Offensive security drives defensive security. We're sharing a collection of SaaS attack techniques to help defenders understand the threats they face. #nolockdown

The OpenTF Manifesto expresses concern over HashiCorp's switch of the Terraform license from open-source to the Business Source License (BSL) and calls for the tool's return to a truly open-source …

Production-ready detection & response queries for osquery

List of vendors that do not allow IMDSv2 enforcement

SSH-MITM - ssh audits made simple

Open source vulnerability DB and triage service.

A Python library and command line interface for CVE Services.

The OpenSSF Vulnerability Disclosures Working Group seeks to help improve the overall security of the open source software ecosystem by helping mature and advocate well-managed vulnerability report…

Automatically create animated gifs for scrolling down webpages

A database of PHP security advisories

Tfsec is now part of Trivy

Terraform module for creating alarms for tracking important changes and occurrences from cloudtrail.

Command line tool to generate a FedRAMP compliant inventory of AWS resources

This repository contains a sample script which can be used to enable security vulnerability alerts in all of the repositories in a given organization.

Dlint is a tool for encouraging best coding practices and helping ensure we're writing secure Python code.

A curated database of insecure Python packages

Generates system-specific repositories to be added in configuration file for silently updating all packages via unattended upgrades.

Transparent SSL/TLS interception

Security advisories for Node.js and the JavaScript ecosystem.

Source code for Hacker101.com - a free online web and mobile security class.

Advanced vulnerability scanning with Nmap NSE

This Ansible collection provides battle tested hardening for Linux, SSH, nginx, MySQL

Node.js Ecosystem Security Working Group

Allows any URL to be loaded as a fullscreen kiosk.

Ship your enterprise Cloudflare logs to Sumo Logic using AWS Lambda

Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation

Solicitation and acquisition documents created for the TTS Bug Bounty program that can be reused by other government agencies and organizations.

The vulnerability disclosure policy for 18F and GSA's Technology Transformation Service.

Verify the configuration of your OS X machine.