SECURITY

OpenShell is a safety layer from NVIDIA that lets AI agents take real actions — reading files, installing software, calling external services — while keeping them…

why it matters: As companies race to deploy autonomous AI agents that actually do things rather than just answer questions, controlling what those agents can access…

CyberStrike is an open-source AI-powered security testing platform that acts like a virtual red team — automatically probing your systems for vulnerabilities the way a…

why it matters: As AI dramatically lowers the cost of cyberattacks, companies that can't afford large security teams are increasingly exposed — and tools like this…

OpenSSL is the world's most widely used open-source toolkit for securing internet communications — it's the engine behind the padlock icon you see in your browser…

why it matters: With over 30,000 stars and 1,400+ contributors, OpenSSL is foundational infrastructure that nearly every internet product quietly depends on …

OWASP Nest is a discovery platform that helps people find, explore, and contribute to OWASP — the world's leading nonprofit focused on software security standards and…

why it matters: With 170 contributors and nearly 400 stars, this project signals strong community momentum around making security knowledge more accessible — a…

Ente is a fully open-source cloud storage platform that keeps your files, photos, and passwords completely private by encrypting everything before it leaves your device …

why it matters: With growing consumer distrust of Big Tech handling personal data, Ente shows there's a viable market for privacy-first alternatives to dominant cloud…

Wireshark is a free tool that lets you see all the data traveling across a computer network in real time, showing you exactly what information is being sent and received…

why it matters: With nearly 10,000 stars and over 1,700 contributors, Wireshark is the industry-standard tool that security teams, network engineers, and developers…

This project maintains a continuously updated blacklist of fake and malicious websites that try to steal cryptocurrency from Web3 users by impersonating legitimate…

why it matters: With over 500 contributors and deep integration into MetaMask — one of the most widely used crypto wallets — this list represents a critical trust…

Clawdstrike is a security monitoring and threat detection system specifically designed for fleets of AI agents — the kind used in autonomous workflows where multiple AI…

why it matters: As companies deploy more autonomous AI agents to handle real business tasks, securing those agents becomes a critical and largely unsolved problem …

This project is a Windows tool that helps users in Russia bypass government internet censorship to access blocked services like Discord and YouTube. It works by…

why it matters: With over 34,000 stars, this project signals massive grassroots demand for censorship circumvention tools in restricted markets like Russia — a real…

Tailscale is an open-source networking tool that lets you securely connect devices and servers together over the internet as if they were on the same private network…

why it matters: As remote work and distributed infrastructure become the norm, secure private networking is a must-have for any company managing employees, servers…

SecLists is a massive, organized collection of reference data used by security professionals when testing whether apps, websites, and systems can be hacked — think common…

why it matters: With over 72,000 stars, SecLists is one of the most widely used security testing resources in the world, meaning the attack patterns your product will…

This project is a toolkit that helps AI coding assistants — like Claude, Cursor, and similar tools — automatically set up and use specialized cybersecurity workflows…

why it matters: As AI coding assistants become standard in developer workflows, the ability to plug specialized domain expertise — like cybersecurity — directly into…

Ship Safe is a command-line tool that automatically scans your codebase and development pipeline for security vulnerabilities before your software goes live, catching…

why it matters: As AI agents become a core part of modern products, the security risks they introduce are outpacing most teams' ability to catch them manually, and a…

Brave Core is the engine that powers the Brave browser, a privacy-focused web browser available on both desktop and mobile devices. It builds on top of Google's…

why it matters: With growing consumer demand for privacy and increasing regulatory pressure around data collection, Brave represents a real market shift away from…

Open Policy Agent (OPA) is a tool that lets companies write rules about who can access what — and then enforce those rules consistently across all their software and…

why it matters: As companies scale, managing who has permission to do what becomes a costly, fragmented mess that creates security gaps and compliance headaches — OPA…

Nuclei Templates is a community-maintained library of over 13,000 pre-written security checks that work with the Nuclei scanning tool to automatically detect…

why it matters: With 1,265 contributors and 13,000+ stars, this project signals that automated security scanning is becoming a standard part of how software gets…

HOPR is a privacy-focused network that lets people send data between each other without anyone being able to trace who is communicating with whom, similar to how Tor…

why it matters: As regulators and consumers push harder for data privacy, HOPR represents an infrastructure layer that products could build on to offer genuinely…

