27 results for “SEC”

List Grid

What you seeeverything

Recent Oldest Added A–Z

All types1919 Articles771 Write-ups333 Papers265 Repos252 Advisories122

More types6

Threads87 Tools27 Talks22 Other18 Courses12 Videos10

🛠️ Tools “SEC”Clear all

spm.threat-modeling.comtool🛡️ Security

CISO Security Program Management 2026

Security Posture Management is a web tool that maps 30 CISO-accountable security topics across the five NIST Cybersecurity Framework functions. It tracks current maturity, KPIs, risks and audit findings per topic. It also records target maturity, target dates, accountable owners and review dates, flagging topics unreviewed for 6 months as due and 12 months as overdue. Initiatives link to topics and risks with owner, budget, dates and expected maturity uplift.

NIST Cybersecurity Framework

GRC· Added 29 Oct 2026

mcpmarket.comtool🧠 AI

Search Search results for "security" | MCP Market

MCP Market search results for "security" in its skills category, listing about 20 installable AI agent skills. Entries cover OWASP Top 10 audits, secure PHP coding, STRIDE threat modeling, CVE remediation, security header analysis, misconfiguration finding, bug bounty triage and AgentShield scans of Claude Code configurations. One is a paid D365FO security-role XML skill. Each entry has only a one-line description and a category label.

Claude CodeAgentShieldPHP+1

MCP MarketOWASPSTRIDE

coding-agents, prompting· Added 25 Oct 2026

thomasunise.comtool🛡️ Security

Argus – a free, open-source agentic security operations platform – MIT

Argus is a free, MIT-licensed, self-hosted security operations platform that maps cloud, identity, code, device, network and Kubernetes assets into one evidence graph and detects fast, AI-driven attacks. Read-only AI agents investigate and only propose actions. Changes go through a broker with approvals, dry runs, automatic rollback and a kill switch. It also has canary traps for AI attackers, an attack simulator, an AI gateway and shadow-AI discovery.

ArgusCrowdStrikeSentinelOne+3

CISA KEVprompt injectionSOC 2+1

AI Security, Blue Team & Detection· Added 25 Oct 2026, published 24 Oct 2026

simonwillison.nettool🧠 AI

Quick Study

Quick Study is a browser artifact built by Claude Opus 5.5 (High) from a single prompt. The user opens a photo and the page repaints it in a few seconds with a simulated paintbrush on a canvas element. Simon Willison links it to an earlier experiment in which Claude Fable simulated a watercolor illustration with P5.js. The post gives the prompt but no code walkthrough.

ClaudeJavaScriptP5.js

Simon WillisonClaude Opus 5.5Claude Fable 5.1+1

prompting, models· Published and added 23 Oct 2026

jevcards.comtool🧠 AI

Show HN: Jev Cards, Can you beat a vision model at a picture quiz?

Jev Cards is a browser picture quiz where a player competes against Jev 1.14, a vision decision model. The 490 cards cover fruit, flags, maps, chess and illusions. Jev reads the image and question and returns a probability for every option, or a box for "tap the place" cards, in one call of about 0.25 seconds. It never writes text. The page reports 5,256 wins in 6,820 games.

Jev

multimodal, evals· Added 21 Oct 2026, published 20 Oct 2026

scfcontrolsplatform.comtool🛡️ Security

SCF Controls Platform — open source

SCF Controls Platform is free, open-source (AGPL-3.0) GRC software built on the Secure Controls Framework. It covers the 1,451-control SCF catalog with 354+ framework mappings, L0–L5 evidence maturity scoring, a risk register linked to controls, and audit workspaces. It self-hosts via Docker Compose or a Helm chart for Kubernetes, and is independent of ComplianceForge, which publishes the SCF.

SCF Controls PlatformSecure Controls FrameworkDocker+2

ComplianceForgeSOC 2ISO 27001+4

GRC· Added 20 Oct 2026

labs.securitykid.comtool🛡️ Security

SecurityKid — learn secure code review on real vulnerabilities

SecurityKid Labs is a practice platform for vulnerability code review built on real GitHub security advisories, de-identified and scrubbed. Users get a scope and a diff, pin the vulnerable line, name the root cause, and defend claims against an AI mentor. They then see the advisory patch and can earn verified badges and public writeups. The page gives no case list or pricing.

GitHub

SecurityKid

Learning, AppSec· Added 20 Oct 2026

securitylabs.datadoghq.comtool🛡️ Security

Datadog pathrunner: AWS IAM privilege escalation framework

pathrunner is a modular offensive framework from Datadog Security Labs that automates exploitation of the AWS IAM privilege escalation paths catalogued in pathfinding.cloud and deployed in Pathfinding Labs. It has over 80 exploit modules (as of October 2026), identity import and switching, multiple payloads per module, and attacker infrastructure deployment with a credential listener. A workspace report lists created resources and expected CloudTrail events for defenders.

