Top 100 security Repositories
Ranking
| Ranking | Project Name | Stars | Forks | Language | Open Issues | Description | Last Commit |
|---|---|---|---|---|---|---|---|
| 1 | the-book-of-secret-knowledge | 234,320 | 13,943 | - | 0 | A collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools and more. | 2024-11-19 |
| 2 | ECC | 231,600 | 35,345 | JavaScript | 32 | The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond. | 2026-07-20 |
| 3 | Awesome-Hacking | 116,578 | 10,543 | - | 0 | A collection of various awesome lists for hackers, pentesters and security researchers | 2026-05-07 |
| 4 | cs-video-courses | 82,562 | 11,386 | - | 0 | List of Computer Science courses with video lectures. | 2026-07-07 |
| 5 | PayloadsAllTheThings | 79,304 | 17,188 | Python | 0 | A list of useful payloads and bypass for Web Application Security and Pentest/CTF | 2026-07-15 |
| 6 | caddy | 74,211 | 4,837 | Go | 206 | Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS | 2026-07-20 |
| 7 | union | 73,894 | 3,888 | Rust | 129 | The trust-minimized, zero-knowledge bridging protocol, designed for censorship resistance, extremely high security, and usage in decentralized finance. | 2026-07-17 |
| 8 | SecLists | 72,313 | 25,066 | PHP | 8 | SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensi... | 2026-07-19 |
| 9 | gatsby | 55,954 | 10,153 | JavaScript | 217 | React-based framework with performance, scalability, and security built in. | 2026-07-21 |
| 10 | Docker-OSX | 52,682 | 2,881 | Shell | 397 | Run macOS VM in a Docker! Run near native OSX-KVM in Docker! X11 Forwarding! CI/CD for OS X Security Research! Docker mac Containers. | 2025-11-11 |
| 11 | x64dbg | 48,948 | 2,788 | C++ | 570 | An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis. | 2026-07-20 |
| 12 | mitmproxy | 44,389 | 4,632 | Python | 370 | An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers. | 2026-07-18 |
| 13 | strix | 42,954 | 4,432 | Python | 97 | Open-source AI penetration testing tool to find and fix your app’s vulnerabilities. | 2026-07-21 |
| 14 | sniffnet | 40,094 | 1,779 | Rust | 57 | Comfortably monitor your Internet traffic 🕵️♂️ | 2026-07-20 |
| 15 | quivr | 39,229 | 3,716 | Python | 10 | Opiniated RAG for integrating GenAI in your apps 🧠 Focus on your product rather than the RAG. Easy integration in existing products with customisation! Any LLM: GPT4, Groq, Llama. Any Vectorstore:... | 2025-07-09 |
| 16 | trivy | 36,996 | 546 | Go | 165 | Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more | 2026-07-20 |
| 17 | web-check | 34,226 | 2,812 | TypeScript | 58 | 🕵️♂️ All-in-one OSINT tool for analysing any website | 2026-07-11 |
| 18 | CheatSheetSeries | 32,616 | 4,536 | Python | 31 | The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics. | 2026-07-20 |
| 19 | nginx | 31,175 | 8,114 | C | 251 | The official NGINX Open Source repository. | 2026-07-17 |
| 20 | hosts | 30,734 | 2,427 | Python | 152 | 🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories. | 2026-07-18 |
| 21 | algo | 30,331 | 2,365 | Python | 66 | Set up a personal VPN in the cloud | 2026-07-16 |
| 22 | nanoclaw | 30,299 | 12,874 | TypeScript | 294 | A lightweight alternative to OpenClaw that runs in containers for security. Connects to WhatsApp, Telegram, Slack, Discord, Gmail and other messaging apps,, has memory, scheduled jobs, and runs direct... | 2026-07-20 |
| 23 | nuclei | 29,875 | 3,620 | Go | 80 | Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the int... | 2026-07-20 |
| 24 | How-To-Secure-A-Linux-Server | 29,514 | 1,966 | - | 32 | An evolving how-to guide for securing a Linux server. | 2026-07-13 |
| 25 | ProxmoxVE | 29,016 | 2,794 | Shell | 10 | Proxmox VE Helper-Scripts (Community Edition) | 2026-07-21 |
