Tools
vet
safedep/vet
SafeDep vet scans dependencies, GitHub Actions workflows, and AI agent configs for malicious packages, vulnerabilities, and risky patterns. It is a policy-as-code security CLI for supply-chain protection.
Topics
Related projects
gitleaks31kA fast CLI scanner that finds passwords, API keys, and tokens leaked in git repos, files, and CI pipelines.
kics2.7kKICS is Checkmarx's open-source scanner for infrastructure-as-code. It uses customizable queries to find security vulnerabilities, compliance issues and misconfigurations in Terraform, Kubernetes, Docker, CloudFormation and many other IaC platforms.
packj695Supply-chain security scanner that flags malicious and risky open-source dependencies via static and dynamic analysis.
pmg563An open-source install-time firewall that blocks malicious npm and Python packages with threat intel, cooldowns, and sandboxing for developers and AI coding agents.
npm-security-best-practices1.3kA curated list of npm security best practices covering supply-chain hardening, lockfile integrity, and safer package installs, with copy-paste configurations for npm and pnpm.
trivy39.3kA comprehensive security scanner that finds vulnerabilities, misconfigurations, secrets, and SBOM issues across container images, filesystems, repositories, Kubernetes, and clouds.