Security on GitHub: The Essential Toolkit for Testing, Defending and Locking Down Your Stack
A practical tour of the most useful open-source security projects on GitHub, from vulnerability scanners and intercepting proxies to reference guides that teach you how to build and run software defensively. Whether you ship code, run servers or test them for a living, these are the tools worth knowing.
Living article: rankings and health notes are re-checked against GitHub and community data. Ratings are GitPalace community ratings; stars are GitHub stars.
Trivy is an all-in-one security scanner that inspects container images, filesystems, git repositories, virtual machine images and Kubernetes clusters for vulnerable packages, misconfigurations, leaked secrets and licence issues, and can emit an SBOM along the way. It is aimed at developers and platform teams who want a single scanner they can drop into CI and run against everything they ship.
Nuclei is a template-driven vulnerability scanner where detection logic is written as simple YAML that describes requests and matchers, backed by a large community-maintained template library. It suits penetration testers, bug-bounty hunters and security teams who want to sweep many hosts for known issues quickly and encode their own checks.
mitmproxy is an interactive, TLS-capable intercepting proxy for HTTP, HTTP/2 and WebSockets, available as a terminal UI, a web interface and a scriptable command-line tool. It is the workhorse for penetration testers debugging application traffic and for developers who need to see, modify and replay exactly what their apps send over the wire.
sqlmap automates the detection and exploitation of SQL injection flaws, fingerprinting the backend database and, where a flaw exists, extracting data or escalating to the underlying system. It is a standard tool for authorised penetration testers and CTF players who need to confirm and demonstrate injection issues rather than guess at them.
PayloadsAllTheThings is a curated reference of payloads, bypass techniques and methodology notes for web application security, organised by vulnerability class with a consistent structure for each topic. It is the go-to cheat sheet for pentesters and CTF competitors, and equally useful for developers who want to understand what attackers actually try.
The OWASP Cheat Sheet Series is a collection of concise, expert-reviewed guides on securing specific aspects of an application, from authentication and session management to input validation and dependency handling. It is written for builders rather than breakers, making it the defensive counterpart to the offensive references in this guide.
How To Secure A Linux Server is an evolving, opinionated walkthrough of hardening a fresh Linux box, covering SSH, firewalls, intrusion prevention, updates and monitoring while explaining why each step matters. It is ideal for self-hosters and developers standing up their first VPS who want a sane baseline without reading a dozen scattered tutorials.