Top 100 security Repositories
Ranking
| Ranking | Project Name | Stars | Forks | Language | Open Issues | Description | Last Commit |
|---|---|---|---|---|---|---|---|
| 1 | ECC | 272,384 | 40,670 | JavaScript | 85 | The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond. | 2026-10-02 |
| 2 | the-book-of-secret-knowledge | 247,718 | 14,447 | - | 0 | A collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools and more. | 2024-11-19 |
| 3 | Awesome-Hacking | 121,804 | 10,803 | - | 0 | A collection of various awesome lists for hackers, pentesters and security researchers | 2026-07-26 |
| 4 | cs-video-courses | 83,604 | 11,495 | - | 0 | List of Computer Science courses with video lectures. | 2026-09-27 |
| 5 | PayloadsAllTheThings | 81,446 | 17,437 | Python | 0 | A list of useful payloads and bypass for Web Application Security and Pentest/CTF | 2026-08-27 |
| 6 | caddy | 76,264 | 5,029 | Go | 198 | Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS | 2026-10-03 |
| 7 | SecLists | 73,920 | 25,142 | PHP | 8 | SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensi... | 2026-10-03 |
| 8 | union | 73,781 | 3,885 | Rust | 129 | The trust-minimized, zero-knowledge bridging protocol, designed for censorship resistance, extremely high security, and usage in decentralized finance. | 2026-07-25 |
| 9 | strix | 66,377 | 7,275 | Python | 179 | Open-source AI penetration testing tool to find and fix your app’s vulnerabilities. | 2026-10-04 |
| 10 | gatsby | 55,942 | 10,109 | JavaScript | 217 | React-based framework with performance, scalability, and security built in. | 2026-10-03 |
| 11 | Docker-OSX | 52,950 | 2,885 | Shell | 397 | Run macOS VM in a Docker! Run near native OSX-KVM in Docker! X11 Forwarding! CI/CD for OS X Security Research! Docker mac Containers. | 2025-11-11 |
| 12 | x64dbg | 49,684 | 2,851 | C++ | 565 | An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis. | 2026-10-01 |
| 13 | shannon | 48,562 | 5,563 | TypeScript | 9 | Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production. | 2026-10-01 |
| 14 | mitmproxy | 45,254 | 4,759 | Python | 370 | An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers. | 2026-10-03 |
| 15 | sniffnet | 41,326 | 1,961 | Rust | 52 | Comfortably monitor your network traffic 🕵️♂️ | 2026-10-03 |
| 16 | quivr | 39,579 | 3,739 | Python | 9 | Opiniated RAG for integrating GenAI in your apps 🧠 Focus on your product rather than the RAG. Easy integration in existing products with customisation! Any LLM: GPT4, Groq, Llama. Any Vectorstore:... | 2026-08-31 |
| 17 | reverse-skill | 39,548 | 5,513 | PowerShell | 11 | Reverse Engineering / Authorized Penetration Testing / Security Research Skill Router Pack AI-powered routing + On-demand toolchain bootstrapping + Self-evolving knowledge base Supports Claude Code, ... | 2026-09-22 |
| 18 | trivy | 38,211 | 723 | Go | 170 | Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more | 2026-10-02 |
| 19 | web-check | 34,996 | 2,871 | TypeScript | 1 | 🕵️♂️ All-in-one OSINT tool for analysing any website | 2026-10-02 |
| 20 | Anthropic-Cybersecurity-Skills | 33,761 | 4,089 | Python | 22 | 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with... | 2026-08-31 |
| 21 | CheatSheetSeries | 33,412 | 4,652 | JavaScript | 1 | The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics. | 2026-10-03 |
| 22 | nginx | 31,787 | 8,311 | C | 193 | The official NGINX Open Source repository. | 2026-09-30 |
| 23 | How-To-Secure-A-Linux-Server | 31,755 | 2,144 | - | 33 | An evolving how-to guide for securing a Linux server. | 2026-09-07 |
| 24 | nuclei | 31,702 | 3,907 | Go | 65 | Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the int... | 2026-10-02 |
| 25 | hosts | 31,158 | 2,437 | Python | 155 | 🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories. | 2026-10-02 |
