Top 100 security Repositories
Ranking
| Ranking | Project Name | Stars | Forks | Language | Open Issues | Description | Last Commit |
|---|---|---|---|---|---|---|---|
| 1 | ECC | 259,454 | 38,812 | JavaScript | 67 | The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond. | 2026-09-15 |
| 2 | the-book-of-secret-knowledge | 244,013 | 14,337 | - | 0 | A collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools and more. | 2024-11-19 |
| 3 | Awesome-Hacking | 120,496 | 10,749 | - | 0 | A collection of various awesome lists for hackers, pentesters and security researchers | 2026-07-26 |
| 4 | cs-video-courses | 83,508 | 11,488 | - | 0 | List of Computer Science courses with video lectures. | 2026-09-11 |
| 5 | PayloadsAllTheThings | 80,892 | 17,375 | Python | 0 | A list of useful payloads and bypass for Web Application Security and Pentest/CTF | 2026-08-27 |
| 6 | caddy | 75,770 | 4,963 | Go | 200 | Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS | 2026-09-14 |
| 7 | union | 73,800 | 3,881 | Rust | 128 | The trust-minimized, zero-knowledge bridging protocol, designed for censorship resistance, extremely high security, and usage in decentralized finance. | 2026-07-25 |
| 8 | SecLists | 73,544 | 25,115 | PHP | 8 | SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensi... | 2026-09-15 |
| 9 | strix | 62,820 | 6,867 | Python | 170 | Open-source AI penetration testing tool to find and fix your app’s vulnerabilities. | 2026-09-15 |
| 10 | gatsby | 55,941 | 10,116 | JavaScript | 218 | React-based framework with performance, scalability, and security built in. | 2026-09-16 |
| 11 | Docker-OSX | 52,924 | 2,885 | Shell | 397 | Run macOS VM in a Docker! Run near native OSX-KVM in Docker! X11 Forwarding! CI/CD for OS X Security Research! Docker mac Containers. | 2025-11-11 |
| 12 | x64dbg | 49,520 | 2,840 | C++ | 570 | An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis. | 2026-09-14 |
| 13 | shannon | 48,044 | 5,503 | TypeScript | 6 | Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production. | 2026-09-08 |
| 14 | mitmproxy | 45,067 | 4,729 | Python | 372 | An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers. | 2026-09-10 |
| 15 | sniffnet | 41,126 | 1,959 | Rust | 52 | Comfortably monitor your network traffic 🕵️♂️ | 2026-09-15 |
| 16 | quivr | 39,528 | 3,733 | Python | 10 | Opiniated RAG for integrating GenAI in your apps 🧠 Focus on your product rather than the RAG. Easy integration in existing products with customisation! Any LLM: GPT4, Groq, Llama. Any Vectorstore:... | 2026-08-31 |
| 17 | trivy | 37,933 | 686 | Go | 172 | Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more | 2026-09-15 |
| 18 | reverse-skill | 36,051 | 4,967 | PowerShell | 4 | Reverse Engineering / Authorized Penetration Testing / Security Research Skill Router Pack AI-powered routing + On-demand toolchain bootstrapping + Self-evolving knowledge base Supports Claude Code, ... | 2026-09-03 |
| 19 | web-check | 34,824 | 2,852 | TypeScript | 5 | 🕵️♂️ All-in-one OSINT tool for analysing any website | 2026-09-14 |
| 20 | CheatSheetSeries | 33,186 | 4,622 | Python | 37 | The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics. | 2026-09-15 |
| 21 | Anthropic-Cybersecurity-Skills | 32,829 | 3,963 | Python | 21 | 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with... | 2026-08-31 |
| 22 | nginx | 31,652 | 8,301 | C | 227 | The official NGINX Open Source repository. | 2026-09-15 |
| 23 | How-To-Secure-A-Linux-Server | 31,425 | 2,120 | - | 32 | An evolving how-to guide for securing a Linux server. | 2026-09-07 |
| 24 | nuclei | 31,229 | 3,869 | Go | 60 | Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the int... | 2026-09-15 |
| 25 | hosts | 31,065 | 2,440 | Python | 149 | 🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories. | 2026-09-14 |
