Search Results for "code analysis"
Sort By:
Showing 69 open source projects for "code analysis"
View related business solutions-
Our Free Plans just got better! | Auth0You asked, we delivered! Auth0 is excited to expand our Free and Paid plans to include more options so you can focus on building, deploying, and scaling applications without having to worry about your security. Auth0 now, thank yourself later.
-
Build Data Resilience - Take the Assessment TodayIs your recovery strategy as strong as you think? Take this quick self-assessment to check your recovery readiness and gain tailored insights. In only 2 minutes, you'll learn where you fall on the recovery readiness scale.
-
1
Claude Code Security Reviewer
An AI-powered security review GitHub Action using Claude
The claude-code-security-review repository implements a GitHub Action that uses Claude (via the Anthropic API) to perform semantic security audits of code changes in pull requests. Rather than relying purely on pattern matching or static analysis, this action feeds diffs and surrounding context to Claude to reason about potential vulnerabilities (e.g. injection, misconfigurations, secrets exposure, etc). -
2
Defending Code Reference Harness
Skills for threat modeling, scanning, triage, patching, etc.
Defending Code Reference Harness is a reference implementation for autonomous vulnerability discovery and remediation with Claude. It is designed for security teams that want a structured way to test, triage, and patch software issues with agent support. The project includes skills for threat modeling, scanning, triage, patching, and customizable autonomous analysis workflows. -
3
Ghidra
Ghidra is a software reverse engineering (SRE) framework
...It supports a wide array of instruction sets and executable formats, offering features such as decompilation, disassembly, scripting, and interactive graphing. Designed for security researchers and analysts, Ghidra provides a robust environment for understanding malware, auditing code, and performing software forensics. It includes both GUI-based and headless analysis modes. -
4
tfsec
Security scanner for your Terraform code
tfsec is a static analysis security scanner for your Terraform code. Designed to run locally and in your CI pipelines, developer-friendly output and fully documented checks mean detection and remediation can take place as quickly and efficiently as possible. tfsec takes a developer-first approach to scanning your Terraform templates; using static analysis and deep integration with the official HCL parser it ensures that security issues can be detected before your infrastructure changes take effect. ... -
Endpoint Management with Remote Control Built InSave 50% on your first year when you switch from your existing RMM to Splashtop AEM. Automate patching, track inventory, and jump directly into 1-click unattended remote sessions without switching tools.
-
5
frida
Dynamic instrumentation toolkit for developers
Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers. Inject your own scripts into black box processes. Hook any function, spy on crypto APIs or trace private application code, no source code needed. Edit, hit save, and instantly see the results. All without compilation steps or program restarts. Works on Windows, macOS, GNU/Linux, iOS, Android, and QNX. Install the Node.js bindings from npm, grab a Python package from PyPI, or use Frida through its Swift bindings, .NET bindings, Qt/Qml bindings, or C API. ... -
6
FLARE VM
A collection of software installations scripts for Windows systems
...Because security toolchains often clash (DLL versions, signing, privileges), FLARE VM’s packaging handles compatibility issues ahead of time. For investigations involving malware unpacking, sandboxing, static analysis, or code reversing on Windows, the platform dramatically accelerates readiness and consistency across analysts. -
7
kube-score
Kubernetes object analysis with recommendations
Kubernetes object analysis with recommendations for improved reliability and security. kube-score is a tool that does static code analysis of your Kubernetes object definitions. The output is a list of recommendations of what you can improve to make your application more secure and resilient. kube-score is open-source and available under the MIT-license. -
8
PHP dotenv
Loads environment variables automatically
You should never store sensitive credentials in your code. Storing configuration in the environment is one of the tenets of a twelve-factor app. Anything that is likely to change between deployment environments, such as database credentials or credentials for 3rd party services, should be extracted from the code into environment variables. Basically, a .env file is an easy way to load custom configuration variables that your application needs without having to modify .htaccess files or... -
9
MalwareSourceCode
Collection of malware source code for a variety of platforms
MalwareSourceCode is a large archival collection of malware-related source code gathered for research and historical reference. The repository organizes material by platform, programming language, malware family, and technical category. Its directories cover Android, Linux, macOS, legacy Windows, Win32, Java, JavaScript, PHP, Perl, Python, Ruby, and other environments. Collections include proof-of-concept samples, older malware families, analysis-related libraries, phishing pages, and web panels. ... -
One Monitoring Tool for IT, OT and Cloud | Free TrialModern infrastructure spans data centers, cloud platforms and factory floors, and every blind spot between them is a risk. PRTG supports SNMP, WMI, SSH and other standard protocols to monitor IT, OT and hybrid environments through one customizable dashboard. Build the views your team needs, from network health to application performance, without switching tools. Try PRTG free for 30 days now.
