Skip to content

40 results for “SARIF”

ListGrid
What you seeeverything
RecentOldestAddedA–Z
All types40Repos39Articles1
“SARIF”
hackers-arise.comarticle🛡️ Security

Artificial Intelligence (AI) in Cybersecurity, Part 30: Shannon – AI Pentester for Web Apps and APIs

Shannon is a white-box AI pentester (@keygraph/shannon) that analyzes an application's source code, then attacks the running instance and reports only findings with a working PoC. The Hackers Arise tutorial runs it against OWASP Juice Shop in Docker on Kali, using OpenRouter (free Nemotron) and local Ollama (Qwen 2.5 Coder 7B) via a models.json file. Output includes PDF, Markdown, JSON and SARIF reports.

ShannonOpenRouterOllama+3
Juice ShopNemotronKeygraph

AI Security, AppSec, Offensive Security· Published and added 26 Oct 2026

github.comrepo🛡️ Security

Spectrmachina/Ztrust

ZTrust is a Python supply-chain scanner that checks manifests, lockfiles, source and GitHub workflows for vulnerable or malicious dependencies (via OSV.dev), typosquats, leaked secrets, unsafe lockfiles and risky CI patterns such as pwn requests and script injection. It outputs console, JSON and SARIF 2.1.0 and ships as a GitHub Action. It also includes a FastAPI bounty service using commit-reveal and shielded Zcash payouts for researchers.

PythonGitHub ActionsOSV+3
xz-utilstj-actions/changed-filesevent-stream+3

Supply Chain, DevSecOps· Added 27 Oct 2026, published 22 Oct 2026

github.comrepo🛡️ Security

https://github.com/dmdhrumilmistry/security-harness

security-harness is an open-source Claude Code plugin (also packaged for Gemini CLI, Codex and opencode) that orchestrates subagents — sh-recon, sh-hunter, sh-chainer, sh-verifier, sh-reporter — through a static-analysis pipeline covering 15 vulnerability classes (IDOR/BOLA, SQLi, XSS, SSRF, injection, auth, deserialization, path traversal, secrets, CSRF, XXE, open redirect, crypto, race conditions, file upload), producing README/JSON/SARIF/HTML/PDF reports with PoCs, CVSS and CWE/OWASP mappings. It also ships sh-pr-review, a per-PR merge-gate skill that posts inline findings and a commit status scoped only to code the PR itself introduced or aggravated, with caching, dedup via fingerprints, and a scheduled GitHub Action that keeps its per-class knowledge bases fresh by having one AI agent draft updates from allowlisted sources (OWASP, PortSwigger Research, CWE/CAPEC, HackerOne) while a separate adversarial reviewer agent fails-closed against prompt injection before auto-merge.

Claude CodeGemini CLISARIF+3
IDORBOLASSRF+1

AppSec, AI Security, DevSecOps· Added 2 Oct 2026, published 29 Sep 2026

github.comrepo🛡️ Security

Agent Threat Rules (ATR) — open detection-rule standard for AI agent threats

Agent Threat Rules (ATR) is an open, versioned YAML rule format (ATR-YYYY-NNNNN scheme) for detecting AI-agent runtime threats — prompt injection, tool-poisoning, malicious SKILL.md content, and MCP exchange abuse — evaluated by a reference TypeScript engine (with a Python wrapper) shipped as an npm/pip package, CLI, GitHub Action, and Docker scanner with SARIF output. The project positions itself as "Sigma for agent threats," maps rules to OWASP Agentic/LLM Top 10, MITRE ATLAS, and NIST AI RMF, and publishes an extensive (and unusually self-critical) benchmark suite against corpora like garak, PromptBench, and PromptInject, including documented harness bugs and withdrawn recall figures.

Model Context ProtocolnpmTypeScript+3
CVE-2026-26030CVE-2026-25592OWASP Top 10 for Agentic Applications+2

AI Security· Added 26 Sep 2026

github.comrepo🛡️ Security

graygnatconsole/mcp-audit-tool

mcp-audit-tool is a dependency-light Python CLI that statically scans Claude Desktop, Cursor, Windsurf, Cline, Zed, and VS Code MCP configuration files for security issues, including hardcoded secrets, unpinned/rug-pull packages, pipe-to-shell installers, tool-poisoning via hidden instructions in tool descriptions, filesystem servers rooted at '/', and unauthenticated plaintext HTTP MCP endpoints. It auto-discovers configs across macOS/Linux/Windows, produces a security score/grade plus SARIF 2.1.0 output for GitHub Code Scanning, and is built around the OWASP MCP Top 10 categories with a CI/CD example that fails builds on severity thresholds. The roadmap adds live server probing over stdio/SSE for runtime rug-pull detection and an ML-based prompt-injection classifier for tool descriptions.

