openmymemo
MyMemoAI
30stars
Your AI memory as a local folder you own. Claude, Codex, Cursor and any MCP app share it; you see every change and can undo it.
Security · GitHub
Protect systems, find vulnerabilities, and improve privacy.
Useful GitHub projects
2,879 projects
SecTools
Myskiv-Ivan
34stars
List of tools for DevSecOps/Appsec and Pentest
XSSRush
N45HT
66stars
Automated Multi-Vector Cross-Site Scripting (XSS) Scanner
osint-mcp
n5za
61stars
86-tool OSINT MCP server with private evidence graphs, image analysis, reverse search, and person dossiers.
nano
nano-rs
75stars
Lightweight open-core SIEM in Rust — S3-compatible for logs, Postgres for state.
impacket-rs
nestho
43stars
High-performance, memory-safe pure-Rust redesign of Impacket protocols and Active Directory tools for Linux, macOS, and Windows.
- Cross-Platform Host & Target Ecosystem: Runs natively on Linux (glibc & static musl), macOS (Apple Silicon & Intel), and Windows. Interacts with both Linux/UNIX targets (Samba, FreeIPA, OpenLDAP, MIT/Heimdal Kerberos KDC) and Windows domains across all eras (Windows 2000 through Windows Server 2025).
- Sub-Millisecond Cold Starts: Starts in < 2ms compared to 150-250ms for Python Impacket, making it ideal for massive orchestrations and fast pivoting.
twofactor_totp
nextcloud
321stars
🔑 Second factor TOTP (RFC 6238) provider for Nextcloud
vulnix
nix-community
884stars
Vulnerability (CVE) scanner for Nix/NixOS [maintainer=@henrirosten]
Identity-Provider
noel-mugisha
176stars
A comprehensive security repo for modern Java backend applications. The only identity provider you’ll ever need.
- Multi-Authentication Support: JWT-based authentication with OAuth2 social login (Google)
- Multi-Factor Authentication: TOTP-based MFA (RFC 6238) compatible with Google Authenticator, Authy, and any standard authenticator app — with QR code enrollment, manual secret entry, and 10 single-use recovery codes
AgePonyAndroid
norsehorse-dev
47stars
Kotlin implementation of the age encryption protocol for Android, with SSH key support. Encrypt and decrypt files locally — no servers, no accounts.
- age encryption and decryption for files and text, byte-compatible with the age CLI
- Post-quantum hybrid recipients (ML-KEM-768 + X25519), encoded as age1pq1... keys
nyxis
NyxFoundation
322stars
A Lean backend framework whose authorization safety is formally proven. The developer writes only a Cedar schema and policies; handlers are built on Supabase Auth and PostgreSQL.
ReconX
ofri09bs
28stars
A modular C-based reconnaissance and enumeration framework
- SQLite Database: SQLite-backed scan history to store and query past reconnaissance results.
- Multithreaded Port Scanner: fast TCP connect scanning using 15 concurrent threads by default , can also do a stealthy SYN Scan
vpnhide
okhsunrog
687stars
Hide active VPN from selected Android apps (kernel module + LSPosed + Zygisk)
opentrap
opentrap
703stars
A free, open-source alternative to Burp Suite: an intercepting proxy and web app security testing suite with Repeater, Intruder, Collaborator and a built-in OWASP ZAP scanner. Linux, AGPL-3.0.
- Proxy-first by design - intercept, replay and edit live traffic, with the whole toolset one click away.
- Detection that stands up - crawl and audit with the proven OWASP ZAP engine, so the findings hold up.
jax-rs-pac4j
pac4j
56stars
Security library for JAX-RS, Jersey and RESTEasy
spark-pac4j-demo
pac4j
38stars
Demo webapp to test the spark-pac4j library for Sparkjava
35stars
Spring Security boot demo using spring-security-pac4j + javaee-pac4j
279stars
Bridge from the pac4j security library to Spring Security (reactive)
44stars
Spring Security boot demo using spring-security-pac4j + spring-webmvc-pac4j
42stars
Spring Boot demo to test the spring-webmvc-pac4j security library
JavaRansomware
PanagiotisDrakatos
137stars
Java Ransomware
- Encrypts files using a robust 256-bit key.
- Fast and efficient for large volumes of data.
XPENC
PATILYASHH
65stars
XPENC — Money, tracked honestly. Offline-first personal finance for Android: income, expenses, budgets, dues & on-device bank-SMS auto-capture. No server, no sign-up. Flutter + Drift.
- 💳 Honest accounts — Cash / Bank / Card / Prepaid, with debit cards & UPI as linked instruments so rupees are never double-counted
- 🎯 Budgets & Envelope Mode — per-category caps, live progress, 80%/overspend alerts, opt-in "every rupee has a job"
cybersecurity-threat-intelligence
paulveillard
67stars
An ongoing & curated collection of awesome software best practices and remediation techniques, libraries and frameworks, E-books and videos, Technical guidelines and important resources about Threat Intelligence.
php2shellbt
pentestershell
82stars
Python scanner for CVE-2026-109618, CVE-2026-109619 and the php2shell session chains (handler mismatch + LFI). No external dependencies.
- 4 detection checks in a single script
- Zero external dependencies — pure Python 3.6+ stdlib