AWSAWS IAMAWS Bedrock

pathrunnerpathfinding.cloudPathfinding Labs+2

Cloud & Infra, Offensive Security, Blue Team & Detection· Added 23 Oct 2026, published 20 Oct 2026

x.comtool🛡️ Security

Trail of Bits (@trailofbits) on X

Trail of Bits announces SequenceHash, a library for hashing several inputs without concatenation ambiguity. Plain concatenation lets different input sequences produce the same SHA-256 digest. SequenceHash appends each input's length as a fixed 128-bit integer so every sequence has a single encoding. It ships for Rust, Go and Python, and removes a recurring bug class in crypto and appsec code.

RustGoPython

Trail of BitsSequenceHash

AppSec· Added 11 Oct 2026, published 9 Oct 2026

github.comtool🛡️ Security

https://github.com/praetorian-inc/gato

Gato (GitHub Attack Toolkit) from Praetorian is a Python CLI for enumerating and attacking GitHub organizations' CI/CD pipelines: it identifies poisoned pipeline execution risks, abuses self-hosted runners via workflow and run-log analysis, exfiltrates Actions secrets, and automates fork-PR/workflow-based command execution. Version 1.7 added an Actions Artifacts Secrets Scanner that downloads and recursively scans workflow artifacts with NoseyParker, which Praetorian used to find critical secrets leaks in prominent open-source projects. The project is now archived/superseded by Praetorian's multi-platform tool Trajan, which merges Gato (GitHub) and Glato (GitLab) attack capabilities.

GitHub ActionsGitHubPython+2

poisoned pipeline execution

DevSecOps, Offensive Security· Published and added 2 Oct 2026

x.comtool🛡️ Security

Python Hub (@PythonHub) on X

TATS is an open-source Python tool that analyzes OAuth 2.0, OpenID Connect, and Microsoft Entra ID tokens. It helps security researchers trace authentication flows, identify risky permissions granted to tokens, and visualize token lifecycles for identity security review and investigation work.

PythonOAuthOIDC+1

TATS

Identity & Access· Published and added 2 Oct 2026

x.comtool🛡️ Security

Average AI Bro (@AverageAiBro) on X

Reversecore MCP is an MCP server that exposes authorized reverse-engineering, malware-analysis, forensics, and SAST-style tooling to an AI agent through selectable profiles, returning structured results for a given binary sample. It targets the gap between hand-driving tools like radare2 and paying for a commercial IDA Pro-based workflow, letting an agent query a toolchain directly instead of a human operator switching between tools.

Model Context Protocolradare2IDA Pro+1

Malware & RE· Added 1 Oct 2026, published 30 Sep 2026

x.comtool🛡️ Security

Manny M. (Vicente Traditor Mancebo) 💀 (@sargexd) on X

AKCA is an open-source Dynamic Application Security Testing (DAST) scanner written in Go, aimed at evidence-oriented web security testing. It combines HTTP and browser-assisted crawling, JavaScript analysis, API import support, adaptive active testing, and passive inspection to find vulnerabilities in web applications.

AKCA

AppSec· Added 30 Sep 2026, published 27 Sep 2026

simonwillison.nettool🧠 AI

Gemini 3.8 TTS Playground

Simon Willison built a bring-your-own-key playground for Google's newly released gemini-3.8-flash-tts and gemini-3.8-flash-lite-tts text-to-speech models, which offer a library of over 2,000 voices plus custom voice cloning from a 30-second sample. The tool exploits the Gemini API's open CORS policy to run entirely client-side, and supports defining full multi-character conversations with per-character voices and style instructions; a demo generated 1m18s of two-pelican dialogue audio in about 20 seconds for 2.74 cents.

Gemini

GPT-6 AstraClaude Opus 4.5Simon Willison+1

multimodal· Added 29 Sep 2026, published 23 Sep 2026

litellm.aitool🛡️ Security

LiteLLM

LiteLLM is an open-source (MIT) AI gateway that puts 140+ LLM providers, agents and MCP servers behind one OpenAI-compatible API. It adds virtual keys, per-team budgets and rate limits, SSO/JWT/RBAC with SCIM, audit logs, leaked-key protection, and guardrails for PII masking and prompt injection (Presidio, Lakera). It self-hosts via Helm, Terraform or Docker, including air-gapped, with Cosign-signed non-root images, Grype and CodeQL scanning, and secrets pulled from Vault or cloud secret managers. A new Rust gateway is benchmarked at 0.66 ms p99 overhead.