| 26 | nanoclaw | 30,876 | 12,783 | TypeScript | 286 | A lightweight alternative to OpenClaw that runs in containers for security. Connects to WhatsApp, Telegram, Slack, Discord, Gmail and other messaging apps,, has memory, scheduled jobs, and runs direct... | 2026-10-04 |
| 27 | algo | 30,406 | 2,366 | Python | 74 | Set up a personal VPN in the cloud | 2026-10-01 |
| 28 | ProxmoxVE | 29,721 | 2,914 | Shell | 11 | Proxmox VE Helper-Scripts (Community Edition) | 2026-10-04 |
| 29 | gitleaks | 29,644 | 2,264 | Go | 272 | Find secrets with Gitleaks 🔑 | 2026-09-30 |
| 30 | h4cker | 29,608 | 5,394 | Jupyter Notebook | 1 | This repository is maintained by Omar Santos (@santosomar) and includes thousands of resources related to ethical hacking, bug bounties, digital forensics and incident response (DFIR), AI security, vu... | 2026-09-29 |
| 31 | infisical | 29,590 | 2,306 | TypeScript | 265 | Infisical is the open-source platform for secrets, certificates, and privileged access management. | 2026-10-04 |
| 32 | authelia | 29,165 | 1,501 | Go | 57 | The Single Sign-On Multi-Factor portal for web apps. OpenID Certified™ and Post-Quantum Cryptography Ready. | 2026-10-04 |
| 33 | keepassxc | 29,071 | 1,925 | C++ | 784 | KeePassXC is a cross-platform community-driven port of the Windows application “KeePass Password Safe”. | 2026-09-30 |
| 34 | SpringAll | 28,946 | 8,076 | Java | 21 | 循序渐进，学习Spring Boot、Spring Boot & Shiro、Spring Batch、Spring Cloud、Spring Cloud Alibaba、Spring Security & Spring Security OAuth2，博客Spring系列源码：https://mrbird.cc | 2024-05-31 |
| 35 | setup-ipsec-vpn | 28,638 | 6,518 | Shell | 0 | Set up your own IPsec VPN server in just a few minutes, with IPsec/L2TP, Cisco IPsec and IKEv2. Supports Ubuntu, Debian, CentOS/RHEL, Alpine Linux and Raspberry Pi OS. Includes client config and manag... | 2026-09-21 |
| 36 | nginxconfig.io | 28,269 | 2,028 | JavaScript | 62 | ⚙️ NGINX config generator on steroids 💉 | 2024-12-14 |
| 37 | trufflehog | 28,266 | 2,619 | Go | 273 | Find, verify, and analyze leaked credentials | 2026-10-03 |
| 38 | openzeppelin-contracts | 27,265 | 12,394 | Solidity | 215 | OpenZeppelin Contracts is a library for secure smart contract development. | 2026-10-01 |
| 39 | authentik | 25,828 | 2,057 | Python | 751 | The authentication glue you need. | 2026-10-04 |
| 40 | cilium | 25,598 | 4,124 | Go | 841 | eBPF-based Networking, Security, and Observability | 2026-10-04 |
| 41 | radare2 | 24,918 | 3,335 | C | 732 | UNIX-like reverse engineering framework and command-line toolset | 2026-10-04 |
| 42 | security-audit-skill | 23,951 | 1,417 | JavaScript | 20 | A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings | 2026-09-14 |
| 43 | osquery | 23,608 | 2,607 | C++ | 515 | SQL powered operating system instrumentation, monitoring, and analytics. | 2026-10-02 |
| 44 | slim | 23,423 | 846 | Go | 188 | Slim(toolkit): Don't change anything in your container image and minify it by up to 30x (and for compiled languages even more) making it secure too! (free and open source) | 2026-09-19 |
| 45 | API-Security-Checklist | 23,331 | 2,645 | - | 1 | Checklist of the most important security countermeasures when designing, testing, and releasing your API | 2026-07-21 |
| 46 | sops | 23,283 | 1,088 | Go | 377 | Simple and flexible tool for managing secrets | 2026-09-28 |
| 47 | anubis | 23,043 | 745 | Go | 313 | Weighs the soul of incoming HTTP requests to stop AI crawlers | 2026-09-30 |
| 48 | pangolin | 22,997 | 794 | TypeScript | 68 | Modern networking and security platform providing secure access and connectivity to apps, infrastructure, and AI workloads. Connect and protect your users. | 2026-10-02 |
| 49 | SafeLine | 22,701 | 1,544 | Go | 72 | SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits. | 2026-09-28 |