Model Context ProtocolClaude DesktopCursor+7
OWASP MCP Top 10

AI Security, DevSecOps· Published and added 26 Sep 2026

github.comrepo🛡️ Security

git-pkgs — dependency history & supply-chain analysis for git repos

git-pkgs is a Go rewrite of a Ruby tool that adds a git subcommand for tracking dependency changes across a repository's history, indexing manifests/lockfiles from 36+ package managers (npm, RubyGems, Cargo, PyPI, Maven, Composer, Go modules, etc.) into a local SQLite database. Beyond history/blame/diff, it offers supply-chain security commands: `vulns` (OSV-based CVE scanning with SARIF output for GitHub code scanning, plus blame/praise/exposure for remediation metrics), `licenses` (with drift detection and CI-friendly exit codes), `deprecated`, `provenance` (trusted-publishing/attestation checks), `integrity` (lockfile hash drift detection), `maintainers`/`health` (via ecosyste.ms metadata), and `sbom` export in CycloneDX/SPDX. It also supports a dependency-aware `bisect` to find when a vulnerability, license change, or capability (e.g. network access) was introduced, and ships GitHub Actions for CI integration.

npmSBOMOSV+3
CVE-2024-1234PURL

Supply Chain, DevSecOps· Added 25 Sep 2026

github.comrepo🛡️ Security

https://github.com/akha-security/akca

AKCA is an open-source, Go-based Dynamic Application Security Testing (DAST) scanner that combines HTTP and headless-browser crawling, JavaScript/AST analysis, API spec import (OpenAPI, GraphQL, gRPC, etc.), and adaptive active testing across a very broad set of vulnerability classes including SQL injection, XSS, SSRF, IDOR/BOLA, SSTI, JWT/OAuth flaws, race conditions, and cloud/CI exposure. It emphasizes evidence-oriented verification — replaying promising signals against baselines, negative controls, and OAST callbacks before promoting them to findings — and exports Burp-style HTTP evidence in HTML, JSON, CSV, Markdown, and SARIF reports. Positioned as a transparent, single-developer alternative inspired by but not claiming parity with Acunetix, Invicti/Netsparker, or Burp Suite Professional.

GoBurp SuiteSARIF+3
IDORBOLASSRF+1

AppSec· Added 2 Oct 2026, published 23 Sep 2026

github.comrepo🛡️ Security

StellarFoundry/soroban-security-scanner

soroban-scan is an open-source, deterministic static analyzer for Stellar Soroban smart contracts and Rust projects. It ships 19 Soroban-aware detectors (SS-001 to SS-033) covering missing authorization, re-initialization, cross-contract call ordering, unchecked arithmetic and storage or resource misuse. Output includes JSON, SARIF 2.1.0 and GitHub annotations, with baselines and a PR-scanning Action. The project describes itself as early development.

SorobanStellarRust+2

AppSec· Added 28 Oct 2026, published 21 Sep 2026

github.comrepo🛡️ Security

Shai-Hulud-2.0-Detector — npm supply-chain compromise scanner

Shai-Hulud-2.0-Detector is a GitHub Action and CLI tool that scans package.json/lockfiles for packages compromised in the Shai-Hulud 2.0 (Nov 2025) and ChainDrop (Aug 2026) npm supply-chain worms. It uses semver-precise matching against a database of 1,241+ known-compromised package versions (auto-updated daily from Datadog and Wiz Research feeds) to flag malicious preinstall/postinstall droppers (setup_bun.js, Math_Symbol.js), rogue GitHub self-hosted runners named SHA1HULUD, and ChainDrop's new IDE-persistence hooks in .claude/settings.json and .vscode/tasks.json. It ships SARIF output for GitHub Security tab integration, an allowlist system, and a detailed incident-response guide covering credential rotation and forensic checks.