LiteLLMModel Context ProtocolDocker+3

PresidioLakeraAI Gateway Bench+2

AI Security· Added 3 Sep 2026, published 31 Aug 2026

submap.nettool🛡️ Security

Submap

SubMap is an enterprise-facing subdomain discovery and attack-surface-mapping SaaS that aggregates multiple reconnaissance data sources, streams results live via SSE, and exports to TXT/CSV/JSON for integration into a security workflow. It also runs 49 service fingerprints to detect subdomain-takeover conditions (dangling CNAMEs pointing at AWS, Azure, GitHub, Heroku, etc.) and layers in CVE monitors/alerting for tracked assets. The public page gates full scan output behind account creation, showing only the first 110 results in the free preview.

AWSAzureGitHub+1

OSINT· Added 3 Sep 2026, published 25 Aug 2026

crt.nametool🛡️ Security

crt.name

crt.name is a free subdomain index and API that returns every subdomain on file for a given apex domain plus first-seen dates, built by continuously parsing SAN hostnames from Certificate Transparency logs (Static CT sources like Let's Encrypt Sunlight, Geomys, Cloudflare Raio, plus legacy RFC 6962 logs like Google Argon, Sectigo, DigiCert), supplemented by Internet Archive CT replays, Common Crawl, ICANN CZDS zone files, ProjectDiscovery Chaos, HaGeZi DNS blocklists, and an active hostname prober. It offers a no-token REST API (100 req/IP/day), a Streamable HTTP MCP server exposing a single search tool for agent clients, and is the default crt source in the subfaster CLI subdomain enumerator.

Model Context Protocol

Let's Encrypt SunlightGeomysCloudflare Raio+8

OSINT· Added 3 Sep 2026, published 21 Aug 2026

huggingface.cotool🛡️ Security

philbert440/Qwen3.8-27B-Uncensored-Cyber-GGUF

philbert440/Qwen3.8-27B-Uncensored-Cyber-GGUF is a llama.cpp-format GGUF release of a Qwen3.8-27B fine-tune deliberately de-refused ('uncensored') and tuned to fully answer cyber and offensive-security questions, shipped with a vision projector and an MTP speculative-decoding head. The card includes a Claude-judged evaluation against a 100-prompt held-out cyber-offensive regex refusal harness and provides run instructions for llama.cpp, Ollama, vLLM, LM Studio, and Docker Model Runner. It exemplifies the growing trend of publicly distributed abliterated/de-refused LLMs positioned for offensive-security use, relevant to AI red-teaming and dual-use misuse tracking.

QwenHugging Facellama.cpp+2

AI Security, Offensive Security· Published and added 21 Aug 2026

claude.comtool🛡️ Security

Claude Security

Claude Security is Anthropic's AI-powered code scanning product (currently in beta for Claude Enterprise and as a Claude Code plugin) that uses the Claude Mythos 5 model to trace data flows across files, find high-severity vulnerabilities (memory corruption, injection, auth bypass, complex logic errors), and validate findings via an adversarial self-check before proposing human-reviewable patches. It integrates with GitHub, Slack, Jira, and webhooks for triage/audit workflows and supports scheduled or directory-scoped scans.

Claude CodeGitHubSlack+1

AppSec, AI Security, DevSecOps· Added 3 Sep 2026, published 23 Jul 2026

promptfoo.devtool🛡️ Security

PromptFoo LM Security DB

PromptFoo's LM Security DB is a searchable database of primary-source AI security research findings, indexing 985 findings across 1123 evaluated models pulled from papers on arXiv and elsewhere. Sampled entries cover memory-deletion leakage persisting in agent summaries/KV cache, embedding-inversion leakage in retrieval systems (SHAQ), vision-language model over-refusal (KoNA), document-image prompt injection against VLM agents (Repeat-After-Me), PII leakage in document images (LeakageBench), context-injection promoting untrusted repo/tool content into agent instructions, and cross-tenant GPU isolation violations in LLM serving frameworks like vLLM and DistServe (GIFT). It is positioned as a research-tracking reference for AI red-teamers and defenders rather than an original piece of research itself.

LLMvLLM

SHAQKoNARepeat-After-Me+4

AI Security· Added 3 Sep 2026, published 18 Jul 2026

osv.devtool🛡️ Security

OSV

OSV.dev is an open, distributed vulnerability database using the OpenSSF OSV schema to describe vulnerabilities precisely mapped to package versions or commit hashes, aggregating sources like GitHub Security Advisories, PyPA, RustSec, and the Global Security Database. It provides a free query API (by commit hash or package version) and the OSV-Scanner CLI/GitHub Actions workflows to scan SBOMs, lockfiles, container images, and repositories for known vulnerabilities, with an experimental `fix` command for automated remediation.

