S

SAST

SAST Analyzer based on Semgrep

Rule Repository for GitLab SAST

GitLab PipeIntel - Scan GitLab CI pipelines for security and correctness issues using OPA policies and ShellCheck

Toolkit local-first de agentes IA para OpenCode. Orquesta subagentes cloud (OpenCode Go) y locales (Ollama), con memoria persistente (engram), OCR local (uocr) y generación/edición de imágenes (ComfyUI). Incluye dos agentes primary — agente-pobre (orquestador, optimización de costo) y agente-hacker-pobre (pentesting ético autorizado + auditoría de seguridad) — con skills de SAST/pentest, y un vault Obsidian de conocimiento. TypeScript (bun) + plugins de OpenCode.

Deep repository intelligence for humans and ai. Air gapped, on premise, zero dependency SAST for 50 languages regardless of compilation status. Sarif and sbom outputs.

Anura is an open-source harness platform built by the security research community to create an independent, realistic benchmark for AI systems used in security research. It runs models and agents against real public, authorized bug bounty scopes and security artifacts, then measures what they actually discover, validate, and reject in practical investigations.

Early access (beta). REACHABLE AI SAST/SCA with reachability and exploitability proof. Proposes reviewable fix MRs; you merge.

Test project with: Language: Python - Package Manager: Pip

Setup Static Application Secret Testing (SAST) in GitLab CI pipeline using NJSScan and Semgrep.

AI Code Security — four agents that catch what SAST misses in AI-generated code. Built on GitLab Duo Agent Platform.

Test project with: Language: Python - Package Manager: Pipenv

This project serves as a comprehensive reference implementation for enterprise DevSecOps practices, demonstrating how security, automation, and observability integrate seamlessly in modern cloud applications.

AI-powered security scanner that finds vulnerabilities and provides one-click fixes directly in GitLab merge requests. A reusable CI/CD Catalog component built with Google Cloud Vertex AI.

An end to end DevSecOps pipeline with features including SAST Scanning of the Source code, SBOM management, and Container image scan, before pushing to EKS.

AI DevSecOps Serverless Scanners.

This repository is part of a master thesis featured on https://scrap.tantemalkah.at and highlights the evaluation of currently maintained F/LOSS static analysis tools for PHP.