-
10
GitHound
Search GitHub for leaked API keys, credentials, and exposed secrets
...It works by combining GitHub search queries (often called “GitHub dorks”) with pattern matching techniques to locate potential secrets across public repositories. Instead of scanning only a limited set of repositories, the tool leverages GitHub’s Code Search API to analyze results from across the entire public GitHub ecosystem, including repositories and Gists. GitHound examines files returned by search queries and applies detection methods such as regex pattern matching, entropy analysis, and contextual evaluation to identify likely credentials. It can also dig into commit history to uncover secrets that may have been removed or reverted but still exist in older revisions. ... -
11
SkillSpector
Security scanner for AI agent skills
SkillSpector is a security scanner built to evaluate AI agent skills before they are installed or trusted. It helps teams inspect skills used by tools such as Claude Code, Codex CLI, and Gemini CLI. The project focuses on detecting vulnerabilities, malicious behavior, and risky patterns that may be hidden inside skill files. It combines fast static checks with optional LLM-based semantic review for issues that require deeper intent analysis. It supports several input types, including Git repositories, URLs, zip files, folders, and individual files. ... -
12
Skitter Creek Bath Salts
Unlocking _everything_ on the CPU with DRAM scrambling
...Its examples examine protected areas associated with the Platform Security Processor, System Management Mode, C6 memory, and CPU microcode. The repository includes kernel code, user-space tooling, example material, collected data, and technical analysis. It is intended for advanced hardware-security research rather than general-purpose system administration. -
13
ModSecurity
Cross platform web application firewall (WAF) engine for Apache
ModSecurity is an open-source, cross-platform web application firewall (WAF) engine for Apache, IIS and Nginx that is developed by Trustwave's SpiderLabs. It has a robust event-based programming language that provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis. Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking in web... -
14
Shannon
Fully autonomous AI hacker to find actual exploits in your web apps
Shannon is an autonomous AI penetration testing system built to find and prove real, exploitable vulnerabilities in web applications rather than stopping at static warnings or best-guess alerts. It focuses on “proof by exploitation,” meaning it actively hunts for attack vectors in your code and then attempts to execute end-to-end exploits to demonstrate impact. The project blends source-aware analysis with automated web interaction so it can validate issues like injection flaws, authentication bypasses, and other exploitable paths in a way that resembles an actual attacker’s workflow. Instead of requiring you to manually reproduce findings, Shannon is designed to produce actionable evidence that a weakness can be weaponized, which helps teams prioritize what truly matters. ... -
15
Metabigor
Command-line OSINT and reconnaissance tool without API keys
Metabigor is a command-line intelligence and OSINT tool designed to perform reconnaissance and security research tasks without requiring API keys. It focuses on simplifying access to public intelligence sources so that researchers, penetration testers, and bug bounty hunters can gather information efficiently from a single interface. It enables users to discover IP ranges, domains, and infrastructure details related to organizations, domains, or autonomous systems. Metabigor integrates... -
16
Wemake Django Template
Bleeding edge django template focused on code quality and security
What this project is all about? The main idea of this project is to provide a fully configured template for django projects, where code quality, testing, documentation, security, and scalability are number one priorities. This template is a result of implementing our processes, it should not be considered as an independent part. When developing this template we had several goals in mind. Development environment should be bootstrapped easily, so we use docker-compose for that. Development... -
17
Al-Khaser
Public malware techniques used in the wild: Virtual Machine, Emulation
al-khaser is an open-source proof-of-concept security tool that deliberately implements techniques commonly used by real-world malware to test and evaluate the effectiveness of antivirus and endpoint detection and response (EDR) systems. It’s written in C/C++ and designed to execute a wide range of anti-analysis, anti-debugging, anti-virtualization, timing-based evasion, and sandbox detection routines so security researchers and defenders can see how well their tools detect or ignore these... -
18
Brakeman
A static analysis security vulnerability scanner for Ruby on Rails app
Brakeman is a free vulnerability scanner specifically designed for Ruby on Rails applications. It statically analyzes Rails application code to find security issues at any stage of development. Brakeman now uses the parallel gem to read and parse files in parallel. By default, parallel will split the reading/parsing into a number of separate processes based on number of CPUs. In testing, this has dramatically improved speed for large code bases, around 35% reduction in overall scan time.... -
19
OWASP MASTG
Manual for mobile app security testing and reverse engineering
OWASP Mobile Application Security Testing Guide (MASTG) is a free, open-source resource that provides comprehensive guidance for testing and evaluating the security of mobile applications. Developed by the Open Worldwide Application Security Project (OWASP), the guide offers practical methodologies, technical instructions, and testing procedures for identifying security vulnerabilities in Android and iOS applications. MASTG covers a wide range of mobile security topics, including data... -
20
A professional PE (Portable Executable) analysis and modification tool for Windows executables and DLLs.
-
21
malware_training_vol1
Materials for Windows Malware Analysis training (volume 1)
...The project also demonstrates how analysis tools can be used to inspect binaries, understand execution behavior, and reason about malicious code. Its main value is giving learners structured practice with real malware-analysis concepts while keeping the content oriented toward research and defense. -
22
nodejsscan
nodejsscan is a static security code scanner for Node.js applications
Static security code scanner (SAST) for Node.js applications powered by libsast and semgrep. nodejsscan is a static security code scanner for Node.js applications. -
23
VisualCodeGrepper V2.3.2
Code security review tool for C/C++, C#, VB, PHP, Java, PL/SQL, COBOL.
VCG is an automated code security review tool for C++, C#, VB, PHP, Java, PL/SQL and COBOL, which is intended to speed up the code review process by identifying bad/insecure code. New beta functionality has been added for R. It has a few features that should make it useful. In addition to performing some more complex checks it also has a config file for each language that basically allows you to add any bad functions (or other text) that you want to search for. It attempts to find... -
24
VX-API
Collection of various malicious functionality
VX-API is a research-oriented collection of Windows-focused code that demonstrates low-level techniques commonly studied in malware analysis and red-team development. It is organized as a Visual Studio solution so related functions and dependencies can be explored together. The repository covers areas such as anti-debugging, cryptographic helpers, fingerprinting, process creation, process injection, networking, library loading, and string handling. -
25
codecat
static code analysis, to find/track sinks and bugs
CodeCat is a open source tool to help you in static code analysis, to find/track sinks and bugs, this points follow regex rules...