OSVGitHub ActionsDocker+3

CVE-2022-27651

Supply Chain, DevSecOps· Added 3 Sep 2026, published 25 May 2026

radar.pathsentinel.eutool🛡️ Security

PathSentinel Radar

PathSentinel Radar is a Spanish-language, read-only CTI dashboard that ingests security news (currently drawn from BleepingComputer) and re-presents it with an urgency score, severity label, and a "playbook" category (e.g. cti_triage, endpoint_tpv_support) plus a one-line remediation action. The sample set covers Pwn2Own exploits against Exchange/Windows 11, credential-theft flaws in WordPress plugins Avada Builder and Funnel Builder, the Linux "Fragnesia" root-privesc bug (CVE-2026-46300), Dell SupportAssist BSOD issues, KongTuke's abuse of Microsoft Teams for initial access, a Google Ads phishing campaign spoofing GoDaddy ManageWP, and the arrest/indictment of the alleged Dream Market administrator. The site states the public front end only serves already-processed reports and runs no live AI queries per visitor.

WordPress

CVE-2026-46300FragnesiaKongTuke+3

Threat Intel· Added 3 Sep 2026, published 16 May 2026

vulnerability.gardentool🛡️ Security

Vulnerability Garden

Vulnerability Garden is a searchable, continuously updated database of named vulnerabilities, attack techniques, and exploits (over 1,132 entries as of September 2026), each tagged with publish date, associated CVE numbers, and reference links. It spans decades of security research — from classic bugs like Billion Laughs and the Kaminsky bug to recent AI-agent and supply-chain attacks like MCPJacking and GitSpawn — making it a useful lookup tool for researchers trying to find or cross-reference a named vuln.

Threat Intel, Offensive Security· Added 3 Sep 2026, published 13 May 2026

protocolsoup.comtool🛡️ Security

Protocol Soup

ProtocolSoup is an interactive platform for executing real identity protocol flows (OAuth 2.0, OIDC, SAML, SCIM, SPIFFE, CAEP/RISC security event sharing, OID4VCI/OID4VP verifiable credentials, WebAuthn/FIDO2) against live authorization servers, issuers, and verifiers. It provides a 'Looking Glass' to inspect every HTTP request/response and decode live artifacts like JWTs, SAML assertions, and SETs, plus a wallet harness for issuing/presenting mdoc and SD-JWT credentials with HAIP attestation. Useful for security practitioners learning or testing identity protocol internals hands-on rather than in the abstract.

OAuthOIDC

Identity & Access, Learning· Added 3 Sep 2026, published 12 May 2026

github.blogtool🛡️ Security

GitHub Dependency Scanning MCP Server

GitHub's MCP Server now ships a "dependabot" toolset, in public preview, that lets MCP-compatible AI coding agents (Copilot Chat, Copilot CLI) scan dependency changes for known vulnerabilities before commit. The toolset queries the GitHub Advisory Database for affected packages, severity, and fixed versions, and can invoke the Dependabot CLI locally to diff dependency graphs pre/post-change for deeper post-commit checks. Requires Dependabot alerts enabled on the repo; setup involves enabling the toolset via Copilot CLI, VS Code MCP headers, or the advanced-security Copilot plugin.

Model Context ProtocolGitHubDependabot+3

Supply Chain, DevSecOps· Added 3 Sep 2026, published 11 May 2026

eventmaturitymatrix.comtool🛡️ Security

SaaS Event Maturity Matrix

The SaaS Event Maturity Matrix (EMM) is an open framework that catalogs categories of SaaS audit log events (authentication, user/group/role management, security policy changes, resource CRUD, etc.) and rates the depth of visibility each provides, with real-world JSON audit log examples from platforms like Box and Salesforce. It's built for defensive security practitioners to understand what activity is actually captured in vendor audit logs and to guide security monitoring and detection coverage decisions.

BoxSalesforce

AppOmni

Blue Team & Detection· Published and added 6 May 2026

gandalf.lakera.aitool🛡️ Security

Gandalf by Lakera

Gandalf is Lakera's free interactive game where players try to socially-engineer an LLM-backed chatbot into revealing a secret password, with each level adding stronger prompt-injection defenses. The "baseline" level represents the undefended starting challenge, used widely as a hands-on introduction to jailbreaking and prompt-injection techniques against language models.

LLM

LakeraGandalf

AI Security, Learning· Published and added 6 May 2026