 Rustls is a modern TLS library written in Rust. It's pronounced 'rustles'. It uses ring for cryptography and libwebpki for certificate verification. It aims to provide a good level of cryptographic security, requires no configuration to achieve that security, and provides no unsafe features or obsolete cryptography.

rustls - A modern TLS library in Rust

Ockam provides end-to-end encryption and mutual authentication for distributed applications. Transport layer security protocols are unable to protect application messages because their protection is constrained by the length and duration of the underlying transport connection. Ockam is a suite of programming libraries and infrastructure that makes it simple for our applications to guarantee end-to-end integrity, authenticity, and confidentiality of data.
 
It helps to create and manage cryptographic keys, unique device identifiers, and verifiable credentials in your connected environments.

Ockam provides end-to-end encryption and mutual authentication for distributed applications. Transport layer security protocols are unable to protect application messages because their protection is constrained by the length and duration of the underlying transport connection. Ockam is a suite of programming libraries and infrastructure that makes it simple for our applications to guarantee end-to-end integrity, authenticity, and confidentiality of data.

Ockam - End-to-end encryption and mutual authentication for distributed applications

Jasypt is a java library which allows the developer to add basic encryption capabilities to his/her projects with minimum effort, and without the need of having deep knowledge on how cryptography works. It provides unidirectional (digest) and bidirectional encryption techniques. It could encrypt text, byte arrays, objects, files etc. It could be integrated with Spring, Apache wicket.

Jasypt - Java Simplified Encryption

KeyczarKeyczar is an open source cryptographic toolkit designed to make it easier and safer for devlopers to use cryptography in their applications. Keyczar supports authentication and encryption with both symmetric and asymmetric keys. Keyczar was originally developed by members of the Google Security Team. 
 
Keyczar is designed to be open, extensible, and cross-platform compatible. It is not intended to replace existing cryptographic libraries like OpenSSL, PyCrypto, or the Java JCE, and in fact is built on these libraries.

KeyczarKeyczar is an open source cryptographic toolkit designed to make it easier and safer for devlopers to use cryptography in their applications. Keyczar supports authentication and encryption with both symmetric and asymmetric keys. Keyczar was originally developed by members of the Google Security Team. 

Keyczar - Toolkit for safe and simple cryptography

Apache Oltu is an OAuth protocol implementation in Java. It also covers others "OAuth family" related implementations such as JWT, JWS and OpenID Connect.

Apache Oltu - OAuth protocol implementation in Java

Quick Android Review Kit - This tool is designed to look for several security related Android application vulnerabilities, either in source code or packaged APKs. 
 
The tool is also capable of creating "Proof-of-Concept" deployable APKs and/or ADB commands, capable of exploiting many of the vulnerabilities it finds. There is no need to root the test device, as this tool focuses on vulnerabilities that can be exploited under otherwise secure conditions.
 
QARK is an easy to use tool capable of finding common security vulnerabilities in Android applications. Unlike commercial products, it is 100% free to use. QARK features educational information allowing security reviewers to locate precise, in-depth explanations of the vulnerabilities. QARK automates the use of multiple decompilers, leveraging their combined outputs, to produce superior results, when decompiling APKs. Finally, the major advantage QARK has over traditional tools, that just point you to possible vulnerabilities, is that it can produce ADB commands, or even fully functional APKs, that turn hypothetical vulnerabilities into working "POC" exploits.

Quick Android Review Kit - This tool is designed to look for several security related Android application vulnerabilities, either in source code or packaged APKs. 

qark - Tool to look for several security related Android application vulnerabilities

s2n is a C99 implementation of the TLS/SSL protocols that is designed to be simple, small, fast, and with security as a priority. s2n implements SSLv3, TLS1.0, TLS1.1, and TLS1.2. For encryption, s2n supports 128-bit and 256-bit AES, in the CBC and GCM modes, 3DES, and RC4. For forward secrecy, s2n supports both DHE and ECDHE. 

s2n - an implementation of the TLS/SSL protocols from Amazon

Metron integrates a variety of open source big data technologies in order to offer a centralized tool for security monitoring and analysis. Metron provides capabilities for log aggregation, full packet capture indexing, storage, advanced behavioral analytics and data enrichment, while applying the most current threat intelligence information to security telemetry within a single platform.
 
Metron will provide next generation defense techniques that consists of using a class of anomaly detection and machine learning algorithms that can be applied in real-time as events are streaming in.

Metron integrates a variety of open source big data technologies in order to offer a centralized tool for security monitoring and analysis. Metron provides capabilities for log aggregation, full packet capture indexing, storage, advanced behavioral analytics and data enrichment, while applying the most current threat intelligence information to security telemetry within a single platform.

Apache Metron - Real-time Big Data Security 

Easy Tink provides APIs that are simple and easy to use correctly. Most cryptographic operations such as data encryption, digital signatures, etc. can be done with only a few lines of code.Security Tink reduces common cryptographic pitfalls with user-centered design, careful implementation and code reviews, and extensive testing.
 
 At Google, Tink is already being used to secure data of many products such as AdMob, Google Pay, Google Assistant, Firebase, the Android Search App, etc.

Tink is a multi-language, cross-platform library that provides cryptographic APIs that are secure, easy to use correctly, and hard(er) to misuse.. Most cryptographic operations such as data encryption, digital signatures, etc. can be done with only a few lines of code. Tink reduces common cryptographic pitfalls with user-centered design, careful implementation and code reviews, and extensive testing.

