#devsecops (30 Repositories)
Ranked open-source repositories tagged with #devsecops, scored by pull request acceptance likelihood and maintainer engagement velocity.
79.6%
20.4h
30 repositories tagged #devsecops
safedep/pmg
PMG protects developers, AI agents from malicious open source packages using proxy, sandbox and SafeDep's threat intelligence feed.
l3montree-dev/devguard
DevGuard Backend - Secure your Software Supply Chain - Attestation-based compliance as Code, manage your CVEs seamlessly, Integrate your Vulnerability Scanners, Security Framework Documentation made easy - OWASP Incubating Project
cynative/cynative
Open-source security agents for cloud, code and runtime. 45 built-in agents audit AWS, GCP, Azure, Kubernetes, GitHub and GitLab for privilege escalation, public exposure, supply chain and more, or build your own in one markdown file. Live, read-only access to your infrastructure.
hahwul/dalfox
🌙🦊 Dalfox is a powerful open-source XSS scanner and utility focused on automation.
ArduPilot/MethodicConfigurator
A clear ArduPilot configuration sequence
PrismorSec/prismor
Self-hosted runtime control plane for AI agents. Observe or HITL approve or Block rogue tool calls before it executes: secret leaks, prompt injection, supply chain etc in a local dashboard. Agent agnostic (Claude, codex, langchain etc.)
devsecblueprint/devsecblueprint
Learn DevSecOps and Cloud Security Engineering fundamentals.
chainloop-dev/chainloop
SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more
duriantaco/skylos
Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/
0sec-labs/0
The multiplayer AI offensive security OS - open, self-improving, extensible. Find, verify, and fix vulnerabilities.
SecObserve/SecObserve
SecObserve is an open source vulnerability and license management system for software development teams and cloud environments. It supports a variety of open source vulnerability scanners and integrates easily into CI/CD pipelines.
xonsh/xonsh
🐚 Python-powered shell. Full-featured, cross-platform and AI-friendly.
GitGuardian/ggshield
Detect and validate 500+ types of hardcoded secrets with advanced checks. Use it as a pre-commit hook, GitHub Action, or CLI for proactive secret detection and security.
praetorian-inc/titus
High-performance secrets scanner. CLI, Go library, Burp Suite extension, and Chrome extension. 487 detection rules with live credential validation.
hashgraph-online/hol-guard
Open-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.
jitpass/jit
Find the plaintext secrets on your Mac and move them behind Touch ID, injected just in time without breaking the tools that read them. Free and local-first.
OWASP/wrongsecrets
Vulnerable app with examples showing how to not use secrets
openai/codex-security
OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm: https://www.npmjs.com/package/@openai/codex-security
betterleaks/betterleaks
Find leaked secrets everywhere.
mongodb/kingfisher
Detect secrets + live validation. Map blast radius. Revoke fast. Use the CLI or embed in Rust and Python.
filipi86/drogonsec
High-performance open-source security scanner combining SAST, SCA, Secret Detection, and IaC analysis, built for developers and CI/CD pipelines, using AI for recommendation!
nomadicmehul/CloudCaptain
Free, open-source learning hub for Cloud, DevOps & AI — 330K+ words of full tutorials, 21 cheat sheets, 19 interview Q&A sets, and certification exam prep, with built-in reading progress. No paywall, ever.
digitalis-io/vals-operator
Kubernetes Operator to sync secrets between different secret backends and Kubernetes
interlynk-io/sbomasm
sbomasm: The Complete SBOM Management Toolkit
awslabs/threat-designer
Threat Designer is a GenerativeAI application designed to automate and streamline the threat modeling process for secure system design.
secureCodeBox/secureCodeBox
secureCodeBox (SCB) - continuous secure delivery out of the box
zaproxy/action-baseline
A GitHub Action for running the ZAP Baseline scan
pyupio/safety
Safety checks Python dependencies for known security vulnerabilities and suggests the proper remediations for vulnerabilities detected.
Zyrexnn/Cybermes
Autonomous Offensive Security, Bug Bounty & Red Teaming Agent Framework powered by Hermes Agent, specialized reasoning skills, and multi-model LLM orchestration.
m14r41/PentestingEverything
Complete Solution for VAPT/AppSec and Pentesting Guide: Web | Mobile | API | Thick Client | Source Code Review | DevSecOps | Wireless | Network Pentesting | SAST | DAST etc...