Starred repositories
⚙️ A curated list of static analysis (SAST) tools and linters for all programming languages, config files, build tools, and more. The focus is on tools which improve code quality.
A plugin for Jekyll to generate a feed in ActivityPub format
A suite of utilities to help with software supply chain challenges on nix targets
GemGuard is your one-stop solution for Ruby supply chain security. Detect vulnerabilities, identify typosquats, generate SBOMs, and secure your dependencies with enterprise-grade tooling designed f…
Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.
mmdb-server is an open source fast API server to lookup IP addresses for their geographic location.
Code and data used to create the examples in "Evidence-based Software Engineering based on the publicly available data"
Issue handling for Evidence-based Software Engineering: based on the publicly available data
🔎 Static code analysis engine to find security issues in code.
Converted security rules fromcodeql to semgrep format.
1
Updated Dec 21, 2025
trevorwinser / advisories
Forked from ecosyste-ms/advisoriesAn open API service providing security vulnerability metadata for many open source software ecosystems.
ripgrep recursively searches directories for a regex pattern while respecting your gitignore
Manager of 14 third-party sources comprising approximately 4,000 Semgrep rules 🗂
Repository to support analyzing energy system design models based on data
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
A curated dataset of known package typosquats from public security research. Maps malicious packages to their legitimate targets with ecosystem, classification, and source attribution.
fuzz parameter generator from json-schema
🌴 TreeHaver is a cross-Ruby adapter for the tree-sitter & citrus parsing libraries; supporting MRI Ruby, JRuby, & TruffleRuby. Provides unified parsing API & AST when using ruby_tree_sitter, citrus…
Detect potential typosquatting packages across package ecosystems
Generate and verify lockfiles for GitHub Actions dependencies.
🌉 A bridge between decentralized social networks
🍺 Alcoholless: lightweight security sandbox for Homebrew (and others)