| 26 | SpringAll | 28,972 | 8,111 | Java | 21 | 循序渐进，学习Spring Boot、Spring Boot & Shiro、Spring Batch、Spring Cloud、Spring Cloud Alibaba、Spring Security & Spring Security OAuth2，博客Spring系列源码：https://mrbird.cc | 2024-05-31 |
| 27 | h4cker | 28,545 | 5,283 | Jupyter Notebook | 0 | This repository is maintained by Omar Santos (@santosomar) and includes thousands of resources related to ethical hacking, bug bounties, digital forensics and incident response (DFIR), AI security, vu... | 2026-06-29 |
| 28 | authelia | 28,337 | 1,445 | Go | 55 | The Single Sign-On Multi-Factor portal for web apps, now OpenID Certified™ | 2026-07-20 |
| 29 | nginxconfig.io | 28,288 | 2,044 | JavaScript | 62 | ⚙️ NGINX config generator on steroids 💉 | 2024-12-14 |
| 30 | infisical | 28,269 | 2,131 | TypeScript | 246 | Infisical is the open-source platform for secrets, certificates, and privileged access management. | 2026-07-21 |
| 31 | setup-ipsec-vpn | 28,226 | 6,513 | Shell | 0 | Set up your own IPsec VPN server in just a few minutes, with IPsec/L2TP, Cisco IPsec and IKEv2. Supports Ubuntu, Debian, CentOS/RHEL, Alpine Linux and Raspberry Pi OS. Includes client config and manag... | 2026-07-09 |
| 32 | gitleaks | 28,215 | 2,154 | Go | 263 | Find secrets with Gitleaks 🔑 | 2026-07-20 |
| 33 | keepassxc | 28,075 | 1,850 | C++ | 782 | KeePassXC is a cross-platform community-driven port of the Windows application “KeePass Password Safe”. | 2026-07-11 |
| 34 | openzeppelin-contracts | 27,190 | 12,402 | Solidity | 239 | OpenZeppelin Contracts is a library for secure smart contract development. | 2026-07-20 |
| 35 | trufflehog | 27,133 | 2,500 | Go | 260 | Find, verify, and analyze leaked credentials | 2026-07-20 |
| 36 | Anthropic-Cybersecurity-Skills | 26,218 | 3,147 | Python | 15 | 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with... | 2026-06-26 |
| 37 | cilium | 24,756 | 3,915 | Go | 785 | eBPF-based Networking, Security, and Observability | 2026-07-21 |
| 38 | radare2 | 24,405 | 3,275 | C | 759 | UNIX-like reverse engineering framework and command-line toolset | 2026-07-21 |
| 39 | osquery | 23,407 | 2,582 | C++ | 607 | SQL powered operating system instrumentation, monitoring, and analytics. | 2026-07-15 |
| 40 | slim | 23,347 | 836 | Go | 187 | Slim(toolkit): Don't change anything in your container image and minify it by up to 30x (and for compiled languages even more) making it secure too! (free and open source) | 2026-06-23 |
| 41 | API-Security-Checklist | 23,280 | 2,654 | - | 1 | Checklist of the most important security countermeasures when designing, testing, and releasing your API | 2026-02-10 |
| 42 | sops | 22,551 | 1,059 | Go | 369 | Simple and flexible tool for managing secrets | 2026-07-20 |
| 43 | macOS-Security-and-Privacy-Guide | 22,472 | 1,459 | - | 8 | Community guide to securing and improving privacy on macOS. | 2026-07-19 |
| 44 | authentik | 22,402 | 1,710 | Python | 861 | The authentication glue you need. | 2026-07-21 |
| 45 | eladmin | 21,932 | 7,355 | Java | 18 | eladmin jpa 版本：项目基于 Spring Boot 2.7.18、 Jpa、 Spring Security、Redis、Vue的前后端分离的后台管理系统，项目采用分模块开发方式， 权限控制采用 RBAC，支持数据字典与数据权限管理，支持一键生成前后端代码，支持动态路由 | 2026-05-09 |
| 46 | SafeLine | 21,909 | 1,446 | Go | 89 | SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits. | 2026-07-10 |
| 47 | personal-security-checklist | 21,894 | 1,460 | TypeScript | 56 | 🔒 A compiled checklist of 300+ tips for protecting digital security and privacy in 2026 | 2026-02-28 |
| 48 | mimikatz | 21,720 | 4,146 | C | 154 | A little tool to play with Windows security | 2026-04-17 |
| 49 | matomo | 21,705 | 2,866 | PHP | 2446 | Empowering People Ethically 🚀 — Matomo is hiring! Join us → https://matomo.org/jobs Matomo is the leading open-source alternative to Google Analytics, giving you complete control and built-in privacy... | 2026-07-21 |
