Project
Dockerscan
Security scanner for Docker containers. Looks for vulnerabilities, analyzes configurations and catches secret leaks. +1,400 stars.
Open source
Open Source Tools
I have published more than a hundred open source tools over the years.
Here I show just a few, the ones people actually use: security, APIs and performance.
Project
Aiotasks
Distributed task manager for Python Asyncio. Processes real-time events and scales horizontally. A Celery alternative with less baggage. +400 stars.
Project
Plecost
WordPress security scanner: core, plugins and themes checked against a daily-updated local CVE database. It needs no API key and sends no data to third parties. +380 stars.
Project
NoSQL Injection Wordlists
Payload collection for pentesting NoSQL databases (MongoDB, Cassandra, CouchDB, Redis). Used in bug bounties with critical findings up to $50K. +370 stars.
Project
FestIn
Scanner for misconfigured S3 buckets. Prevents data leaks and multi-million GDPR fines. Finds exposed medical records, backups and confidential data. +230 stars.
Project
Aiohttp-Swagger
Automatic OpenAPI/Swagger documentation for aiohttp APIs. Cuts documentation time by 90%. Used in APIs handling millions of daily requests. +180 stars.
Project
Enteletaor
Pentesting tool for message queues (RabbitMQ, Redis, Kafka). Finds insecure configurations and malicious message injection. +150 stars.
Project
Dockerfile Security
Static security analysis for Dockerfiles, in seconds. Finds hardcoded secrets, excessive privileges and outdated software before the build. Plugs into CI/CD. +95 stars.
Project
Vulnerable Node
NodeJS web shop with real vulnerabilities in the code, not simulated, to benchmark security analyzers and practice pentesting. OWASP Top 10. 480 stars.
Project
Aiohttp-Cache
Cache for aiohttp servers
Project
OpenVAS to Report
Turn OpenVAS XML reports into professional reports
Project
ja-shortener
Self-hosted URL shortener with no external dependencies. Lightweight, fast, easy to deploy. 43 stars.
Project
RSM - Redis Security Map
Anti-hacking tool for Redis. Detects and blocks attacks against exposed Redis instances. 31 stars.
Project
EasyLogs
Real-time log dashboard that starts with one docker run: filters, search, grouping and a PWA for the phone. For people who do not need Kibana. 26 stars.
Project
wordpress-docker-sec
Anti-hacking Docker configuration for WordPress. Automated hardening with nmap, wpscan and plecost. 13 stars.
Project
LAPIS
Lightweight API Specification for Intelligent Systems. Uses 85% fewer LLM tokens than OpenAPI. Published paper on arXiv. 12 stars.
Project
nginx-wordpress-docker-sec
Secure Nginx configuration for WordPress on Docker. Anti-hacking tools deployed automatically. 12 stars.
Project
realtime-redis-backup
Realtime Redis data backup to S3. Uses asyncio to avoid performance impact. 11 stars.