103 Open source projects that are alternatives of or similar to perimeterator

Centralize Vulnerability Assessment and Management for DevSecOps Team

The DevSecOps toolset for REST APIs

📚 Overview 🔒 Tooling 🔒 Process 🔒 Physical 🔒 People 📚

TerraGoat is Bridgecrew's "Vulnerable by Design" Terraform repository. TerraGoat is a learning and training project that demonstrates how common configuration errors can find their way into production cloud environments.

This repository contains information about DevSecOps and how to get involved in this community effort.

ContainerSSH: Launch containers on demand

Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.

REST API backend for Reconmap

Agile Threat Modeling Toolkit

A curated list of threat modeling resources (Books, courses - free and paid, videos, tools, tutorials and workshops to practice on ) for learning Threat modeling and initial phases of security review.

Faraday introduces a new concept - IPE (Integrated Penetration-Test Environment) a multiuser Penetration test IDE. Designed for distributing, indexing, and analyzing the data generated during a security audit.

Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.

Identify hardcoded secrets and dangerous behaviours

All-in-one tool for managing vulnerability reports from AppSec pipelines

The Solutions Delivery Platform runtime pipeline framework

Kubernetes Goat is "Vulnerable by Design" Kubernetes Cluster. Designed to be an intentionally vulnerable cluster environment to learn and practice Kubernetes security.

Curating the best DevSecOps resources and tooling.

Awesome PHP Security Resources 🕶🐘🔐

GitGuardian Shield GitHub Action - Find exposed credentials in your commits

Identify vulnerabilities in running containers, images, hosts and repositories

🔐 Docker Container for Penetration Testing & Security

Hunter作为中通DevSecOps闭环方案中的一环，扮演着很重要的角色，开源之后希望能帮助到更多企业。

GitGuardian Shield GitHub Action - Find exposed credentials in your commits

nodejsscan is a static security code scanner for Node.js applications.

IAST 灰盒扫描工具

🛡️ Make your web services secure by default !

njsscan is a semantic aware SAST tool that can find insecure code patterns in your Node.js applications.

An authoritative list of awesome devsecops tools with the help from community experiments and contributions.

Kubernetes Common Configuration Scoring System

Prowler is an Open Source Security tool for AWS, Azure and GCP to perform Cloud Security best practices assessments, audits, incident response, compliance, continuous monitoring, hardening and forensics readiness. It contains hundreds of controls covering CIS, PCI-DSS, ISO27001, GDPR, HIPAA, FFIEC, SOC2, AWS FTR, ENS and custom security frameworks.

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

The Secure Coding Framework

Подборка выступлений и публикаций на тему DevSecOps на русском и не только)

CLI to interact with Kondukto

Reapsaw is a continuous security devsecops tool, which helps in enabling security into CI/CD Pipeline. It supports coverage for multiple programming languages.

Prevent cloud misconfigurations during build-time for Terraform, Cloudformation, Kubernetes, Serverless framework and other infrastructure-as-code-languages with Checkov by Bridgecrew.

CMS Scanner: Scan Wordpress, Drupal, Joomla, vBulletin websites for Security issues

Scanner for vulnerabilities in container images, file systems, and Git repositories, as well as for configuration issues

Detect secret in source code, scan your repo for leaks. Find secrets with GitGuardian and prevent leaked credentials. GitGuardian is an automated secrets detection & remediation service.

SBT Plugin for OWASP DependencyCheck. Monitor your dependencies and report if there are any publicly known vulnerabilities (e.g. CVEs). 🌈

kube-scan: Octarine k8s cluster risk assessment tool

LunaSec - Dependency Security Scanner that automatically notifies you about vulnerabilities like Log4Shell or node-ipc in your Pull Requests and Builds. Protect yourself in 30 seconds with the LunaTrace GitHub App: https://github.com/marketplace/lunatrace-by-lunasec/

Application Security Automation

A unified DevSecOps Framework that allows you to go from iterative, collaborative Threat Modeling to Application Security Test Orchestration

Dow Jones Hammer : Protect the cloud with the power of the cloud(AWS)

🔐 Authentication, Authorization, and Accounting (AAA) App and Plugin for Caddy v2. 💎 Implements Form-Based, Basic, Local, LDAP, OpenID Connect, OAuth 2.0 (Github, Google, Facebook, Okta, etc.), SAML Authentication. MFA/2FA with App Authenticators and Yubico. 💎 Authorization with JWT/PASETO tokens. 🔐

Knowledge seeks no man

🔱 Collection and Roadmap for everyone who wants DevSecOps.

secureCodeBox (SCB) - continuous secure delivery out of the box

Ultimate DevSecOps library

Some of the questions which i was asked when i was giving interviews for Application/Product Security roles. I am sure this is not an exhaustive list but i felt these questions were important to be asked and some were challenging to answer

🔥Open source RASP solution

Security scanner for your Terraform code

Scan is a free & Open Source DevSecOps tool for performing static analysis based security testing of your applications and its dependencies. CI and Git friendly.

Awesome DevSecOps на русском языке

Detect Sensitive REST API communication using Deep Neural Networks

Fully open-source security audit for project dependencies based on known vulnerabilities and advisories. Supports both local repos and container images. Integrates with various CI environments such as Azure Pipelines, CircleCI and Google CloudBuild. No server required!

Find and fix 360+ types of hardcoded secrets and 70+ types of infrastructure-as-code misconfigurations.

ChopChop is a CLI to help developers scanning endpoints and identifying exposition of sensitive services/files/folders.

DefectDojo is an open-source application vulnerability correlation and security orchestration tool.