awesome-devsecops

- Guidelines to running security training within an organisation

- An article explains what DevSecOps aims to achieve, why it’s advantageous, and how the DevSecOps lifecycle looks

- An accessible and thorough resource for anyone seeking to incorporate, from the beginning of the System Development Life Cycle, best security practices in software development

- A community that runs conferences, a blog, a podcast and a Discord dedicated to DevSecOps

- TAG Security facilitates collaboration to discover and produce resources that enable secure access, policy control, and safety for operators, administrators, developers, and end-users across the cloud native ecosystem

- An Australian application security conference run by OWASP

- A network of DevSecOps conferences run by Snyk

- A free biweekly newsletter for security-aware developers covering application security, secure architecture, DevSecOps, cryptography, incidents, etc. that can be useful for builders and (to a lesser extent) for breakers

- Discussions about current events and specific topics related to application security

- Interviews with industry experts about specific application security concepts

- Breaking down the silos of Dev, Sec and Ops, discussing topics that span these subject areas

- Discussions with thought leaders and practitioners to integrate security into the development lifecycle

- Discussion about security tools and best practices for software developers

- A framework of security requirements and controls to help developers design and develop secure web applications

- A collection of secure development standards for C, C++, Java and Android development

- Guidelines for implementing key secure development practices throughout the SDLC

- OWASP's list of top ten controls that should be implemented in every software development project

- A guideline containing specific secure development standards for secure web application development

- A checklist to verify that secure development standards have been followed

- A framework for software security created by observing and analysing data from leading software security initiatives

- A collection of tools and practices that serve as a framework for the secure development lifecycle

- A framework consisting of practices, tasks and implementation examples for a secure development lifecycle

Software Assurance Maturity Model

- A framework to measure and improve the maturity of the secure development lifecycle

- A poster containing the Securing Web Application Technologies (SWAT) Checklist, SANS Cloud Security Curriculum, Cloud Security Top 10, Top 12 Kubernetes Threats, and Secure DevOps Toolchain

- A collection of DevSecOps tooling categorised by tool functionality

Application Security Education

- Training materials created by the Duo application security team, including introductory and advanced training presentations and hands-on labs

- Subscription based online courses with dedicated categories for cybersecurity and DevSecOps

- Hands on labs to understand and exploit simple and advanced web vulnerabilities

- Learn DevSecOps concepts, tools, and techniques from industry experts with practical DevSecOps using state of the art browser-based labs

- Security training for software development teams, designed to be accessible to individuals and small teams as well as larger organisations

- Gamified and hands-on secure development training with support for courses, assessments and tournaments

- Hands-on secure coding training for Developers and Build/Release Engineers

- A presentation created and open-sourced by PagerDuty to provide security training to software engineers

- A presentation created and open-sourced by PagerDuty to provide security training employees

- Free, on-demand courses covering topics including API security, secure coding and application security

- A set of materials and labs to learn and exploit common web vulnerabilities

- Online courses that teach application security theory and hands-on technical lessons

- Introduction to key DevSecOps concepts, processes and technologies

- A repository of information about software vulnerabilities and how to prevent them

Deepfence ThreatMapper

Apache v2, powerful runtime vulnerability scanner for kubernetes, virtual machines and serverless

- Automatically scan GitHub repositories for vulnerabilities and create pull requests to merge in patched dependencies

- Scans dependencies for publicly disclosed vulnerabilities using CLI or build server plugins

- Monitor the volume and severity of vulnerable dependencies across multiple projects over time

- Security and compliance analysis for artifacts stored in JFrog Artifactory

- Vulnerable package auditing for node packages built into the npm CLI

- Automatically monitor and update software dependencies for multiple frameworks and languages using a CLI or git repository apps

- Automated vulnerable dependency monitoring and upgrades for Python projects

- Automated vulnerable dependency monitoring and upgrades using Snyk's dedicated vulnerability database

Automatic API Attack Tool

- Perform automated security scanning against an API based on an API specification

- BurpSuite's web application vulnerability scanner used widely by penetration testers, modified with CI/CD integration and continuous monitoring over multiple web applications

Gauntlt

- A Behaviour Driven Development framework to run security scans using common security tools and test output, defined using Gherkin syntax