OWASP BLT is an open-source platform that turns security vulnerability reporting into a game, letting communities of testers compete to find and report bugs in websites…

why it matters: Bug bounty programs — where companies pay outside researchers to find security flaws — are typically only accessible to large enterprises with…

Trustee is a security system that verifies the identity and integrity of confidential computing environments — essentially confirming that a remote server or cloud…

why it matters: As confidential computing becomes the standard for handling sensitive workloads in the cloud, builders need infrastructure to prove their systems are…

istio-csr is a security agent that automatically manages and renews digital certificates for applications running on Kubernetes, the popular cloud infrastructure…

why it matters: As companies build more complex cloud applications split across many services, securing the communication between those services becomes a critical…

NodeWarden is a free, self-hosted password manager that you can run entirely on Cloudflare's global network, compatible with all existing Bitwarden apps and browser…

why it matters: As data privacy concerns grow and subscription fatigue sets in, tools that let users own their data while keeping familiar interfaces have strong…

cnspec is an open-source security tool that automatically scans your entire infrastructure — from cloud servers and Kubernetes clusters to SaaS products and APIs — to…

why it matters: As companies face growing regulatory pressure and security threats, having automated, continuous security checks baked into the development process is…

KSword is a free, open-source Windows security toolkit that lets users inspect what's really happening deep inside their operating system — detecting hidden malware…

why it matters: As cyber threats grow more sophisticated, there's increasing demand for transparent, auditable security tools — and open-source projects like KSword…

BitGoJS is an open-source software toolkit that lets developers add multi-signature cryptocurrency wallet management to their applications, supporting Bitcoin, Ethereum…

why it matters: For any startup building a crypto product — exchanges, payment apps, custody services — handling digital assets securely is the hardest and…

Keycloak is a free, open-source tool that handles user login and identity for apps and services — think of it as a ready-made system for managing who can access your…

why it matters: Building secure login and user management from scratch is expensive, risky, and time-consuming — Keycloak lets teams skip that work entirely and plug…

Miden VM is a system that runs computer programs and automatically generates a compact, tamper-proof receipt proving the program ran correctly — without exposing what the…

why it matters: Privacy-preserving computation is becoming a key differentiator for fintech, healthcare, and compliance-heavy products that need to share verified…

acme.sh is a free, lightweight tool that automatically obtains and renews SSL/TLS certificates — the digital credentials that enable the padlock icon and secure 'https'…

why it matters: With nearly 48,000 stars and adoption by major platforms like Proxmox, pfSense, and Discourse, acme.sh has become a de facto standard for certificate…

Protobom is a universal translator for Software Bill of Materials (SBOMs) — standardized documents that list every component inside a software product, similar to an…

why it matters: Regulatory pressure (including U.S. executive orders) is making SBOMs mandatory for software sold to governments and enterprises, creating an urgent…

Vault is a centralized system for storing and controlling access to sensitive information — things like passwords, API keys, and security certificates — that modern…

why it matters: For any company building software that handles sensitive data or integrates with third-party services, a breach caused by exposed credentials can be…

Session Desktop is a private messaging app that lets people communicate without revealing their identity or location, similar to Signal but with no central company…

why it matters: As consumer demand for privacy-first communication grows and regulators increase scrutiny of how platforms handle user data, Session represents a new…

Microkit is a toolkit for building software systems on top of seL4, a highly secure operating system kernel that has been mathematically proven to be free of certain…

why it matters: As software increasingly runs critical infrastructure, vehicles, medical devices, and defense systems, demand for provably secure operating…

Caliptra is a security chip project that provides the foundational software running inside modern processors and data center chips, handling the critical process of…

why it matters: With hardware-level security becoming a baseline requirement for cloud providers, enterprise buyers, and government contracts, having open…

WSO2 Identity Server is an open-source platform that handles everything related to who can access your apps and services — including login, single sign-on (one password…

why it matters: Building secure login and user management from scratch is expensive and risky, making a battle-tested open-source solution like this a significant…

