection of awesome software practices and remediation, libraries and frameworks,payloads and techniques, best guidelines and technical resources about Application Security
application application-security web-security security-vulnerability security-hardening appsec vulnerability-scanners security-scanner security-tools web-security-research security-testing endpoint-security mobilesecurity mdm-server developer-security security-advisory
-
Updated
Sep 23, 2023 - Python
Open-source config scanner for AI coding agents: scores the permissions, hooks, sandbox and MCP settings of Claude Code, Codex, Cursor and Gemini CLI. Runs locally and measures by default, with an optional fleet server and SIEM feed. Rust.
rust security mcp cybersecurity cursor siem soc codex ai-security endpoint-security detection-engineering developer-security ai-agent prompt-injection gemini-cli claude-code mcp-security ai-coding-agent tool-poisoning ai-spm
-
Updated
Nov 2, 2026 - Rust
Application scanning component of OWASP PurpleTeam
devops ci build-tool application-security web-security hacktoberfest devsecops cloud-security security-testing purpleteam application-scanner security-regression-testing devsecops-pipelin developer-security
-
Updated
Feb 12, 2023 - JavaScript
NEXUS REDFOX — Local-first code intelligence and security analysis platform for developers and security researchers.
python cli open-source static-analysis dependency-analysis code-analysis cybersecurity developer-tools software-analysis software-security security-tools devsecops security-analysis source-code-analysis project-analysis code-intelligence code-security developer-security nexus-redfox
-
Updated
Aug 13, 2026 - Python
TLS scanning component of OWASP PurpleTeam
tls devops ci build-tool application-security web-security hacktoberfest devsecops cloud-security security-testing purpleteam devsecops-pipeline security-regression-testing tls-security developer-security
-
Updated
Feb 8, 2023 - JavaScript
Offline, read-only repository triage for documented software supply-chain and coding-agent attacks, with explicit coverage and fail-closed results
python cli security software-supply-chain security-scanner sarif security-tools ai-security supply-chain-security developer-security coding-agents repository-scanner agent-security claude-code npm-security shai-hulud repository-security
-
Updated
Oct 4, 2026 - Python
Infrastructure as Code for SUTs
devops ci terraform iac build-tool application-security web-security hacktoberfest sut devsecops cloud-security security-testing purpleteam system-under-test devsecops-pipeline security-regression-testing developer-security
-
Updated
Jun 19, 2022 - HCL
Server scanning component of OWASP PurpleTeam
devops ci build-tool application-security web-security hacktoberfest devsecops cloud-security security-testing purpleteam devsecops-pipeline server-scanner security-regression-testing developer-security
-
Updated
Mar 5, 2023 - JavaScript
Stage Two containers of OWASP PurpleTeam
docker devops ci containers build-tool application-security web-security hacktoberfest devsecops cloud-security security-testing purpleteam devsecops-pipeline security-regression-testing developer-security
-
Updated
Feb 3, 2023 - Shell
AWS Lambda functions of OWASP PurpleTeam
devops lambda ci build-tool application-security web-security hacktoberfest devsecops cloud-security security-testing purpleteam devsecops-pipeline security-regression-testing purpleteam-lambda developer-security
-
Updated
Jul 13, 2022 - JavaScript
Post-compromise forensic tool for developer workstations
python golang incident-response forensics dfir blue-team threat-emulation supply-chain-security developer-security credential-exposure
-
Updated
Jun 9, 2026 - Go
How to identify, analyze, and report targeted phishing campaigns on GitHub — with real-world case studies and a step-by-step takedown workflow.
security osint phishing cybersecurity opsec warnings threat-intelligence social-engineering scammers living-off-the-land abuse-reporting phishing-awareness github-security developer-security how-to-secure
-
Updated
Apr 1, 2026
Security scanner for VSIX, MCP, AI IDEs, and developer workflow attack paths.
vsix vscode vscode-extension security-scanner sarif ai-security supply-chain-security developer-security ide-security
-
Updated
May 9, 2026 - Python
Instructions and materials to run the HIPSTER workshop
-
Updated
Aug 15, 2023
Zero dependency Node script that flags install hooks and risky code in a repo before you run npm install. For take-home tests and unknown projects.
nodejs javascript cli npm security static-analysis developer-tools git-hooks devsecops malware-detection take-home-test supply-chain-security scam-prevention developer-security npm-security supply-chain-attack recruitment-scam
-
Updated
Oct 24, 2026 - JavaScript
Zero-trust API firewall and security integrity layer for autonomous AI agents & Model Context Protocol (MCP) tool execution. Secure, TOCTOU-proof, fail-closed.
rust application-security python-sdk human-in-the-loop owasp-top-10 ai-agents go-sdk zero-trust security-gateway api-firewall developer-security axum agentic-ai model-context-protocol mcp-security fail-closed soc2-compliance cedar-policy cryptographic-integrity action-receipts
-
Updated
Oct 14, 2026 - Rust
Claude Code skill that hardens package manager configs against supply chain attacks. Run /harden once, it detects what you have and secures it.
package-manager supply-chain-security developer-security dependency-confusion claude-code npm-security claude-code-skill pip-security
-
Updated
Apr 3, 2026
AI-powered vulnerability reporting platform that automates pentest report generation from raw findings into professional, client-ready deliverables.
python ai cybersecurity penetration-testing developer-tools bug-bounty workflow-automation security-tools security-engineering developer-productivity developer-security reporting-pipelines practical-tooling security-productivity
-
Updated
Apr 8, 2026 - HTML
An interactive, privacy-first cybersecurity simulator exposing how social engineering scams manipulate trust, exploit urgency, and compromise security.
javascript open-source cybersecurity web-security threat-modeling fraud-prevention interactive-learning security-training social-engineering-attacks social-engineering security-awareness privacy-first cybersecurity-training cyber-education supply-chain-security phishing-awareness developer-security phishing-simulation oauth-security scam-awareness
-
Updated
Oct 14, 2026 - JavaScript
Add this topic to your repo
To associate your repository with the developer-security topic, visit your repo's landing page and select "manage topics."