npmGitHub ActionsBun+3
Shai-Hulud 2.0ChainDropkeyv+6

Supply Chain, DevSecOps, Blue Team & Detection· Added 16 Sep 2026

github.comrepo🛡️ Security

MassPIIFinder v2

MassPIIFinder v2 is a Python recon tool that automates crawling a target's in-scope JavaScript (multi-hop HTML crawl, dynamic imports, chunk manifests, sourcemaps, plus optional passive CT-log subdomain discovery) and mines it for API keys, tokens, credentials, internal endpoints, and PII using ~90 named patterns plus a high-entropy freeform heuristic. Findings are validated offline (Luhn checks, JWT decode, AWS key-shape) and via scope-checked, rate-limited reachability probes, then triaged by severity and exported as JSON/HTML/SARIF/Markdown/CSV. It enforces authorization with a required --confirm-authorized flag and a ScopeGuard that blocks any out-of-scope requests, and explicitly avoids testing leaked keys against third-party providers or exploiting findings.

PythonFlaskSQLite+1

OSINT, AppSec· Added 22 Sep 2026, published 15 Sep 2026

github.comrepo🛡️ Security

vet (SafeDep)

vet is an open-source CLI (from SafeDep) that scans package manifests, SBOMs, container images, and source repos across npm, PyPI, Maven, Go, RubyGems, Cargo, and Packagist to surface vulnerabilities, malicious packages, and license/quality issues. It cuts through CVE noise by analyzing actual code-usage evidence, queries SafeDep Cloud's threat-intelligence database for real-time malware detection (e.g. flagged packages like express-cookie-parser, eslint-config-airbnb-compat), and lets teams enforce security/license/OpenSSF-Scorecard policies as CEL expressions in CI/CD via SARIF/JSON/Markdown reporting.

npmPyPIMaven+3
MAL-2025-3541MAL-2025-4339MAL-2025-4029+2

Supply Chain, DevSecOps· Published and added 7 Sep 2026

github.comrepo🛡️ Security

ForgeGuardian

ForgeGuardian is an open-source (Apache 2.0) supply chain security scanner covering 9 package ecosystems (npm, PyPI, Go, Maven, RubyGems, Cargo, NuGet, Hugging Face, GitHub Actions) via 8 concurrent scan engines and 223+ built-in malicious-package detection signatures. It runs fully offline/local-first, offers a CLI (fgctl) and self-hosted SOC-style dashboard, generates CycloneDX/SPDX SBOMs, supports Sigstore keyless signing and provenance tracking, policy-as-code rules, dependency topology/attack-surface mapping, drift detection with auto-quarantine, and SARIF output for GitHub Actions CI integration, plus optional AI-powered advisory/patch-agent triage.

npmPyPIGo+3

Supply Chain, DevSecOps· Published and added 5 Sep 2026

github.comrepo🛡️ Security

eldarshiraliyev/BugScanner

BugScanner is an asyncio/httpx Python framework for recon and automated web vulnerability scanning, with a React and FastAPI dashboard. It covers subdomain enumeration (crt.sh, DNS brute force), TCP port scanning, fingerprinting, and modules for XSS, SQLi, CORS, SSRF, open redirect, JWT, IDOR and business logic, plus a Nuclei wrapper. A 5-rule false-positive filter with SPA detection, adaptive rate limiting, WAF detection and SARIF export are included.

PythonNucleiFastAPI+3
IDORSSRFCWE-89

AppSec, Offensive Security, OSINT· Added 20 Oct 2026, published 5 Sep 2026

github.comrepo🛡️ Security

PackageGuard

PackageGuard is an open-source .NET CLI tool that scans NuGet, npm, pnpm and Yarn dependencies (direct and transitive) across a codebase, enforcing hierarchically-configured allow- and deny-lists for licenses, packages and versions. It scores each package's Legal, Security and Operational risk using signals like OSV vulnerability data, maintainer activity, package signing and release cadence, and can emit a CycloneDX or SPDX SBOM enriched with OSV vulnerability data, plus console, HTML and SARIF output for CI/GitHub code scanning. It's positioned as a free alternative to commercial supply-chain tools like Black Duck and Snyk.

NuGetnpmpnpm+3

Supply Chain, DevSecOps· Published and added 31 Aug 2026

github.comrepo🛡️ Security

flawed

flawed is a static-analysis engine for Python web applications that builds a framework-aware model of an app's routes, request inputs, state effects, call graph, and value flow, exposing it both as a queryable Python library (open_repo(), load_findings()) and a CLI scanner. It runs pluggable rule modules (@detector contract) across three layers — L1 index, L2 semantic model, L3 rules — and outputs findings as JSON/SARIF with baseline diffing support for CI use.