| 50 | Mobile-Security-Framework-MobSF | 21,464 | 3,730 | JavaScript | 20 | Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and ... | 2026-07-06 |
| 51 | Atlas | 21,104 | 737 | Batchfile | 3 | 🚀 An open and lightweight modification to Windows, designed to optimize performance, privacy and usability. | 2026-07-18 |
| 52 | security-guide-for-developers | 21,088 | 1,577 | - | 0 | Security Guide for Developers | 2025-08-30 |
| 53 | anubis | 20,820 | 658 | Go | 264 | Weighs the soul of incoming HTTP requests to stop AI crawlers | 2026-07-20 |
| 54 | chezmoi | 20,763 | 668 | Go | 57 | Manage your dotfiles across multiple diverse machines, securely. | 2026-07-20 |
| 55 | shardingsphere | 20,761 | 6,894 | Java | 295 | Empowering Data Intelligence with Distributed SQL for Sharding, Scalability, and Security Across All Databases. | 2026-07-20 |
| 56 | teleport | 20,676 | 2,121 | Go | 2734 | The easiest, and most secure way to access and protect all of your infrastructure. | 2026-07-21 |
| 57 | RustScan | 20,136 | 1,355 | Rust | 34 | 🤖 The Modern Port Scanner 🤖 | 2026-07-16 |
| 58 | universal-android-debloater | 19,651 | 1,046 | Rust | 505 | Cross-platform GUI written in Rust using ADB to debloat non-rooted android devices. Improve your privacy, the security and battery life of your device. | 2024-08-02 |
| 59 | bettercap | 19,536 | 1,677 | Go | 47 | The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks. | 2026-07-16 |
| 60 | DB-GPT | 19,522 | 2,832 | Python | 366 | open-source agentic AI data assistant for the next generation of AI + Data products. | 2026-07-16 |
| 61 | cutter | 19,377 | 1,419 | C++ | 465 | Free and Open Source Reverse Engineering Platform powered by rizin | 2026-07-17 |
| 62 | simplex-chat | 18,815 | 1,183 | Haskell | 972 | SimpleX - the first messaging network operating without user identifiers of any kind - 100% private by design! iOS, Android and desktop apps 📱! | 2026-07-20 |
| 63 | Obtainium | 18,387 | 536 | Dart | 368 | Get Android app updates straight from the source. | 2026-07-20 |
| 64 | CS-Interview-Knowledge-Map | 18,260 | 2,533 | - | 29 | Build the best interview map. The current content includes JS, network, browser related, performance optimization, security, framework, Git, data structure, algorithm, etc. | 2020-05-03 |
| 65 | fail2ban | 18,215 | 1,482 | Python | 164 | Daemon to ban hosts that cause multiple authentication errors | 2026-06-23 |
| 66 | 90DaysOfCyberSecurity | 17,789 | 2,022 | - | 7 | This repository contains a 90-day cybersecurity study plan, along with resources and materials for learning various cybersecurity concepts and technologies. The plan is organized into daily tasks, cov... | 2026-03-14 |
| 67 | nebula | 17,543 | 1,161 | Go | 52 | A scalable overlay networking tool with a focus on performance, simplicity and security | 2026-07-21 |
| 68 | hydra | 17,415 | 1,595 | Go | 103 | Internet-scale OpenID Certified™ OpenID Connect and OAuth2.1 provider that integrates with your user management through headless APIs. Solve OIDC/OAuth2 user cases over night. Consume as a service on ... | 2026-07-20 |
| 69 | DOMPurify | 17,231 | 857 | JavaScript | 0 | DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo: | 2026-07-20 |
| 70 | wazuh | 16,232 | 2,384 | C++ | 2772 | Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads. | 2026-07-21 |
| 71 | javascript-obfuscator | 16,164 | 1,731 | TypeScript | 15 | A powerful obfuscator for JavaScript and Node.js | 2026-07-18 |
| 72 | lynis | 16,032 | 1,613 | Shell | 170 | Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional. | 2026-07-17 |
| 73 | cryptomator | 15,731 | 1,381 | Java | 274 | Cryptomator for Windows, macOS, and Linux: Secure client-side encryption for your cloud storage, ensuring privacy and control over your data. | 2026-07-20 |