Netz

- Discover internet-wide misconfigurations, using zgrab2 and others

RESTler

- A stateful RESTful API scanner based on peer-reviewed research papers

SSL Labs Scan

- Automated scanning for SSL / TLS configuration issues

Zed Attack Proxy (ZAP)

- An open-source web application vulnerability scanner, including an API for CI/CD integration

Checkov

- Scan Terraform, AWS CloudFormation and Kubernetes templates for insecure configuration

KICS

- Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle

- Find misconfiguration both in infrastructure as well as apps as early as commit time

Terrascan

- Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure

Cfn Nag

- Scan AWS CloudFormation templates for insecure configuration

Clair

- Scan App Container and Docker containers for publicly disclosed vulnerabilities

Dagda

- Compares OS and software dependency versions installed in Docker containers with public vulnerability databases, and also performs virus scanning

Docker-Bench-Security

- The Docker Bench for Security is a script that checks for dozens of common best-practices around deploying Docker containers in production

Grype

- An easy-to-integrate open source vulnerability scanning tool for container images and filesystems

Hadolint

- Checks a Dockerfile against known rules and validates inline bash code in RUN statements

- Scan Docker and Kubernetes applications for security vulnerabilities during CI/CD or via continuous monitoring

Trivy

- Simple and comprehensive vulnerability scanner for containers

Regula

- Evaluate Terraform infrastructure-as-code for potential security misconfigurations and compliance violations prior to deployment

- A lightweight, security and compliance focused test framework against terraform to enable negative testing capability for your infrastructure-as-code

Tfsec

- Scan Terraform templates for security misconfiguration and noncompliance with AWS, Azure and GCP security best practice

- An open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters

Kube-Score

- Scan Kubernetes object definitions for security and performance misconfiguration

Kubectrl Kubesec

- Plugin for kubesec.io to perform security risk analysis for Kubernetes resources

Ansible-Lint

- Checks playbooks for practices and behaviour that could potentially be improved. As a community backed project ansible-lint supports only the last two major versions of Ansible

Bad SSL

- A container running a number of webservers with poor SSL / TLS configuration. Useful for testing tooling

Cfngoat

- Cloud Formation templates for creating stacks of intentionally insecure services in AWS. Ideal for testing the Cloud Formation Infrastructure as Code Analysis tools above

CI/CD Goat

- A deliberately vulnerable CI/CD environment. Learn CI/CD security through multiple challenges

- A web application that provides a safe environment to understand and exploit common web vulnerabilities

Juice Shop

- A web application containing the OWASP Top 10 security vulnerabilities and more

Kubernetes Goat

- Intentionally vulnerable cluster environment to learn and practice Kubernetes security

NodeGoat

- A Node.js web application that demonstrates and provides ways to address common security vulnerabilities

- Pentest-Ground is a free playground with deliberately vulnerable web applications and network services

Terragoat

- Terraform templates for creating stacks of intentionally insecure services in AWS, Azure and GCP. Ideal for testing the Terraform Infrastructure as Code Analysis tools above

- A collection of vulnerable web applications for learning purposes

WrongSecrets

- Vulnerable app with examples showing how to not use secrets

- A set of Content Security Policy tools that can test policies, monitor CSP reports and provide metrics and alerts

- Embed privacy controls in your application code to detect and monitor PII as it enters and leaves your systems, preventing it from reaching unintended databases, data streams, or pipelines

- Securely store secrets within Ansible pipelines

- Create and manage cryptographic keys in AWS

- Securely store retrievable application secrets in AWS

- Securely store secrets within Azure

BlackBox

- Encrypt credentials within your code repository

Chef Vault

- Securely store secrets within Chef

CredStash

- Securely store secrets within AWS using KMS and DynamoDB

- Secrets management for applications including secret rotation and auditing

- Store and manage access to secrets within a Docker swarm

Git Secrets

- Scan git repositories for secrets committed within code or commit messages

Gopass

- Password manager for teams relying on Git and gpg. Manages secrets in encrypted files and repositories

- Securely store secrets within GCP

- Securely store secrets via UI, CLI or HTTP API

Keyscope

- Keyscope is an open source key and secret workflow tool (validation, invalidation, etc.) built in Rust

Pinterest Knox

- Securely store, rotate and audit secrets

Secrets Operations (SOPS)