PythonSARIF

AppSec· Published and added 23 Aug 2026

github.comrepo🛡️ Security

Deep Eye

Deep Eye is an open-source Python pentesting framework that orchestrates 11 AI providers (OpenAI, Claude, Grok, Gemini, Ollama, Groq, Mistral, OpenRouter, LiteLLM, LM Studio, and more) with automatic failover to generate context-aware attack payloads for 50+ vulnerability classes including SQLi, XSS, SSRF, IDOR, JWT and GraphQL flaws. It adds an RAG-indexed CVE intelligence DB built from NVD/MITRE/Exploit-DB, AI-based finding triage and false-positive filtering, Nuclei-style YAML templates, Playwright browser automation, CAPTCHA-solving (reCAPTCHA/hCaptcha/Turnstile/Arkose), mitmproxy interception, and auto-generated HackerOne-style bug bounty reports with PCI-DSS/SOC2/ISO 27001 compliance mapping, SARIF/JUnit export, scan diffing, and retest workflows.

OpenAIClaudeGemini+3
PCI DSSSOC 2ISO 27001:2022+3

Offensive Security, AI Security· Added 3 Sep 2026, published 22 Aug 2026

github.comrepo🛡️ Security

SecureAI-Scan

SecureAI-Scan is an offline CLI that performs import-resolved dataflow analysis on TypeScript, JavaScript, and Python code to find LLM/MCP/Agent-Skill/RAG-specific risks (prompt injection, tool poisoning, unsafe output handling, vector-store access control), mapped to the OWASP Top 10 for LLM Applications, Agentic Applications, and MCP Top 10. It distinguishes proven dataflow traces from heuristic keyword matches, scans .mcp.json/claude_desktop_config.json/SKILL.md for tool-poisoning and command-injection patterns (citing the WhatsApp MCP rug-pull and postmark-mcp backdoor), and includes evasion-resistant deobfuscation checks built in response to the "Cloak and Detonate" adversarial study (arXiv:2607.02357) that bypassed most published skill scanners. It also runs offline advisory checks against known-malicious/vulnerable packages (validated against CVE-2025-6514 and CVE-2024-34359) and integrates via GitHub Actions, pre-commit hooks, SARIF output, and an MCP server for Claude Code.

Model Context ProtocolTypeScriptPython+3
CVE-2025-6514CVE-2024-34359postmark-mcp backdoor+4

AI Security, Supply Chain· Published and added 5 Aug 2026

github.comrepo🛡️ Security

npm-scan

npm-scan is a CLI supply-chain security scanner (@lateos/npm-scan) that inspects npm packages and lockfiles for behavioral attack patterns missed by npm audit/Snyk/Socket, including obfuscated payloads, credential stealers, eBPF kernel rootkits, memory-level OIDC token extraction, GitHub maintainer-account spoofing, and AI-platform-targeted key theft. It ships 23 detectors (D1-D25), validated against real campaigns like IronWorm and Miasma, and outputs SBOM (CycloneDX/SPDX) and SARIF for GitHub Security, plus a workflow to submit critical findings to CISA's VINCE with mandatory manual review. It's free (MIT) for individuals/OSS/evaluation, with paid commercial tiers ($799-$9,900/yr).

npmGitHub ActionsDocker+3
IronWormMiasmaCISA+1

Supply Chain, DevSecOps· Published and added 5 Aug 2026

github.comrepo🛡️ Security

Beetle

Beetle is an offline-first mobile application security platform that statically analyzes Android APKs and iOS IPAs (including Flutter and React Native apps), combining decompilation, taint analysis, secret/endpoint extraction, certificate and native-binary hardening checks, and CVE enrichment with explainable 'intelligence engines' (ownership, confidence, evidence selection, finding fusion) that correlate findings into evidence-backed attack chains. It maps results to OWASP MASVS/Mobile Top 10, provides source-level navigation, and exports SARIF, CycloneDX SBOM, and PDF reports, with optional (non-scanning) AI assistance via Claude, OpenAI, Gemini, DeepSeek, or local Ollama for explaining findings.

