Libraries & frameworks
in-toto
in-toto/in-toto
in-toto is a framework for protecting software supply-chain integrity by verifying that each build step was performed as planned by authorized personnel.
Topics
Related projects
guac1.6kGUAC aggregates software supply chain security metadata such as SBOMs, attestations, and vulnerabilities into a unified graph, giving security teams a queryable platform for auditing, policy, and risk analysis.
pip-audit1.4kpip-audit scans Python environments and requirements files for dependencies with known vulnerabilities, with automatic fixes, SBOM output and CI integration.
rekor1.2kRekor is Sigstore's tamper-resistant transparency log for software supply-chain metadata, offering a REST API and CLI to record, query, and verify signed artifacts.
openzeppelin-contracts27.4kA community-vetted Solidity library of secure, reusable smart contract components such as ERC token standards, access control, and utility contracts.
DOMPurify17.5kDOMPurify is a fast, DOM-only XSS sanitizer for HTML, MathML and SVG. Distributed as an npm library, it strips dangerous markup and is easily configured with hooks, making it a widely used developer dependency for preventing cross-site scripting.
helmet10.7kA Node/Express middleware that helps secure apps by setting HTTP response headers such as Content-Security-Policy and HSTS.