SECURITY

OWASP Nest is a discovery platform that helps people find, explore, and contribute to OWASP — the world's leading nonprofit focused on software security standards and…

why it matters: With 170 contributors and nearly 400 stars, this project signals strong community momentum around making security knowledge more accessible — a…

OpenSSL is the world's most widely used open-source toolkit for securing internet communications — it's the engine behind the padlock icon you see in your browser…

why it matters: With over 30,000 stars and 1,400+ contributors, OpenSSL is foundational infrastructure that nearly every internet product quietly depends on …

This is a free, open-source library of 754 cybersecurity skills designed to teach AI assistants how to think and act like senior security analysts — covering everything…

why it matters: As AI agents take on more autonomous roles in security operations, teams that can plug expert-level security knowledge directly into their AI tools…

CyberStrike is an open-source AI-powered security testing platform that acts like a virtual red team — automatically probing your systems for vulnerabilities the way a…

why it matters: As AI dramatically lowers the cost of cyberattacks, companies that can't afford large security teams are increasingly exposed — and tools like this…

This project maintains a constantly updated blacklist of fraudulent websites that try to steal cryptocurrency from Web3 users by pretending to be legitimate services like…

why it matters: With over 1,200 stars and 440 contributors, this is a community-powered safety layer that MetaMask and other crypto products rely on to protect…

Clawdstrike is a security monitoring and threat detection system specifically designed for fleets of AI agents — the kind used in autonomous workflows where multiple AI…

why it matters: As companies deploy more autonomous AI agents to handle real business tasks, securing those agents becomes a critical and largely unsolved problem …

Wireshark is a free tool that lets you see all the data traveling across a computer network in real time, showing you exactly what information is being sent and received…

why it matters: With nearly 10,000 stars and over 1,700 contributors, Wireshark is the industry-standard tool that security teams, network engineers, and developers…

Brave Core is the engine that powers the Brave browser, a privacy-focused web browser available on both desktop and mobile devices. It builds on top of Google's…

why it matters: With growing consumer demand for privacy and increasing regulatory pressure around data collection, Brave represents a real market shift away from…

OSS-Fuzz is a Google-backed service that automatically stress-tests open source software by bombarding it with massive amounts of random and malformed inputs to uncover…

why it matters: If your product depends on open source libraries (and virtually every modern product does), those libraries carrying undetected security flaws is a…

Ship Safe is a command-line tool that automatically scans your codebase and development pipeline for security vulnerabilities before your software goes live, catching…

why it matters: As AI agents become a core part of modern products, the security risks they introduce are outpacing most teams' ability to catch them manually, and a…

ConfigForge-V2Ray automatically collects, sorts, and updates VPN connection settings from across the internet, then stores them in an organized way on GitHub for easy…

why it matters: Growing demand for censorship circumvention tools — particularly in regions like Iran, Russia, and China — signals a large underserved market where…

HOPR is a privacy-focused network that lets people send data between each other without anyone being able to trace who is communicating with whom, similar to how Tor…

why it matters: As regulators and consumers push harder for data privacy, HOPR represents an infrastructure layer that products could build on to offer genuinely…

SecLists is a massive, organized collection of reference data used by security professionals when testing whether apps, websites, and systems can be hacked — think common…

why it matters: With over 72,000 stars, SecLists is one of the most widely used security testing resources in the world, meaning the attack patterns your product will…

OWASP BLT is an open-source platform that turns security vulnerability reporting into a game, letting communities of testers compete to find and report bugs in websites…

why it matters: Bug bounty programs — where companies pay outside researchers to find security flaws — are typically only accessible to large enterprises with…

Trustee is a security system that verifies the identity and integrity of confidential computing environments — essentially confirming that a remote server or cloud…

why it matters: As confidential computing becomes the standard for handling sensitive workloads in the cloud, builders need infrastructure to prove their systems are…

istio-csr is a security agent that automatically manages and renews digital certificates for applications running on Kubernetes, the popular cloud infrastructure…

why it matters: As companies build more complex cloud applications split across many services, securing the communication between those services becomes a critical…