| 50 | macOS-Security-and-Privacy-Guide | 22,535 | 1,463 | Shell | 5 | Community guide to securing and improving privacy on macOS. | 2026-10-01 |
| 51 | personal-security-checklist | 22,451 | 1,476 | TypeScript | 38 | 🔒 A compiled checklist of 300+ tips for protecting digital security and privacy in 2026 | 2026-10-01 |
| 52 | matomo | 21,919 | 2,903 | PHP | 2407 | Empowering People Ethically 🚀 — Matomo is hiring! Join us → https://matomo.org/jobs Matomo is the leading open-source alternative to Google Analytics, giving you complete control and built-in privacy... | 2026-10-04 |
| 53 | eladmin | 21,906 | 7,330 | Java | 24 | eladmin jpa 版本：项目基于 Spring Boot 2.7.18、 Jpa、 Spring Security、Redis、Vue的前后端分离的后台管理系统，项目采用分模块开发方式， 权限控制采用 RBAC，支持数据字典与数据权限管理，支持一键生成前后端代码，支持动态路由 | 2026-05-09 |
| 54 | mimikatz | 21,882 | 4,176 | C | 155 | A little tool to play with Windows security | 2026-04-17 |
| 55 | Mobile-Security-Framework-MobSF | 21,873 | 3,777 | JavaScript | 9 | Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and ... | 2026-09-30 |
| 56 | chezmoi | 21,810 | 693 | Go | 56 | Manage your dotfiles across multiple diverse machines, securely. | 2026-10-02 |
| 57 | Atlas | 21,745 | 760 | Batchfile | 9 | 🚀 An open and lightweight modification to Windows, designed to optimize performance, privacy and usability. | 2026-10-03 |
| 58 | security-guide-for-developers | 21,096 | 1,570 | - | 0 | Security Guide for Developers | 2025-08-30 |
| 59 | teleport | 20,963 | 2,169 | Go | 2722 | The easiest, and most secure way to access and protect all of your infrastructure. | 2026-09-17 |
| 60 | shardingsphere | 20,805 | 6,904 | Java | 178 | Empowering Data Intelligence with Distributed SQL for Sharding, Scalability, and Security Across All Databases. | 2026-10-04 |
| 61 | RustScan | 20,496 | 1,387 | Rust | 13 | 🤖 The Modern Port Scanner 🤖 | 2026-10-03 |
| 62 | Obtainium | 20,174 | 619 | Dart | 376 | Get Android app updates straight from the source. | 2026-09-13 |
| 63 | DB-GPT | 20,077 | 2,947 | Python | 375 | open-source agentic AI data assistant for the next generation of AI + Data products. | 2026-10-03 |
| 64 | bettercap | 20,074 | 1,727 | Go | 43 | The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks. | 2026-08-13 |
| 65 | universal-android-debloater | 20,011 | 1,061 | Rust | 512 | Cross-platform GUI written in Rust using ADB to debloat non-rooted android devices. Improve your privacy, the security and battery life of your device. | 2024-08-02 |
| 66 | cutter | 19,860 | 1,478 | C++ | 469 | Free and Open Source Reverse Engineering Platform powered by rizin | 2026-09-11 |
| 67 | 90DaysOfCyberSecurity | 19,774 | 2,265 | - | 5 | This repository contains a 90-day cybersecurity study plan, along with resources and materials for learning various cybersecurity concepts and technologies. The plan is organized into daily tasks, cov... | 2026-09-06 |
| 68 | simplex-chat | 19,514 | 1,361 | Haskell | 1010 | SimpleX - the first messaging network operating without user identifiers of any kind - 100% private by design! iOS, Android and desktop apps 📱! | 2026-10-03 |
| 69 | SkillSpector | 19,305 | 1,687 | Python | 73 | Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills befo... | 2026-10-02 |
| 70 | fail2ban | 18,711 | 1,500 | Python | 163 | Daemon to ban hosts that cause multiple authentication errors | 2026-09-28 |
| 71 | nebula | 18,410 | 1,191 | Go | 55 | A scalable overlay networking tool with a focus on performance, simplicity and security | 2026-10-02 |
| 72 | CS-Interview-Knowledge-Map | 18,230 | 2,526 | - | 29 | Build the best interview map. The current content includes JS, network, browser related, performance optimization, security, framework, Git, data structure, algorithm, etc. | 2020-05-03 |
