Gitleaks audits local and remote repos by running regex checks against all commits.

Gitleaks - Searches full repo history for secrets and keys

Docker slim minify's and secure's Docker containers. Keep doing what you are doing. No need to change anything. Use the base image you want. Use the package manager you want. Don't worry about hand optimizing your Dockerfile. You shouldn't have to throw away your tools and your workflow to have small container images.
 
docker-slim will optimize and secure your containers by understanding your application and what it needs using various analysis techniques.

Docker slim minify's and secure's Docker containers. Keep doing what you are doing. No need to change anything. Use the base image you want. Use the package manager you want. Don't worry about hand optimizing your Dockerfile. You shouldn't have to throw away your tools and your workflow to have small container images.



DockerSlim (docker-slim) - Optimize and secure your Docker containers

Cilium is open source software for providing and transparently securing network connectivity and loadbalancing between application workloads such as application containers or processes. Cilium operates at Layer 3/4 to provide traditional networking and security services as well as Layer 7 to protect and secure use of modern application protocols such as HTTP, gRPC and Kafka. Cilium is integrated into common orchestration frameworks such as Kubernetes.
 
A new Linux kernel technology called eBPF is at the foundation of Cilium. It supports dynamic insertion of eBPF bytecode into the Linux kernel at various integration points such as: network IO, application sockets, and tracepoints to implement security, networking and visibility logic. eBPF is highly efficient and flexible.

Cilium is open source software for providing and transparently securing network connectivity and loadbalancing between application workloads such as application containers or processes. Cilium operates at Layer 3/4 to provide traditional networking and security services as well as Layer 7 to protect and secure use of modern application protocols such as HTTP, gRPC and Kafka. Cilium is integrated into common orchestration frameworks such as Kubernetes.

Cilium -  eBPF-based Networking, Security, and Observability

ORY Hydra is a hardened, OpenID Certified OAuth 2.0 Server and OpenID Connect Provider optimized for low-latency, high throughput, and low resource consumption. ORY Hydra is not an identity provider (user sign up, user login, password reset flow), but connects to your existing identity provider through a login and consent app. Implementing the login and consent app in a different language is easy, and exemplary consent apps (Go, Node) and SDKs are provided.

ORY Hydra - OpenID Connect and OAuth Provider written in Go

sops is an editor of encrypted files that supports YAML, JSON, ENV, INI and BINARY formats and encrypts with AWS KMS, GCP KMS, Azure Key Vault and PGP.

SOPS: Simple and flexible tool for managing secrets 

CloudQuery transforms your cloud infrastructure into queryable SQL for easy monitoring, governance and security. CloudQuery pulls, normalize, expose and monitor your cloud infrastructure and SaaS apps as SQL database. This abstracts various scattered APIs enabling you to define security, governance, cost and compliance policies with SQL. CloudQuery comes with built-in policy packs such as: AWS CIS.

CloudQuery - Transforms your cloud infrastructure into SQL database for easy monitoring, governance and security

bluemonday is a HTML sanitizer implemented in Go. It is fast and highly configurable.bluemonday takes untrusted user generated content as an input, and will return HTML that has been sanitised against a whitelist of approved HTML elements and attributes so that you can safely include the content in your web page. 
 
It protects sites from XSS attacks. There are many vectors for an XSS attack and the best way to mitigate the risk is to sanitize user input against a known safe list of HTML elements and attributes.

bluemonday is a HTML sanitizer implemented in Go. It is fast and highly configurable.bluemonday takes untrusted user generated content as an input, and will return HTML that has been sanitised against a whitelist of approved HTML elements and attributes so that you can safely include the content in your web page.

Bluemonday - A fast golang HTML sanitizer (inspired by the OWASP Java HTML Sanitizer) to scrub user generated content of XSS

Let's Encrypt client and ACME library written in Go.
 