NodeWarden is a free, self-hosted password manager that you can run entirely on Cloudflare's global network, compatible with all existing Bitwarden apps and browser…

why it matters: As data privacy concerns grow and subscription fatigue sets in, tools that let users own their data while keeping familiar interfaces have strong…

angr is an open-source toolkit that lets researchers and engineers deeply inspect compiled software programs — even without access to the original source code — to…

why it matters: With nearly 9,000 stars and over 300 contributors, angr has become a go-to standard for security research, meaning any product team building security…

cnspec is an open-source security tool that automatically scans your entire infrastructure — from cloud servers and Kubernetes clusters to SaaS products and APIs — to…

why it matters: As companies face growing regulatory pressure and security threats, having automated, continuous security checks baked into the development process is…

Strix is an AI-powered security testing tool that automatically hunts for vulnerabilities in your software the same way a human hacker would — by actually trying to break…

why it matters: Security testing traditionally costs tens of thousands of dollars and takes weeks through manual penetration testing firms, making it inaccessible for…

This is an open-source software toolkit that lets developers embed verified authenticity information into digital media files — photos, videos, and documents — so anyone…

why it matters: As AI-generated content floods the internet, consumers and platforms are demanding proof that media is authentic — and regulators in the EU and US are…

Miden VM is a system that runs computer programs and automatically generates a compact, tamper-proof receipt proving the program ran correctly — without exposing what the…

why it matters: Privacy-preserving computation is becoming a key differentiator for fintech, healthcare, and compliance-heavy products that need to share verified…

3X-UI is an open-source web dashboard that lets you set up and manage your own private internet proxy server, giving individual users control over multiple connection…

why it matters: With over 41,000 stars, this project signals massive demand for self-managed, privacy-focused networking tools — particularly in regions where…

RAPx is an automated safety checker for Rust code that scans programs for bugs and security flaws before they ship, including code written by AI tools like GitHub Copilot…

why it matters: As AI-generated code becomes standard in software development, the risk of shipping subtle, hard-to-detect bugs at scale grows dramatically — RAPx…

Session Desktop is a private messaging app that lets people communicate without revealing their identity or location, similar to Signal but with no central company…

why it matters: As consumer demand for privacy-first communication grows and regulators increase scrutiny of how platforms handle user data, Session represents a new…

Microkit is a toolkit for building software systems on top of seL4, a highly secure operating system kernel that has been mathematically proven to be free of certain…

why it matters: As software increasingly runs critical infrastructure, vehicles, medical devices, and defense systems, demand for provably secure operating…

Caliptra is a security chip project that provides the foundational software running inside modern processors and data center chips, handling the critical process of…

why it matters: With hardware-level security becoming a baseline requirement for cloud providers, enterprise buyers, and government contracts, having open…

WSO2 Identity Server is an open-source platform that handles everything related to who can access your apps and services — including login, single sign-on (one password…

why it matters: Building secure login and user management from scratch is expensive and risky, making a battle-tested open-source solution like this a significant…

This is the central codebase for Ledger Live, the official companion app that lets users manage their crypto, NFTs, and DeFi investments securely through their Ledger…

why it matters: With 257 contributors and hundreds of forks, this project reflects the scale of Ledger's developer ecosystem and its ambition to be the go-to secure…

FreedomBox turns ordinary home hardware into a personal server that you fully control, letting you run your own email, social network, website, and privacy tools without…

why it matters: As privacy regulations tighten and user distrust of centralized platforms grows, there is a real market for self-hosted alternatives — FreedomBox…

Heimdall is a tool from MITRE that lets teams collect, store, and compare results from automated security compliance scans — think of it as a dashboard for understanding…

why it matters: As regulations and security audits become mandatory for selling to enterprises and governments, having a clear, shareable record of your security…

Nuclei Templates is a large, community-built library of pre-written security checks that work with the Nuclei scanning tool to automatically detect vulnerabilities in…

why it matters: With over 12,000 stars and 1,265 contributors, this project signals that automated security scanning is becoming a standard part of how software teams…

OSV Schema is a standardized format for describing security vulnerabilities in open source software, making it easy for both humans and automated systems to understand…

why it matters: For any company shipping software that relies on open source components — which is virtually every tech company today — having a common standard for…

Keycloak is a free, open-source system that handles user login, registration, and access control for apps and services, so builders don't have to build those features…

why it matters: Building secure user authentication from scratch is expensive, time-consuming, and easy to get wrong — Keycloak lets teams skip that work entirely and…