| 26 | nanoclaw | 30,781 | 12,834 | TypeScript | 357 | A lightweight alternative to OpenClaw that runs in containers for security. Connects to WhatsApp, Telegram, Slack, Discord, Gmail and other messaging apps,, has memory, scheduled jobs, and runs direct... | 2026-09-15 |
| 27 | algo | 30,383 | 2,364 | Python | 70 | Set up a personal VPN in the cloud | 2026-09-09 |
| 28 | ProxmoxVE | 29,598 | 2,887 | Shell | 15 | Proxmox VE Helper-Scripts (Community Edition) | 2026-09-16 |
| 29 | h4cker | 29,434 | 5,367 | Jupyter Notebook | 1 | This repository is maintained by Omar Santos (@santosomar) and includes thousands of resources related to ethical hacking, bug bounties, digital forensics and incident response (DFIR), AI security, vu... | 2026-09-12 |
| 30 | gitleaks | 29,336 | 2,236 | Go | 267 | Find secrets with Gitleaks 🔑 | 2026-09-09 |
| 31 | infisical | 29,279 | 2,258 | TypeScript | 259 | Infisical is the open-source platform for secrets, certificates, and privileged access management. | 2026-09-16 |
| 32 | authelia | 28,983 | 1,482 | Go | 59 | The Single Sign-On Multi-Factor portal for web apps. OpenID Certified™ and Post-Quantum Cryptography Ready. | 2026-09-16 |
| 33 | SpringAll | 28,941 | 8,083 | Java | 21 | 循序渐进，学习Spring Boot、Spring Boot & Shiro、Spring Batch、Spring Cloud、Spring Cloud Alibaba、Spring Security & Spring Security OAuth2，博客Spring系列源码：https://mrbird.cc | 2024-05-31 |
| 34 | keepassxc | 28,817 | 1,909 | C++ | 786 | KeePassXC is a cross-platform community-driven port of the Windows application “KeePass Password Safe”. | 2026-09-15 |
| 35 | setup-ipsec-vpn | 28,497 | 6,514 | Shell | 0 | Set up your own IPsec VPN server in just a few minutes, with IPsec/L2TP, Cisco IPsec and IKEv2. Supports Ubuntu, Debian, CentOS/RHEL, Alpine Linux and Raspberry Pi OS. Includes client config and manag... | 2026-09-14 |
| 36 | nginxconfig.io | 28,260 | 2,027 | JavaScript | 62 | ⚙️ NGINX config generator on steroids 💉 | 2024-12-14 |
| 37 | trufflehog | 27,937 | 2,579 | Go | 267 | Find, verify, and analyze leaked credentials | 2026-09-16 |
| 38 | openzeppelin-contracts | 27,242 | 12,401 | Solidity | 241 | OpenZeppelin Contracts is a library for secure smart contract development. | 2026-09-15 |
| 39 | authentik | 25,570 | 2,019 | Python | 759 | The authentication glue you need. | 2026-09-16 |
| 40 | cilium | 25,149 | 4,059 | Go | 818 | eBPF-based Networking, Security, and Observability | 2026-09-16 |
| 41 | radare2 | 24,809 | 3,319 | C | 752 | UNIX-like reverse engineering framework and command-line toolset | 2026-09-16 |
| 42 | osquery | 23,570 | 2,596 | C++ | 588 | SQL powered operating system instrumentation, monitoring, and analytics. | 2026-09-15 |
| 43 | slim | 23,411 | 839 | Go | 188 | Slim(toolkit): Don't change anything in your container image and minify it by up to 30x (and for compiled languages even more) making it secure too! (free and open source) | 2026-08-02 |
| 44 | API-Security-Checklist | 23,317 | 2,649 | - | 1 | Checklist of the most important security countermeasures when designing, testing, and releasing your API | 2026-07-21 |
| 45 | sops | 23,136 | 1,080 | Go | 376 | Simple and flexible tool for managing secrets | 2026-09-14 |
| 46 | pangolin | 22,763 | 783 | TypeScript | 77 | Modern networking and security platform providing secure access and connectivity to apps, infrastructure, and AI workloads. Connect and protect your users. | 2026-09-16 |
| 47 | SafeLine | 22,600 | 1,531 | Go | 69 | SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits. | 2026-09-10 |
| 48 | macOS-Security-and-Privacy-Guide | 22,526 | 1,462 | Shell | 6 | Community guide to securing and improving privacy on macOS. | 2026-09-16 |
| 49 | anubis | 22,454 | 721 | Go | 309 | Weighs the soul of incoming HTTP requests to stop AI crawlers | 2026-09-14 |
| 50 | personal-security-checklist | 22,326 | 1,466 | TypeScript | 48 | 🔒 A compiled checklist of 300+ tips for protecting digital security and privacy in 2026 | 2026-09-07 |