Its feature include: 
<ul>
<li>Register with CA</li>
<li>Obtain certificates, both from scratch or with an existing CSR</li>
<li>Renew certificates</li>
<li>Revoke certificates</li>
<li>Robust implementation of all ACME challenges
<ul>
<li>HTTP (http-01)</li>
<li>TLS with Server Name Indication (tls-sni-01)</li>
<li>DNS (dns-01)</li>
</ul>
</li>
<li>SAN certificate support</li>
<li>Comes with multiple optional <a href="https://github.com/xenolf/lego/tree/master/providers/dns">DNS providers</a></li>
<li><a href="https://github.com/xenolf/lego/wiki/Writing-a-Challenge-Solver">Custom challenge solvers</a></li>
<li>Certificate bundling</li>
<li>OCSP helper function</li>
</ul>

Let's Encrypt client and ACME library written in Go.

Lego - Let's Encrypt client and ACME library

ZITADEL provides you with all the features necessary to build great solutions, without the need of building the login and access management yourself. 
 
Its features include: 
<ul><li>Authentication:&nbsp; OpenID Connect 1.0 Protocol (OP), Username / Password,&nbsp; Machine-to-machine (JWT profile), Passwordless with FIDO2</li><li>Multifactor authentication with OTP, U2F</li><li>Federation with OpenID Connect 1.0 Protocol (RP), OAuth 2.0 Protocol (RP)</li><li>Authorization via Role Based Access Control (RBAC)</li><li>Identity Brokering</li><li>Delegation of roles to other organizations for self-management</li><li>Strong audit trail for all IAM resources</li><li>User interface for administration</li><li>APIs for Management, Administration, and Authentication</li><li>Policy configuration and enforcement</li><li>Private Labeling</li></ul>

ZITADEL provides you with all the features necessary to build great solutions, without the need of building the login and access management yourself. 

ZITADEL - Cloud Native Identity and Access Management

SpiceDB is a database system for managing security-critical application permissions. Developers create a schema that models their permissions requirements and use a client library to apply the schema to the database, insert data into the database, and query the data to efficiently check permissions in their applications.
 
The data used to calculate permissions have the most critical correctness requirements in the entirety a software system. Despite that, developers continue to build their own ad-hoc solutions coupled to the internal code of each new project. By developing a SpiceDB schema, you can iterate far more quickly and exhaustively test designs before altering any application code. This becomes especially important as you introduce backwards-compatible changes to the schema and want to ensure that the system remains secure.

SpiceDB is a database system for managing security-critical application permissions. Developers create a schema that models their permissions requirements and use a client library to apply the schema to the database, insert data into the database, and query the data to efficiently check permissions in their applications.

SpiceDB - Inspired by Google's Zanzibar paper, SpiceDB is a database system for managing security-critical application permissions

Ecoji encodes data as 1024 emojis, its base1024 with an emoji character set. As a bonus, includes code to decode emojis to original data. The difference between Ecoji and Base64 is that Ecoji is more bytes, but less visible characters. With Ecoji each visible char represents 10 bits, but each character is multi-byte. With base64 each char represents 6 bits and is one byte. 

Ecoji - Encodes (and decodes) data as emojis

Kubescape is an open-source Kubernetes security platform. It includes risk analysis, security compliance, and misconfiguration scanning. Targeted at the DevSecOps practitioner or platform engineer, it offers an easy-to-use CLI interface, flexible output formats, and automated scanning capabilities. It saves Kubernetes users and admins precious time, effort, and resources.
Kubescape scans clusters, YAML files, and Helm charts. It detects misconfigurations according to multiple frameworks (including&nbsp;<a href="https://www.armosec.io/blog/kubernetes-hardening-guidance-summary-by-armo/?utm_source=github&amp;utm_medium=repository" target="_blank" rel="noopener">NSA-CISA</a>,&nbsp;<a href="https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/" target="_blank" rel="noopener">MITRE ATT&amp;CK </a>and the&nbsp;<a href="https://www.armosec.io/blog/cis-kubernetes-benchmark-framework-scanning-tools-comparison/?utm_source=github&amp;utm_medium=repository" target="_blank" rel="noopener">CIS Benchmark</a>).
Kubescape uses&nbsp;<a href="https://github.com/open-policy-agent/opa" target="_blank" rel="noopener">Open Policy Agent</a>&nbsp;to verify Kubernetes objects against&nbsp;<a href="https://github.com/kubescape/regolibrary" target="_blank" rel="noopener">a library of posture controls</a>. By default, the results are printed in a console but they can be exported to JSON and PDF.
Kubescape is running the following tests according to what is defined by Kubernetes Hardening Guidance by NSA and CISA.
<ul>
<li>Non-root containers</li>
<li>Immutable container filesystem</li>
<li>Privileged containers</li>
<li>hostPID, hostIPC privileges</li>
<li>hostNetwork access</li>
<li>allowedHostPaths field</li>
<li>Protecting pod service account tokens</li>
<li>Resource policies</li>
<li>Control plane hardening</li>
<li>Exposed dashboard</li>
<li>Allow privilege escalation</li>
<li>Applications credentials in configuration files</li>
<li>Cluster-admin binding</li>
<li>Exec into container</li>
<li>Dangerous capabilities</li>
<li>Insecure capabilities</li>
<li>Linux hardening</li>
</ul>