This is the central codebase for Ledger Live, the official companion app that lets users manage their crypto, NFTs, and DeFi investments securely through their Ledger…

why it matters: With 257 contributors and hundreds of forks, this project reflects the scale of Ledger's developer ecosystem and its ambition to be the go-to secure…

FreedomBox turns ordinary home hardware into a personal server that you fully control, letting you run your own email, social network, website, and privacy tools without…

why it matters: As privacy regulations tighten and user distrust of centralized platforms grows, there is a real market for self-hosted alternatives — FreedomBox…

OSV Schema is a standardized format for describing security vulnerabilities in open source software, making it easy for both humans and automated systems to understand…

why it matters: For any company shipping software that relies on open source components — which is virtually every tech company today — having a common standard for…

Radare2 is a free, open-source toolkit used by security researchers and developers to tear apart and inspect software programs — examining how they work at their most…

why it matters: For founders building in cybersecurity, vulnerability research, or software integrity verification, radare2 represents a battle-tested foundation with…

dotenvx is a tool that helps software teams securely store and manage the secret passwords, API keys, and configuration settings their apps need to run — across different…

why it matters: Leaked API keys and exposed credentials are one of the most common and costly security mistakes startups make, often leading to data breaches or…

Sliver is an open-source tool that lets security teams simulate real-world cyberattacks against their own organizations to find weaknesses before actual hackers do. It…

why it matters: With nearly 12,000 stars and a growing contributor base, Sliver has become a go-to standard for professional security testing, meaning any company…

Infosec Streams is a community-maintained directory of cybersecurity content creators who stream live on platforms like Twitch, automatically sorted by how active they…

why it matters: With 92 contributors and over 250 stars, this project shows strong organic community demand for a curated discovery layer in the cybersecurity…

Nono is a security tool that locks AI agents inside an isolated container at the operating system level, so they can only access what you explicitly allow — making it…

why it matters: As companies race to ship AI agents that take real actions in the world, the liability and trust question of 'what can this agent actually do to my…

Xray-core is an open-source networking tool that lets users route their internet traffic through encrypted tunnels, bypassing censorship and surveillance in restrictive…

why it matters: With nearly 40,000 stars and an active contributor base, this project signals massive demand for privacy and censorship-circumvention infrastructure…

This is an open-source software toolkit that lets developers embed verified authenticity information into digital media files — photos, videos, and documents — so anyone…

why it matters: As AI-generated content floods the internet, consumers and platforms are demanding proof that media is authentic — and regulators in the EU and US are…

The OWASP Web Security Testing Guide is a free, community-built playbook that tells you exactly how to check whether a website or web app has security vulnerabilities…

why it matters: For any founder or PM shipping a web product, using an industry-standard security framework like this can mean the difference between passing…

Strix is an AI-powered security testing tool that automatically hunts for vulnerabilities in your software the same way a human hacker would — by actually trying to break…

why it matters: Security testing traditionally costs tens of thousands of dollars and takes weeks through manual penetration testing firms, making it inaccessible for…

HackTricks is a comprehensive, community-built knowledge base that documents hundreds of real-world hacking techniques, security vulnerabilities, and penetration testing…

why it matters: With over 11,000 stars and backing from major cybersecurity firms, HackTricks has become a go-to reference in the security industry, signaling strong…

3X-UI is an open-source web dashboard that lets you set up and manage your own private internet proxy server, giving individual users control over multiple connection…

why it matters: With over 41,000 stars, this project signals massive demand for self-managed, privacy-focused networking tools — particularly in regions where…

This project provides automated scripts for creating accounts on AI platforms like OpenAI, Grok (xAI), and Tavily, bypassing normal registration flows using proxy…

why it matters: The popularity of this repo (484 stars, 258 forks) signals strong demand for programmatic access to AI platforms, often driven by users seeking to…

Bisq 2 is an upgraded version of a peer-to-peer platform that lets people buy and sell Bitcoin directly with each other, without any company or middleman in the middle…

why it matters: As regulators increasingly scrutinize centralized crypto exchanges, decentralized trading platforms like Bisq 2 represent a growing alternative market…

This project provides a toolkit for running software inside 'confidential containers' — a special type of secure computing environment where the code and data inside are…

why it matters: As privacy regulations tighten and enterprises grow more cautious about moving sensitive workloads to the cloud, confidential computing is becoming a…