Cybersecurity tools directory
158 reviewed tools with install guidance, safe example commands and legal-use notes. Every record links to the official website, documentation and source; use tools only on systems you own or are authorised to test.
Bandit is a tool designed to find common security issues in Python code, such as use of eval, weak hashes and hard-coded...
Brakeman is a static-analysis security scanner for Ruby on Rails applications that finds vulnerabilities without running...
Checkmarx One is a commercial application security platform covering static analysis, dependency scanning and more.
CodeQL treats code as data so you can query it for vulnerabilities; it powers GitHub code scanning and is free for open-...
Gitleaks detects hard-coded secrets such as API keys and passwords in git repositories and files.
Dependency-Track is an intelligent component-analysis platform that ingests SBOMs and continuously identifies risk in yo...
OWASP Threat Dragon is an open-source threat-modelling tool for drawing data-flow diagrams and recording threats and mit...
Semgrep is a fast, rule-based static-analysis tool that finds bugs and security issues in source code across many langua...
Snyk is a developer-security platform (with a free tier) that finds vulnerabilities in dependencies, code, containers an...
SonarQube analyses code quality and security (bugs, vulnerabilities, security hotspots) across many languages; a Communi...
Syft generates a software bill of materials (SBOM) listing the packages inside container images and filesystems.
TruffleHog finds, classifies and can verify leaked credentials across git history, filesystems and other sources.
detect-secrets is an open-source Yelp tool that finds secrets in code and helps prevent new ones being committed.
pip-audit scans Python environments and requirements files for packages with known vulnerabilities, using PyPI advisory...