Agentic AI security tool that applies proactive, attacker-first analysis directly to source code.

Self-hosted external attack surface scanner. Subdomain enumeration + takeover detection, ports, CVEs, TLS, SSH, web vulns, EPSS/KEV prioritisation. 19 tools, 12 attack vectors, one `docker run`. MI…

Instant, Concurrent, Secure & Lightweight Sandbox for AI Agents.

A complete bug bounty workspace for HackerOne researchers. Includes scope enforcement, automated recon/vuln pipeline (400+ tools), report templates, CVE/CWE watchlists, and a local VM practice lab.…

The agent that grows with you

The community's most comprehensive, continuously-updated index of research on Large Language Models for software vulnerability detection — papers across function-level, repository-level, agentic, a…

Pure python3 implementation for working with iDevices (iPhone, etc...).

Collaborative forensic timeline analysis

A comprehensive guide to adversarial testing and security evaluation of AI systems, helping organizations identify vulnerabilities before attackers exploit them.

An HTTP toolkit for security research.

A native decompiler app for iOS!

How To approach recon on real targets — from passive enumeration to origin IP discovery. Covers tools, automation, and the logic behind each phase.

Autonomous white-hat security auditor

Deepsec is a security harness for finding vulnerabilities in your codebase powered by coding agents

A fast tool to scan CRLF vulnerability written in Go

Web-aware secrets scanner for code, Git history, URLs, and JavaScript-heavy applications, with crawling and JS intelligence built in.

Offensive knowledge, offline. One search box for every playbook.

Reverse Engineering / Authorized Penetration Testing / Security Research Skill Router Pack AI-powered routing + On-demand toolchain bootstrapping + Self-evolving knowledge base Supports Claude Code…

Very vulnerable ARM/AARCH64 application (CTF style exploitation tutorial with 29 vulnerability techniques)

Anyone who has used Burp Suite Repeater for more than 20 minutes knows the problem. You send request after request, and every tab is named 1, 2, 3... Ten tabs in, you are clicking through each one …

CVE cache of the official CVE List in CVE JSON 5 format

Notify is a Go-based assistance package that enables you to stream the output of several tools (or read from a file) and publish it to a variety of supported platforms.

Your Personal AI super intelligence. Private, Simple and extremely powerful.

A modern HTTP proxy test suite.

EarlyBird is a sensitive data detection tool capable of scanning source code repositories for clear text password violations, PII, outdated cryptography methods, key files and more.

The open and composable observability and data visualization platform. Visualize metrics, logs, and traces from multiple sources like Prometheus, Loki, Elasticsearch, InfluxDB, Postgres and many mo…

Open-source mobile security testing suite for iOS and Android. Previously Passionfruit