| 74 | hacker-roadmap | 15,511 | 1,702 | - | 2 | A collection of hacking tools, resources and references to practice ethical hacking. | 2023-10-16 |
| 75 | zaproxy | 15,442 | 2,598 | Java | 803 | The ZAP by Checkmarx Core project | 2026-07-17 |
| 76 | systeminformer | 15,429 | 1,753 | C | 262 | A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc. @ https://windows-internals.com | 2026-07-19 |
| 77 | wifiphisher | 14,699 | 2,746 | Python | 335 | The Rogue Access Point Framework | 2026-05-22 |
| 78 | awesome-security | 14,649 | 2,325 | - | 32 | A collection of awesome software, libraries, documents, books, resources and cools stuffs about security. | 2026-01-11 |
| 79 | dirsearch | 14,522 | 2,436 | Python | 16 | Web path scanner | 2026-07-01 |
| 80 | hacker101 | 14,483 | 2,667 | SCSS | 0 | Source code for Hacker101.com - a free online web and mobile security class. | 2025-02-22 |
| 81 | prowler | 14,379 | 2,269 | Python | 79 | Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment. | 2026-07-20 |
| 82 | bytebase | 14,276 | 963 | Go | 142 | World's most advanced database DevSecOps solution for Developer, Security, DBA and Platform Engineering teams. The GitHub/GitLab for database DevSecOps. | 2026-07-21 |
| 83 | crowdsec | 14,271 | 680 | Go | 222 | CrowdSec - the open-source and participative security solution offering crowdsourced protection against malicious IPs and access to the most advanced real-world CTI. | 2026-07-20 |
| 84 | openvpn | 14,264 | 3,365 | C | 176 | OpenVPN is an open source VPN daemon | 2026-07-20 |
| 85 | nginx-admins-handbook | 14,218 | 1,130 | Shell | 3 | How to improve NGINX performance, security, and other important things. | 2024-11-19 |
| 86 | fscan | 14,165 | 1,906 | Go | 19 | 一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning) | 2026-07-15 |
| 87 | zuul | 14,050 | 2,441 | Java | 3 | Zuul is a gateway service that provides dynamic routing, monitoring, resiliency, security, and more. | 2026-07-20 |
| 88 | gophish | 14,038 | 2,935 | Go | 660 | Open-Source Phishing Toolkit | 2024-09-23 |
| 89 | opensnitch | 13,896 | 650 | Python | 152 | OpenSnitch is a GNU/Linux interactive application firewall inspired by Little Snitch. | 2026-07-21 |
| 90 | opennhp | 13,823 | 2,482 | Go | 7 | A lightweight, cryptography-powered, open-source toolkit built to enforce Zero Trust security for infrastructure, applications, and data in the AI-driven world. | 2026-07-20 |
| 91 | awesome-web-security | 13,608 | 1,803 | Python | 1 | 🐶 A curated list of Web Security materials and resources. | 2026-07-18 |
| 92 | tink | 13,541 | 1,189 | Java | 0 | Tink is a multi-language, cross-platform, open source library that provides cryptographic APIs that are secure, easy to use correctly, and hard(er) to misuse. | 2024-04-17 |
| 93 | juice-shop | 13,522 | 18,736 | TypeScript | 3 | OWASP Juice Shop: Probably the most modern and sophisticated insecure web application | 2026-07-15 |
| 94 | secguide | 13,480 | 1,949 | - | 33 | 面向开发人员梳理的代码安全指南 | 2023-03-20 |
| 95 | SkillSpector | 13,478 | 1,110 | Python | 42 | Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, and security risks. | 2026-07-20 |
| 96 | GTFOBins.github.io | 13,468 | 1,644 | YAML | 6 | GTFOBins is a curated list of Unix-like executables that can be used to bypass local security restrictions in misconfigured systems. | 2026-05-27 |
| 97 | DVWA | 13,388 | 4,998 | PHP | 2 | Damn Vulnerable Web Application (DVWA) | 2026-05-30 |
| 98 | nmap | 13,220 | 2,856 | C | 359 | Nmap - the Network Mapper. Github mirror of official SVN repository. | 2026-07-20 |
| 99 | routersploit | 13,193 | 2,402 | Python | 86 | Exploitation Framework for Embedded Devices | 2026-05-05 |
| 100 | mastg | 13,067 | 2,772 | Python | 187 | The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP ... | 2026-07-19 |