- Encrypt keys stored within YAML, JSON, ENV, INI and BINARY files

Teller

- A secrets management tool for developers - never leave your command line for secrets

- A credential scanning tool that can be run as a task in Azure DevOps pipelines

Detect Secrets

- An aptly named module for (surprise, surprise) detecting secrets within a code base

- A web-based solution that scans and monitors public and private git repositories for secrets

Gitleaks

- Gitleaks is a SAST tool for detecting hardcoded secrets like passwords, api keys, and tokens in git repositories

git-secrets

- Scans commits, commit messages and merges for secrets. Native support for AWS secret patterns, but can be configured to support other patterns

- A web-based platform that monitors for sensitive data disclosure across several SDLC tools, including GitHub repositories

Repo-supervisor

- Secrets scanning tool that can run as a CLI, as a Docker container or in AWS Lambda

- Automated code security, secrets, tokens and sensitive data scanning

truffleHog

- Searches through git repositories for secrets, digging deep into commit history and branches

DevSkim

- A set of IDE plugins, CLIs and other tools that provide security analysis for a number of programming languages

Graudit

- Grep source code for potential security flaws with custom or pre-configured regex signatures

Hawkeye

- Modularised CLI tool for project security, vulnerability and general risk highlighting

- Scan and monitor code for security vulnerabilities using custom or built-in CodeQL queries

- Automated static analysis for PHP, Java and Node.js projects

- Semgrep is a fast, open-source, static analysis tool that finds bugs and enforces code standards at editor, commit, and CI time

- An IDE plugin that highlights potential security security issues, code quality issues and bugs

- Scan code for security and quality issues with support for a wide variety of languages

FlawFinder

- Scan C / C++ code for potential security weaknesses

Puma Scan

- A Visual Studio plugin to scan .NET projects for potential security flaws

Conftest

- Create custom tests to scan any configuration file for security flaws

Selefra

- An open-source policy-as-code software that provides analytics for multi-cloud and SaaS

- Static analysis for JVM deployment units including Ear, War, Jar and APK

Find Security Bugs

- SpotBugs plugin for security audits of Java web applications. Supports Eclipse, IntelliJ, Android Studio and SonarQube

SpotBugs

- Static code analysis for Java applications

- Linting tool for JavaScript with multiple security linting rules available

Golang Security Checker

- CLI tool to scan Go code for potential security flaws

Security Code Scan

- Static code analysis for C# and VB.NET applications

Phan

- Broad static analysis for PHP applications with some support for security scanning features

PHPCS Security Audit

- PHP static analysis with rules for PHP, Drupal 7 and PHP related CVEs

Progpilot

- Static analysis for PHP source code

Bandit

- Find common security vulnerabilities in Python code

Brakeman

- Static analysis tool which checks Ruby on Rails applications for security vulnerabilities

DawnScanner

- Security scanning for Ruby scripts and web application. Supports Ruby on Rails, Sinatra and Padrino frameworks

Harden Runner GitHub Action

- installs a security agent on the GitHub-hosted runner (Ubuntu VM) to prevent exfiltration of credentials, detect compromised dependencies and build tools, and detect tampering of source code during the build

Overlay

- a browser extension helping developers evaluate open source packages before picking them

Preflight

- helps you verify scripts and executables to mitigate supply chain attacks in your CI and other systems, such as in the recent

sigstore is a set of free to use and open source tools, including , and , handling digital signing, verification and checks for provenance needed to make it safer to distribute and use open source software

Syft

- A CLI tool for generating a Software Bill of Materials (SBOM) from container images and filesystems

Awesome Threat Modelling

- A curated list of threat modelling resources

- Treat modelling and attack simulations for IT infrastructure

- Draw threat models and capture threats and countermeasures and manage risk

Raindance Project

- Use attack maps to identify attack surface and adversary strategies that may lead to compromise

- Identify and rank threats, generate actionable tasks and track related tickets

- Threat model diagramming tool

- Threat model diagramming tool

- Define threat modelling as code

Awesome Dynamic Analysis

- A collection of dynamic analysis tools and code quality checkers

Awesome Platform Engineering

A curated list of solutions, tools and resources for

Awesome Static Analysis

- A collection of static analysis tools and code quality checkers

Awesome Threat Modelling

- A curated list of threat modeling resources

- A collection of vulnerable web applications for learning purposes