Tink - Cryptographic library that provides an easy, secure, and agile API for common cryptographic tasks

Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM). This approach provides capabilities that traditional Software Composition Analysis (SCA) solutions cannot achieve.
 
Dependency-Track monitors component usage across all versions of every application in its portfolio in order to proactively identify risk across an organization. The platform has an API-first design and is ideal for use in CI/CD environments.

Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM). This approach provides capabilities that traditional Software Composition Analysis (SCA) solutions cannot achieve.

Dependency-Track - Intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain

ZITADEL provides you with all the features necessary to build great solutions, without the need of building the login and access management yourself. 
 
Its features include: 
<ul><li>Authentication:&nbsp; OpenID Connect 1.0 Protocol (OP), Username / Password,&nbsp; Machine-to-machine (JWT profile), Passwordless with FIDO2</li><li>Multifactor authentication with OTP, U2F</li><li>Federation with OpenID Connect 1.0 Protocol (RP), OAuth 2.0 Protocol (RP)</li><li>Authorization via Role Based Access Control (RBAC)</li><li>Identity Brokering</li><li>Delegation of roles to other organizations for self-management</li><li>Strong audit trail for all IAM resources</li><li>User interface for administration</li><li>APIs for Management, Administration, and Authentication</li><li>Policy configuration and enforcement</li><li>Private Labeling</li></ul>

ZITADEL provides you with all the features necessary to build great solutions, without the need of building the login and access management yourself. 

ZITADEL - Cloud Native Identity and Access Management

SpiceDB is a database system for managing security-critical application permissions. Developers create a schema that models their permissions requirements and use a client library to apply the schema to the database, insert data into the database, and query the data to efficiently check permissions in their applications.
 
The data used to calculate permissions have the most critical correctness requirements in the entirety a software system. Despite that, developers continue to build their own ad-hoc solutions coupled to the internal code of each new project. By developing a SpiceDB schema, you can iterate far more quickly and exhaustively test designs before altering any application code. This becomes especially important as you introduce backwards-compatible changes to the schema and want to ensure that the system remains secure.

SpiceDB is a database system for managing security-critical application permissions. Developers create a schema that models their permissions requirements and use a client library to apply the schema to the database, insert data into the database, and query the data to efficiently check permissions in their applications.

SpiceDB - Inspired by Google's Zanzibar paper, SpiceDB is a database system for managing security-critical application permissions

Ecoji encodes data as 1024 emojis, its base1024 with an emoji character set. As a bonus, includes code to decode emojis to original data. The difference between Ecoji and Base64 is that Ecoji is more bytes, but less visible characters. With Ecoji each visible char represents 10 bits, but each character is multi-byte. With base64 each char represents 6 bits and is one byte. 

Ecoji - Encodes (and decodes) data as emojis

Kubescape is an open-source Kubernetes security platform. It includes risk analysis, security compliance, and misconfiguration scanning. Targeted at the DevSecOps practitioner or platform engineer, it offers an easy-to-use CLI interface, flexible output formats, and automated scanning capabilities. It saves Kubernetes users and admins precious time, effort, and resources.
Kubescape scans clusters, YAML files, and Helm charts. It detects misconfigurations according to multiple frameworks (including&nbsp;<a href="https://www.armosec.io/blog/kubernetes-hardening-guidance-summary-by-armo/?utm_source=github&amp;utm_medium=repository" target="_blank" rel="noopener">NSA-CISA</a>,&nbsp;<a href="https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/" target="_blank" rel="noopener">MITRE ATT&amp;CK </a>and the&nbsp;<a href="https://www.armosec.io/blog/cis-kubernetes-benchmark-framework-scanning-tools-comparison/?utm_source=github&amp;utm_medium=repository" target="_blank" rel="noopener">CIS Benchmark</a>).
Kubescape uses&nbsp;<a href="https://github.com/open-policy-agent/opa" target="_blank" rel="noopener">Open Policy Agent</a>&nbsp;to verify Kubernetes objects against&nbsp;<a href="https://github.com/kubescape/regolibrary" target="_blank" rel="noopener">a library of posture controls</a>. By default, the results are printed in a console but they can be exported to JSON and PDF.
Kubescape is running the following tests according to what is defined by Kubernetes Hardening Guidance by NSA and CISA.
<ul>
<li>Non-root containers</li>
<li>Immutable container filesystem</li>
<li>Privileged containers</li>
<li>hostPID, hostIPC privileges</li>
<li>hostNetwork access</li>
<li>allowedHostPaths field</li>
<li>Protecting pod service account tokens</li>
<li>Resource policies</li>
<li>Control plane hardening</li>
<li>Exposed dashboard</li>
<li>Allow privilege escalation</li>
<li>Applications credentials in configuration files</li>
<li>Cluster-admin binding</li>
<li>Exec into container</li>
<li>Dangerous capabilities</li>
<li>Insecure capabilities</li>
<li>Linux hardening</li>
</ul>

An open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters.



Kubescape - An open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters

Ranger is a framework to enable, monitor and manage comprehensive data security across the Hadoop platform. It provides centralized security administration to manage all security related tasks in a central UI or using REST APIs, Fine grained authorization, Centralize auditing of user access within Apache Hadoop, Apache Hive, Apache HBase and other Apache components.

Ranger - Manage Data Security across the Hadoop Platform

Discover open source projects across all platforms

Projects