AndroidiOSDocker+3

Mobile Security, AppSec· Published and added 31 Jul 2026

github.comrepo🛡️ Security

Talaria

Talaria is a single-binary, pure-Go Linux privilege escalation scanner that enumerates misconfigurations (SUID/SGID, sudoers, capabilities, cron, Polkit JS rules, systemd EnvironmentFile overrides) and links them into confirmed multi-stage root-escalation chains using an embedded Dijkstra pathfinder. It runs read-only with no disk writes, executes in milliseconds, detects backport-aware 2026 Linux kernel vulnerabilities (Dirty Frag, Fragnesia, Copy Fail, DirtyClone, CIFSwitch, PinTheft, pedit COW), and exports JSON/SARIF for SIEM and GitHub Code Scanning integration.

GoLinuxLinux kernel+2
FragnesiaDirty FragCopy Fail+4

Offensive Security· Added 3 Sep 2026, published 31 Jul 2026

github.comrepo🛡️ Security

Semgrep Rules (0xdea)

A "battle-tested" collection of Semgrep rules by researcher 0xdea aimed at C (and some C++) vulnerability hunting, covering buffer overflows, use-after-free/double-free, format string bugs, integer truncation/wraparound, command injection, insecure APIs (gets, strcpy, sprintf, scanf family), privilege management ordering, ReDoS, and dozens of other memory-safety and secure-coding checks. Rules are published to the Semgrep registry as "p/0xdea" and can be run directly via `semgrep --config "p/0xdea"` or cloned locally, with SARIF output support for triage in VS Code via SARIF Explorer. The repo also documents a roadmap including porting rules to the Semgrep Pro engine for taint/inter-procedural analysis.

SemgrepCSARIF+1
use-after-freedouble-freeformat string bugs+4

AppSec· Added 3 Sep 2026, published 31 Jul 2026

github.comrepo🛡️ Security

glsec

glsec is a security linter for GitLab CI (.gitlab-ci.yml) configuration files, analogous to zizmor/actionlint for GitHub Actions. It detects misconfigurations like mutable image tags, unquoted user-controlled CI variables in scripts, and other issues mapped to 84 rules across 8 OWASP CI/CD Security categories (excluding IAM and logging, which require platform-level access). It supports baseline/ignore workflows, ShellCheck integration, SARIF/Code Climate/JUnit output for GitLab dashboards, a pre-commit hook, and a Claude Code plugin, and ships releases with Sigstore/cosign signing and SLSA provenance attestations.

GitLab CISARIFSigstore+3
GL001GL002GL003+4

DevSecOps· Published and added 29 Jul 2026

github.comrepo🛡️ Security

Visa Vulnerability Agentic Harness (VVAH)

VVAH is Visa's open-source agentic harness that runs an eleven-stage (S0–S11) LLM pipeline to discover, verify, report, and optionally remediate/validate application vulnerabilities, built on learnings from Anthropic's Project Glasswing. It combines threat-modeled discovery, multi-lens adversarial analysis, interprocedural taint analysis, and a beta live-HTTP "exploit verification" stage (S6) that proves exploitability and supports regression-testing fixes via ev-replay, outputting Markdown and SARIF 2.1.0 findings with CVSS/CWE data.

SARIFCVSSPython+3
Project Glasswing

AppSec, AI Security· Published and added 29 Jul 2026

github.comrepo🛡️ Security

HOL Guard

HOL Guard is an open-source local "antivirus" runtime protection layer for AI coding agents that intercepts shell commands, file access, package installs, and MCP tool calls before execution, classifying them for secret exposure, destructive operations, prompt injection, and supply-chain risk, then allowing/blocking/requesting approval per policy. It integrates via native hooks and managed MCP proxies with Codex, Claude Code, GitHub Copilot CLI, Cursor, Cline, Gemini CLI, Grok, and other agents, and includes a supply-chain package/advisory checker (hol-guard supply-chain scan/explain). The repo also bundles plugin-scanner, a companion CLI/GitHub Action that lints and scores agent plugins, skills, and MCP integrations for manifest issues, secrets, MCP transport risks, and dependency/lockfile problems, producing SARIF/JSON reports for CI gating.

Model Context ProtocolCodexClaude Code+5
HOL Guardplugin-scannerHCS-28

AI Security· Published and added 15 Jul 2026

github.comrepo🛡️ Security

apisec-inc/AI-Surface

ai-surface is a local/offline static analysis CLI (apisec-inc) that scans a codebase for AI attack surface — LLM SDK calls, agent frameworks (LangChain, AWS Strands), MCP servers, RAG/vector stores, model gateways, and provider keys — and flags risk indicators such as financial-action tools with no human approval or unverified MCP servers. It generates an AI-BOM (CycloneDX), SARIF for GitHub code scanning, and maps findings to OWASP LLM Top 10, EU AI Act, NIST AI RMF, and ISO/IEC 42001, with a baseline+fail-on-severity workflow for gating new risk in PRs without blocking on pre-existing debt.

