An awesome list of OSS developer-first security tools
-
Updated
May 15, 2025
#
developer-security
Here are 33 public repositories matching this topic...
An ongoing & curated collection of awesome software practices and remediation, libraries and frameworks,payloads and techniques, best guidelines and technical resources about Application Security
application application-security web-security security-vulnerability security-hardening appsec vulnerability-scanners security-scanner security-tools web-security-research security-testing endpoint-security mobilesecurity mdm-server developer-security security-advisory
-
Updated
Sep 23, 2023 - Python
Application scanning component of OWASP PurpleTeam
devops ci build-tool application-security web-security hacktoberfest devsecops cloud-security security-testing purpleteam application-scanner security-regression-testing devsecops-pipelin developer-security
-
Updated
Feb 12, 2023 - JavaScript
NEXUS REDFOX — Local-first code intelligence and security analysis platform for developers and security researchers.
python cli open-source static-analysis dependency-analysis code-analysis cybersecurity developer-tools software-analysis software-security security-tools devsecops security-analysis source-code-analysis project-analysis code-intelligence code-security developer-security nexus-redfox
-
Updated
Aug 13, 2026 - Python
Fleet AI Security Posture Management (AI-SPM): client agents on each developer machine score their AI coding agents' guard surfaces (Claude Code, Cursor, Codex, Gemini CLI — permissions, hooks, sandboxes, mcp.json) and ship hash-anchored events to a central server + your SIEM. Fleet-wide posture; measures, doesn't block. Rust.
rust security mcp cybersecurity cursor siem soc codex ai-security endpoint-security detection-engineering developer-security ai-agent prompt-injection gemini-cli claude-code mcp-security ai-coding-agent tool-poisoning ai-spm
-
Updated
Aug 1, 2026 - Rust
TLS scanning component of OWASP PurpleTeam
tls devops ci build-tool application-security web-security hacktoberfest devsecops cloud-security security-testing purpleteam devsecops-pipeline security-regression-testing tls-security developer-security
-
Updated
Feb 8, 2023 - JavaScript
Infrastructure as Code for SUTs
devops ci terraform iac build-tool application-security web-security hacktoberfest sut devsecops cloud-security security-testing purpleteam system-under-test devsecops-pipeline security-regression-testing developer-security
-
Updated
Jun 19, 2022 - HCL
Server scanning component of OWASP PurpleTeam
devops ci build-tool application-security web-security hacktoberfest devsecops cloud-security security-testing purpleteam devsecops-pipeline server-scanner security-regression-testing developer-security
-
Updated
Mar 5, 2023 - JavaScript
Stage Two containers of OWASP PurpleTeam
docker devops ci containers build-tool application-security web-security hacktoberfest devsecops cloud-security security-testing purpleteam devsecops-pipeline security-regression-testing developer-security
-
Updated
Feb 3, 2023 - Shell
AWS Lambda functions of OWASP PurpleTeam
devops lambda ci build-tool application-security web-security hacktoberfest devsecops cloud-security security-testing purpleteam devsecops-pipeline security-regression-testing purpleteam-lambda developer-security
-
Updated
Jul 13, 2022 - JavaScript
How to identify, analyze, and report targeted phishing campaigns on GitHub — with real-world case studies and a step-by-step takedown workflow.
security osint phishing cybersecurity opsec warnings threat-intelligence social-engineering scammers living-off-the-land abuse-reporting phishing-awareness github-security developer-security how-to-secure
-
Updated
Apr 1, 2026
Security scanner for VSIX, MCP, AI IDEs, and developer workflow attack paths.
vsix vscode vscode-extension security-scanner sarif ai-security supply-chain-security developer-security ide-security
-
Updated
May 9, 2026 - Python
Post-compromise forensic tool for developer workstations
python golang incident-response forensics dfir blue-team threat-emulation supply-chain-security developer-security credential-exposure
-
Updated
Jun 9, 2026 - Go
Instructions and materials to run the HIPSTER workshop
-
Updated
Aug 15, 2023
Zero-trust API firewall and security integrity layer for autonomous AI agents & Model Context Protocol (MCP) tool execution. Secure, TOCTOU-proof, fail-closed.
rust application-security python-sdk human-in-the-loop owasp-top-10 ai-agents go-sdk zero-trust security-gateway api-firewall developer-security axum agentic-ai model-context-protocol mcp-security fail-closed soc2-compliance cedar-policy cryptographic-integrity action-receipts
-
Updated
Aug 18, 2026 - Rust
Claude Code skill that hardens package manager configs against supply chain attacks. Run /harden once, it detects what you have and secures it.
package-manager supply-chain-security developer-security dependency-confusion claude-code npm-security claude-code-skill pip-security
-
Updated
Apr 3, 2026
AI-powered vulnerability reporting platform that automates pentest report generation from raw findings into professional, client-ready deliverables.
python ai cybersecurity penetration-testing developer-tools bug-bounty workflow-automation security-tools security-engineering developer-productivity developer-security reporting-pipelines practical-tooling security-productivity
-
Updated
Apr 8, 2026 - HTML
Practical MCP readiness, security and stateless-migration resources for teams moving MCP servers toward enterprise deployment.
oauth security-audit mcp authorization oidc zero-trust machine-identity ai-security runtime-security enterprise-security developer-security model-context-protocol mcp-server mcp-security machine-trust tool-security stateless-mcp mcp-readiness ecz-id mcp-migration
-
Updated
Aug 14, 2026
Official ECZ-ID Agent Trust product and documentation hub. Local-first agent inventory, authority and change inspection for VS Code.
mcp vscode-extension ai-agents zero-trust ai-security local-first open-vsx developer-security agentic-ai agent-security machine-trust ecz-id
-
Updated
Aug 15, 2026 - Python
Practical examples for organisational machine identity, parent-child identity relationships and resolver-first evidence using ECZ-ID Business Passports.
resolver identity mcp provenance trust governance ai-agents authority zero-trust digital-identity machine-identity machine-economy software-identity developer-security business-identity api-identity machine-trust verifiable-evidence ecz-id organizational-identity
-
Updated
Aug 14, 2026
Improve this page
Add a description, image, and links to the developer-security topic page so that developers can more easily learn about it.
Add this topic to your repo
To associate your repository with the developer-security topic, visit your repo's landing page and select "manage topics."