| 51 | eladmin | 21,911 | 7,336 | Java | 20 | eladmin jpa 版本：项目基于 Spring Boot 2.7.18、 Jpa、 Spring Security、Redis、Vue的前后端分离的后台管理系统，项目采用分模块开发方式， 权限控制采用 RBAC，支持数据字典与数据权限管理，支持一键生成前后端代码，支持动态路由 | 2026-05-09 |
| 52 | matomo | 21,874 | 2,895 | PHP | 2460 | Empowering People Ethically 🚀 — Matomo is hiring! Join us → https://matomo.org/jobs Matomo is the leading open-source alternative to Google Analytics, giving you complete control and built-in privacy... | 2026-09-16 |
| 53 | mimikatz | 21,842 | 4,165 | C | 155 | A little tool to play with Windows security | 2026-04-17 |
| 54 | Mobile-Security-Framework-MobSF | 21,778 | 3,758 | JavaScript | 18 | Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and ... | 2026-09-09 |
| 55 | chezmoi | 21,615 | 687 | Go | 54 | Manage your dotfiles across multiple diverse machines, securely. | 2026-09-13 |
| 56 | Atlas | 21,536 | 753 | Batchfile | 7 | 🚀 An open and lightweight modification to Windows, designed to optimize performance, privacy and usability. | 2026-09-14 |
| 57 | security-guide-for-developers | 21,094 | 1,573 | - | 0 | Security Guide for Developers | 2025-08-30 |
| 58 | teleport | 20,923 | 2,156 | Go | 2703 | The easiest, and most secure way to access and protect all of your infrastructure. | 2026-09-15 |
| 59 | shardingsphere | 20,797 | 6,899 | Java | 182 | Empowering Data Intelligence with Distributed SQL for Sharding, Scalability, and Security Across All Databases. | 2026-09-15 |
| 60 | RustScan | 20,415 | 1,382 | Rust | 34 | 🤖 The Modern Port Scanner 🤖 | 2026-09-09 |
| 61 | bettercap | 19,981 | 1,723 | Go | 43 | The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks. | 2026-08-13 |
| 62 | DB-GPT | 19,970 | 2,929 | Python | 371 | open-source agentic AI data assistant for the next generation of AI + Data products. | 2026-09-15 |
| 63 | universal-android-debloater | 19,919 | 1,060 | Rust | 512 | Cross-platform GUI written in Rust using ADB to debloat non-rooted android devices. Improve your privacy, the security and battery life of your device. | 2024-08-02 |
| 64 | cutter | 19,734 | 1,461 | C++ | 468 | Free and Open Source Reverse Engineering Platform powered by rizin | 2026-09-11 |
| 65 | Obtainium | 19,705 | 598 | Dart | 358 | Get Android app updates straight from the source. | 2026-09-13 |
| 66 | simplex-chat | 19,448 | 1,350 | Haskell | 999 | SimpleX - the first messaging network operating without user identifiers of any kind - 100% private by design! iOS, Android and desktop apps 📱! | 2026-09-15 |
| 67 | 90DaysOfCyberSecurity | 19,326 | 2,202 | - | 3 | This repository contains a 90-day cybersecurity study plan, along with resources and materials for learning various cybersecurity concepts and technologies. The plan is organized into daily tasks, cov... | 2026-09-06 |
| 68 | fail2ban | 18,630 | 1,498 | Python | 162 | Daemon to ban hosts that cause multiple authentication errors | 2026-09-11 |
| 69 | nebula | 18,345 | 1,184 | Go | 55 | A scalable overlay networking tool with a focus on performance, simplicity and security | 2026-09-15 |
| 70 | CS-Interview-Knowledge-Map | 18,240 | 2,527 | - | 29 | Build the best interview map. The current content includes JS, network, browser related, performance optimization, security, framework, Git, data structure, algorithm, etc. | 2020-05-03 |
| 71 | hydra | 17,543 | 1,610 | Go | 62 | Internet-scale OpenID Certified™ OpenID Connect and OAuth2.1 provider that integrates with your user management through headless APIs. Solve OIDC/OAuth2 user cases over night. Consume as a service on ... | 2026-07-29 |
| 72 | DOMPurify | 17,392 | 861 | JavaScript | 0 | DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo: | 2026-09-15 |
| 73 | SkillSpector | 17,352 | 1,480 | Python | 59 | Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills befo... | 2026-09-16 |