Model Context ProtocolLangChainPython+4
OWASP Top 10 for LLM ApplicationsEU AI ActNIST AI RMF+1

AI Security, DevSecOps· Published and added 11 Jul 2026

github.comrepo🛡️ Security

0xSteph/pentest-ai

Pentest-AI (ptai) is an MIT-licensed tool that connects an AI client (Claude Code, Codex, or a local Ollama model) via MCP, CLI, or CI to drive a penetration-testing workflow. It uses "oracles" to reproduce candidate findings against a control case and stores results as replayable, portable proof capsules, distinguishing verified findings from unverified scanner/model output; it supports CI gating with SARIF export and OAST-based blind-vulnerability checks.

Model Context ProtocolClaude CodeCodex+4

AI Security, Offensive Security· Published and added 4 Jul 2026

github.comrepo🛡️ Security

OASIS

OASIS (Open Automated Security Intelligence Scanner) is an AI-powered SAST tool that runs local LLMs via Ollama or any OpenAI-compatible backend (vLLM, LiteLLM, LM Studio, llama.cpp) to detect vulnerabilities like SQLi and XSS in source code. It uses a two-phase scan (lightweight scan model + deep analysis model) orchestrated by a LangGraph pipeline (discover→scan→expand→deep→verify→report), adds a deterministic finding-validation agent that computes exploitability verdicts with confidence, and exports canonical JSON/SARIF/HTML/PDF reports with a web dashboard, RAG-backed chat assistant, --fail-on CI gating, and suppression/inline-ignore support.

OllamavLLMLiteLLM+3

AI Security, AppSec· Published and added 28 Jun 2026

github.comrepo🛡️ Security

Teycir/SkillsGuard

SkillsGuard is a zero-dependency static security scanner for AI agent skill packages (SKILL.md files and bundled scripts) that detects prompt injection, exfiltration, obfuscated payloads, persistence, and privilege escalation before an agent reads or executes them. It recursively decodes base64/hex/URL-encoded blobs to catch hidden attacks like a base64-wrapped reverse shell, computes a 0-100 risk score, and integrates into CI (SARIF/JSON output), git pre-commit hooks, and Claude via an MCP server (scan_skill tool) or a free hosted Cloudflare Workers API. The README also situates it against competing agent-skill scanners (NVIDIA, Cisco, Snyk, Mondoo, SkillSpector, SkillScan), noting it's the only one requiring no account/API/LLM dependency versus SkillSpector's LLM-augmented semantic analysis backed by a study of 42,447 scanned skills.

Node.jsModel Context ProtocolSARIF+3
SkillSpector

AI Security, DevSecOps· Published and added 21 Jun 2026

github.comrepo🛡️ Security

SuperagenticAI/superclaw

SuperClaw is a pre-deployment security testing framework for autonomous AI coding agents like OpenClaw, generating scenario-driven adversarial tests for prompt injection, jailbreaks, tool misuse, and behavioral drift. It scores agent behavior against explicit security contracts with rubric-based evidence (tool calls, outputs) and produces HTML/JSON/SARIF reports, with local-only mode and auth-token gating for remote targets to reduce misuse risk.

OpenClawSARIFPython

AI Security, Offensive Security· Published and added 18 Jun 2026

github.comrepo🛡️ Security

VICE

VICE is an open-source (MIT) Node.js security auditing CLI with two modes: a remote black-box scan that crawls a target with a headless browser across 15-16 security modules (headers, TLS, Supabase access controls, subdomains, storage buckets, WebSockets), and a local white-box audit that scans source code for secrets, .env exposure, npm vulnerabilities, missing Supabase RLS policies, SQL injection and XSS. It ships as a GitHub Action that posts PR comments with a security score, uploads SARIF findings to GitHub Code Scanning, gates merges on a minimum score, and maintains a live README badge. Version 3.4.0 adds an AI/RAG security module for testing chat/agent API endpoints for access control, prompt injection, retrieval isolation, and tool-security issues.

Node.jsnpmGitHub Actions+3

AppSec, DevSecOps, AI Security· Published and added 14 Jun 2026

Showing 30 of 40

Show more