🍰 Everything is RSSible

The Best Practices for OSS Developers working group is dedicated to raising awareness and education of secure code best practices for open source developers.

The SBOM tool is a highly scalable and enterprise ready tool to create SPDX 2.2 compatible SBOMs for any variety of artifacts.

The SCANOSS python package providing a simple, easy to consume library for interacting with SCANOSS APIs/Engine.

The SCANOSS JS package provides a simple, easy to consume module for interacting with SCANOSS APIs/Engine.

BLint is a Binary Linter to check the security properties, and capabilities in your executables. Since v2, blint is also an SBOM generator for binaries.

GitHub App to set and enforce security policies

Scans Software Bill of Materials (SBOMs) for security vulnerabilities

A web application that assists network defenders, analysts, and researcher in the process of mapping adversary behaviors to the MITRE ATT&CK® framework.

Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.

🥑 Language focused docker images, minus the operating system.

The SCANOSS Audit Workbench graphical user interface to scan and audit your source code.

🦙 MegaLinter analyzes 50 languages, 22 formats, 21 tooling formats, excessive copy-pastes, spelling mistakes and security issues in your repository sources with a GitHub Action, other CI tools or l…

Software sharing for modern businesses. Engage the developer community with your core products.

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis

A Swiss Army knife for developers.

Universal dependency update tool that fits into your workflows.

The CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 100 common, vulnerable components (openssl, libpng, libxml2, expat and others),…

Ginger Automation IDE

Chrome extension for fixing fixing RTL (e.g., Hebrew) text issues in AI chat platforms (Claude.ai, ChatGPT, Perplexity.ai, Google Gemini and NotebookLM)

OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container …

Periodic cyber security newsletters that capture the latest news, summaries of conference talks, research, best practices, tools, events, vulnerabilities, and analysis of trending threats and attacks

"Vulnerable by Design" supply chain is a learning and training project that demonstrates how common configuration errors can find their way into production cloud environments.

WebGoat is a deliberately insecure application

Malicious Packages and Users are infiltrating software around the globe. Examples of Account Takeover, Dependency Confusion, Hacktivism and Chain/Repo-Jacking are being used to infect your software.

TerraGoat is Bridgecrew's "Vulnerable by Design" Terraform repository. TerraGoat is a learning and training project that demonstrates how common configuration errors can find their way into product…

Powerful building blocks for React-based web applications