An open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters.



Kubescape - An open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters

Vanilla OS is an immutable operating system that prioritizes security and stability. Its core parts of the system are locked down to prevent unwanted changes or corruption caused by third-party applications or faulty updates. Current Vanilla OS is based on Ubuntu-based Linux distribution that provides vanilla GNOME without any changes to the user experience.&nbsp;
Installing packages in the root partition is possible using <a href="https://github.com/Vanilla-OS/ABRoot" target="_blank" rel="noopener">ABRoot</a>, but this approach isn&rsquo;t ideal or recommended as the root partition is small and should get used for kernel modules or root-side essential packages only. <a href="https://github.com/Vanilla-OS/apx" target="_blank" rel="noopener">Apx</a> is a package manager created by the Vanilla OS team is recommended to install packages. Apx can install packages from any Linux distribution (Fedora, Ubuntu, Arch Linux, openSUSE, Alpine Linux, etc).
&nbsp;

Vanilla OS is an Immutable Operating System.

Vanilla OS - Immutable Operating System

EdgelessDB is a full SQL database, tailor-made for confidential computing. It seamlessly integrates with your existing tools and workflows to help you unlock the full potential of your data. All data stored and processed in EdgelessDB is always encrypted and isolated—even in system memory at runtime. Your data is protected even from rogue system administrators, rootkits, and other powerful attackers. This makes EdgelessDB the most secure and most versatile option available for both storing and processing data.
 
Architecturally, EdgelessDB is based on MariaDB. As storage engine, it uses an enhanced version of RocksDB. The file encryption of EdgelessDB's storage engine is designed and built for the enclave and its very strong attacker model. In this context, EdgelessDB's storage engine provides confidentiality, integrity, freshness, auditability, and recoverability for data. Other databases, even when running inside enclaves using general-purpose frameworks, do not have these security properties.

EdgelessDB is a full SQL database, tailor-made for confidential computing. It seamlessly integrates with your existing tools and workflows to help you unlock the full potential of your data. All data stored and processed in EdgelessDB is always encrypted and isolated—even in system memory at runtime. Your data is protected even from rogue system administrators, rootkits, and other powerful attackers. This makes EdgelessDB the most secure and most versatile option available for both storing and processing data.

EdgelessDB - MySQL-compatible database for confidential computing

Acra helps you to easily secure your databases in distributed, microservice-rich environments. It allows you to selectively encrypt sensitive records with strong multi-layer cryptography, detect potential intrusions and SQL injections and cryptographically compartment data stored in large sharded schemes. It's security model guarantees that compromising the database or your application does not leak sensitive data, or keys to decrypt it. 
 
Acra gives you means to encrypt the data on application side into a special cryptographic container, store it in the database and then decrypt in secure compartmented area (separate virtual machine/container). Cryptographic design ensures that no secret (password, key, anything) leaked from the application or database is sufficient to decrypt protected data chunks which originate from it.

Acra helps you to easily secure your databases in distributed, microservice-rich environments. It allows you to selectively encrypt sensitive records with strong multi-layer cryptography, detect potential intrusions and SQL injections and cryptographically compartment data stored in large sharded schemes. It's security model guarantees that compromising the database or your application does not leak sensitive data, or keys to decrypt it. 

Acra - Database protection suite with selective encryption and intrusion detection

Discover open source projects across all platforms

Projects