Firezone is an open-source security platform that lets companies control who can access their internal systems and networks, replacing traditional VPNs with a faster…

why it matters: As remote work becomes permanent and data breaches grow more costly, companies need stronger ways to control access to their systems — and the…

dotenvx is a tool that helps software teams securely store and manage the secret passwords, API keys, and configuration settings their apps need to run — across different…

why it matters: Leaked API keys and exposed credentials are one of the most common and costly security mistakes startups make, often leading to data breaches or…

Infosec Streams is a community-maintained directory of cybersecurity content creators who stream live on platforms like Twitch, automatically sorted by how active they…

why it matters: With 92 contributors and over 250 stars, this project shows strong organic community demand for a curated discovery layer in the cybersecurity…

Nono is a security tool that locks AI agents inside an isolated container at the operating system level, so they can only access what you explicitly allow — making it…

why it matters: As companies race to ship AI agents that take real actions in the world, the liability and trust question of 'what can this agent actually do to my…

Metasploit Framework is a widely-used open-source platform that security professionals use to test whether their systems can be hacked — essentially a toolkit for finding…

why it matters: For any founder or product leader building software that handles sensitive data, understanding tools like Metasploit is critical — it's what security…

This project provides automated scripts for creating accounts on AI platforms like OpenAI, Grok (xAI), and Tavily, bypassing normal registration flows using proxy…

why it matters: The popularity of this repo (484 stars, 258 forks) signals strong demand for programmatic access to AI platforms, often driven by users seeking to…

Bisq 2 is an upgraded version of a peer-to-peer platform that lets people buy and sell Bitcoin directly with each other, without any company or middleman in the middle…

why it matters: As regulators increasingly scrutinize centralized crypto exchanges, decentralized trading platforms like Bisq 2 represent a growing alternative market…

This project provides a toolkit for running software inside 'confidential containers' — a special type of secure computing environment where the code and data inside are…

why it matters: As privacy regulations tighten and enterprises grow more cautious about moving sensitive workloads to the cloud, confidential computing is becoming a…

This tool automates bypassing the usage limits and paywalls of Cursor, an AI-powered code editor, by creating fresh accounts and resetting the device fingerprint (a…

why it matters: With nearly 1,400 stars, this project signals significant demand from developers unwilling to pay for AI coding tools — a direct challenge to Cursor's…

Vigil is an open-source AI-powered security operations center that monitors networks and responds to threats at machine speed, using a team of specialized AI agents that…

why it matters: Enterprise security operations is a multi-billion dollar market dominated by opaque, costly vendors, and Vigil offers a credible open-source…

OpenZeppelin Contracts is a free, battle-tested library of pre-built building blocks for creating smart contracts — the self-executing programs that power decentralized…

why it matters: With over 27,000 stars and nearly 500 contributors, OpenZeppelin has become the de facto standard foundation for blockchain product development…

cmctl is a command-line tool that helps developers manage SSL/TLS certificates (the technology that keeps websites and apps secure) within their software infrastructure…

why it matters: As security and compliance requirements grow for software products, tools that simplify certificate management reduce operational overhead and the…

Metatron is a command-line tool that automates the process of probing a website or server for security weaknesses, then uses a locally-running AI model to analyze the…

why it matters: With 2,200+ stars, this project signals strong demand for AI-assisted security testing that keeps sensitive infrastructure data private — a real…

KeePassXC is a free, open-source password manager that securely stores all your passwords, usernames, and sensitive information in an encrypted file on your own device …

why it matters: With nearly 30,000 stars and almost 500 contributors, KeePassXC represents strong market validation for privacy-first, self-hosted alternatives to…

Semgrep is a free, open-source tool that automatically scans your codebase to find bugs, security vulnerabilities, and coding standard violations across 30+ programming…

why it matters: Security and code quality failures are among the most expensive problems a software company can face, and Semgrep gives teams an automated safety net…

authentik is an open-source system that handles user login and identity verification for apps and services, supporting all major sign-on standards so users can log in…

why it matters: As data privacy concerns grow and SaaS costs come under scrutiny, having control over your own identity layer is increasingly a strategic decision …