| 73 | hydra | 17,587 | 1,607 | Go | 59 | Internet-scale OpenID Certified™ OpenID Connect and OAuth2.1 provider that integrates with your user management through headless APIs. Solve OIDC/OAuth2 user cases over night. Consume as a service on ... | 2026-07-29 |
| 74 | DOMPurify | 17,433 | 860 | JavaScript | 0 | DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo: | 2026-10-03 |
| 75 | wazuh | 17,082 | 2,522 | C++ | 2947 | Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads. | 2026-10-03 |
| 76 | lynis | 16,427 | 1,635 | Shell | 172 | Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional. | 2026-09-16 |
| 77 | javascript-obfuscator | 16,282 | 1,742 | TypeScript | 15 | A powerful obfuscator for JavaScript and Node.js | 2026-10-04 |
| 78 | cryptomator | 16,243 | 1,546 | Java | 276 | Cryptomator for Windows, macOS, and Linux: Secure client-side encryption for your cloud storage, ensuring privacy and control over your data. | 2026-10-01 |
| 79 | systeminformer | 16,155 | 1,795 | C | 283 | A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc. @ https://windows-internals.com | 2026-10-03 |
| 80 | zaproxy | 15,866 | 2,654 | Java | 804 | The ZAP by Checkmarx Core project | 2026-10-01 |
| 81 | hacker-roadmap | 15,631 | 1,715 | - | 2 | A collection of hacking tools, resources and references to practice ethical hacking. | 2023-10-16 |
| 82 | mvt | 15,195 | 1,435 | Python | 27 | MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise. | 2026-09-30 |
| 83 | crowdsec | 15,060 | 725 | Go | 226 | Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs. | 2026-10-02 |
| 84 | awesome-security | 14,931 | 2,417 | - | 34 | A collection of awesome software, libraries, documents, books, resources and cools stuffs about security. | 2026-01-11 |
| 85 | prowler | 14,928 | 2,416 | Python | 157 | Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment. | 2026-10-03 |
| 86 | dirsearch | 14,920 | 2,453 | Python | 14 | Web path scanner | 2026-10-04 |
| 87 | wifiphisher | 14,875 | 2,745 | Python | 336 | The Rogue Access Point Framework | 2026-05-22 |
| 88 | openvpn | 14,635 | 3,405 | C | 180 | OpenVPN is an open source VPN daemon | 2026-10-03 |
| 89 | fscan | 14,618 | 1,949 | Go | 12 | 一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning) | 2026-10-01 |
| 90 | hacker101 | 14,563 | 2,663 | SCSS | 0 | Source code for Hacker101.com - a free online web and mobile security class. | 2025-02-22 |
| 91 | bytebase | 14,536 | 988 | Go | 149 | Database governance built for humans and agents — controlling changes and access across every major database. | 2026-10-03 |
| 92 | nginx-admins-handbook | 14,315 | 1,138 | Shell | 3 | How to improve NGINX performance, security, and other important things. | 2024-11-19 |
| 93 | gophish | 14,290 | 2,976 | Go | 676 | Open-Source Phishing Toolkit | 2024-09-23 |
| 94 | opensnitch | 14,118 | 674 | Python | 173 | OpenSnitch is a GNU/Linux interactive application firewall inspired by Little Snitch. | 2026-07-26 |
| 95 | zuul | 14,083 | 2,440 | Java | 2 | Zuul is a gateway service that provides dynamic routing, monitoring, resiliency, security, and more. | 2026-10-01 |
| 96 | juice-shop | 14,019 | 19,878 | TypeScript | 3 | OWASP Juice Shop: Probably the most modern and sophisticated insecure web application | 2026-09-30 |
| 97 | opennhp | 13,940 | 2,484 | Go | 10 | A lightweight, cryptography-powered, open-source toolkit built to enforce Zero Trust security for infrastructure, applications, and data in the AI-driven world. | 2026-10-04 |
| 98 | awesome-web-security | 13,846 | 1,823 | Python | 1 | 🐶 A curated list of Web Security materials and resources. | 2026-09-14 |
| 99 | DVWA | 13,768 | 5,162 | PHP | 3 | Damn Vulnerable Web Application (DVWA) | 2026-10-01 |
| 100 | GTFOBins.github.io | 13,726 | 1,696 | YAML | 6 | GTFOBins is a curated list of Unix-like executables that can be used to bypass local security restrictions in misconfigured systems. | 2026-05-27 |