🔍 ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet, the Google Summer of Code, Azure credits, nexB and other generous sponsors!

OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.

ASH is an extensible, open source SAST, SCA, and IaC security scanner orchestration engine.

A source code static analysis platform for AppSec enthusiasts.

ScanCode.io is a server to script and automate software composition analysis with pipelines. This project is sponsored by the European Commission, NLnet NGI0, the Google Summer of Code, nexB and others generous sponsors!

Vulnerability database and package search for sources such as Linux, OSV, NVD, GitHub and npm. Powered by sqlite, CVE 5.2, purl, and vers.

prancer platform is an IaC Security engine + Continuous Compliance for your cloud (Azure, AWS, GCP) and Kubernetes environment

Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning

Python Elliptic Curve Side-Channel Analysis toolkit.

Automate open source license compliance and ensure software supply chain integrity

This repository contains the container image scanning tool ORCA

用于检测python项目的第三方依赖组件是否存在安全漏洞。

VulnReach builds on standard SCA output by adding reachability context - proving through static analysis, taint tracking, and live runtime coverage which of the detected CVEs can actually be reached in your application.

Лабораторные работы по курсам для AppSec, Risk Analysis, Securty Champion: Toolchain, Orchestration, CI/CD, UML, etc.

Using PyRaider You can scan installed dependencies known security vulnerabilities. It uses publicly known exploits, vulnerabilities database.

Ship AI-generated code without the fear

SupplyShield is an open-source application security orchestration framework designed to secure your software supply chain from vulnerabilities.

QSCAT is a QGIS plugin for shoreline change analysis (SCA).

Discrete signal processing tool for side chanel data leakage attacks and analysis. Air-gapped keylogger PoC.