| 74 | wazuh | 16,894 | 2,481 | C++ | 2919 | Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads. | 2026-09-16 |
| 75 | lynis | 16,342 | 1,634 | Shell | 173 | Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional. | 2026-09-09 |
| 76 | javascript-obfuscator | 16,257 | 1,741 | TypeScript | 15 | A powerful obfuscator for JavaScript and Node.js | 2026-09-09 |
| 77 | cryptomator | 16,142 | 1,541 | Java | 274 | Cryptomator for Windows, macOS, and Linux: Secure client-side encryption for your cloud storage, ensuring privacy and control over your data. | 2026-09-15 |
| 78 | systeminformer | 16,006 | 1,785 | C | 273 | A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc. @ https://windows-internals.com | 2026-09-16 |
| 79 | zaproxy | 15,771 | 2,636 | Java | 808 | The ZAP by Checkmarx Core project | 2026-09-15 |
| 80 | hacker-roadmap | 15,596 | 1,709 | - | 2 | A collection of hacking tools, resources and references to practice ethical hacking. | 2023-10-16 |
| 81 | crowdsec | 14,863 | 718 | Go | 222 | CrowdSec - the open-source and participative security solution offering crowdsourced protection against malicious IPs and access to the most advanced real-world CTI. | 2026-09-15 |
| 82 | awesome-security | 14,859 | 2,396 | - | 33 | A collection of awesome software, libraries, documents, books, resources and cools stuffs about security. | 2026-01-11 |
| 83 | wifiphisher | 14,845 | 2,744 | Python | 336 | The Rogue Access Point Framework | 2026-05-22 |
| 84 | prowler | 14,819 | 2,385 | Python | 143 | Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment. | 2026-09-15 |
| 85 | dirsearch | 14,727 | 2,440 | Python | 14 | Web path scanner | 2026-09-16 |
| 86 | fscan | 14,554 | 1,947 | Go | 14 | 一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning) | 2026-09-01 |
| 87 | openvpn | 14,551 | 3,397 | C | 181 | OpenVPN is an open source VPN daemon | 2026-09-15 |
| 88 | hacker101 | 14,541 | 2,661 | SCSS | 0 | Source code for Hacker101.com - a free online web and mobile security class. | 2025-02-22 |
| 89 | bytebase | 14,486 | 983 | Go | 147 | Database governance built for humans and agents — controlling changes and access across every major database. | 2026-09-16 |
| 90 | nginx-admins-handbook | 14,308 | 1,137 | Shell | 3 | How to improve NGINX performance, security, and other important things. | 2024-11-19 |
| 91 | gophish | 14,218 | 2,958 | Go | 673 | Open-Source Phishing Toolkit | 2024-09-23 |
| 92 | zuul | 14,078 | 2,445 | Java | 1 | Zuul is a gateway service that provides dynamic routing, monitoring, resiliency, security, and more. | 2026-09-11 |
| 93 | opensnitch | 14,066 | 664 | Python | 170 | OpenSnitch is a GNU/Linux interactive application firewall inspired by Little Snitch. | 2026-07-26 |
| 94 | opennhp | 13,924 | 2,479 | Go | 11 | A lightweight, cryptography-powered, open-source toolkit built to enforce Zero Trust security for infrastructure, applications, and data in the AI-driven world. | 2026-09-16 |
| 95 | juice-shop | 13,874 | 19,615 | TypeScript | 4 | OWASP Juice Shop: Probably the most modern and sophisticated insecure web application | 2026-09-14 |
| 96 | awesome-web-security | 13,798 | 1,818 | Python | 1 | 🐶 A curated list of Web Security materials and resources. | 2026-09-14 |
| 97 | DVWA | 13,672 | 5,110 | PHP | 3 | Damn Vulnerable Web Application (DVWA) | 2026-09-07 |
| 98 | GTFOBins.github.io | 13,664 | 1,686 | YAML | 6 | GTFOBins is a curated list of Unix-like executables that can be used to bypass local security restrictions in misconfigured systems. | 2026-05-27 |
| 99 | nmap | 13,596 | 2,906 | C | 364 | Nmap - the Network Mapper. Github mirror of official SVN repository. | 2026-09-15 |
| 100 | tink | 13,535 | 1,191 | Java | 0 | Tink is a multi-language, cross-platform, open source library that provides cryptographic APIs that are secure, easy to use correctly, and hard(er) to misuse. | 2024-04-17 |