Data

Tools

Indexes

Applications

Experiments

Awesome

An open API service indexing awesome lists of open source software.

awesome-platform-engineering

A curated list of awesome tools, resources and various shiny things
https://github.com/dstrates/awesome-platform-engineering

Last synced: 9 days ago
JSON representation

  • API tools

    • Threat modelling

      • Vacuum - vacuum is the worlds fastest OpenAPI 3, OpenAPI 2 / Swagger linter and quality analysis tool. Built in go, it tears through API specs faster than you can think. vacuum is compatible with Spectral rulesets and generates compatible reports
      • Spectral - A flexible JSON/YAML linter for creating automated style guides, with baked in support for OpenAPI v3.1, v3.0, and v2.0 as well as AsyncAPI v2.x.
      • openapi-diff - Utility for comparing two OpenAPI specifications.
      • openapi-generator - OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec (v2, v3)
      • ogen - OpenAPI v3 code generator for go
      • swagger-codegen - swagger-codegen contains a template-driven engine to generate documentation, API clients and server stubs in different languages by parsing your OpenAPI / Swagger definition.
      • oapi-codegen - Generate Go client and server boilerplate from OpenAPI 3 specifications
      • goa - Goa: Elevate Go API development! Streamlined design, automatic code generation, and seamless HTTP/gRPC support
      • SwaggerHub
      • oasdiff - OpenAPI Diff and Breaking Changes

  • Application Security

    • API Fuzzing

      • OWASP ZAP - dynamic security testing and web app scanner
      • Burpsuite - The enterprise-enabled dynamic web vulnerability scanner
      • Cherrybomb - CLI tool that helps you avoid undefined user behaviour by validating your API specifications
      • Restler - stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs
      • Dredd - Language-agnostic HTTP API Testing Tool
      • Schemathesis - Specification-centric API testing tool for Open API and GraphQL-based applications
      • Snapchange - Lightweight fuzzing of a memory snapshot using KVM
      • Onefuzz - A self-hosted Fuzzing-As-A-Service platform
      • OSS-Fuzz - continuous fuzzing for open source software
      • GraphQLer - A cutting edge context aware GraphQL API fuzzing tool

    • DAST

      • OWASP ZAP - automatically find security vulnerabilities in your web applications while you are developing and testing your applications
      • Nikto2 - web server scanner
      • Wapiti - Web vulnerability scanner written in Python3
      • Skipfish - Web application security scanner created by lcamtuf for google - Unofficial Mirror [Deprecated]
      • CI Fuzz - CI Fuzz CLI is an open-source solution that lets you run feedback-based fuzz tests from your command line
      • nuclei - Fast and customizable vulnerability scanner based on simple YAML based DSL
      • paulveillard/cybersecurity-dynamic-analysis
      • analysis-tools-dev/dynamic-analysis
      • Jazzer - Coverage-guided, in-process fuzzing for the JVM
      • CI Fuzz - CI Fuzz CLI is an open-source solution that lets you run feedback-based fuzz tests from your command line

    • SAST

      • Shisho - Lightweight static analyzer
      • Purple panda - identify privilege escalation paths within and across different clouds
      • opensourcesecurityindex.io
      • Privado - Open Source Static Scanning tool to detect data flows in your code, find data security vulnerabilities & generate accurate Play Store Data Safety Report
      • static-analysis - A curated list of static analysis (SAST) tools and linters for all programming languages, config files, build tools, and more. The focus is on tools which improve code quality

    • SCA

      • OpenSCA - supports detection of open source component dependencies and vulnerabilities
      • Dependency-track - Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain
      • OSV scanner - Dependency vulnerability scanner written in Go which uses the data provided by [https://osv.dev](https://osv.dev)
      • packj - Packj stops ⚡ Solarwinds-, ESLint-, and PyTorch-like attacks by flagging malicious/vulnerable open-source dependencies ("weak links") in your software supply-chain
      • socket.dev - Socket fights vulnerabilities and provides visibility, defense-in-depth, and proactive supply chain protection for JavaScript and Python dependencies
      • nancy - A tool to check for vulnerabilities in your Golang dependencies, powered by Sonatype OSS Index
      • deps.dev - Google project for rating dependencies
      • dep-scan - OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies
      • depguard - Go linter that checks if package imports are in a list of acceptable packages

    • Secrets detection

      • Trufflehog - Find leaked credentials
      • Detect-secrets - Yelp: An enterprise friendly way of detecting and preventing secrets in code
      • Bridgecrew detect-secrets - Bridgecrew fork of yelp/detect-secrets
      • Gitleaks - SAST tool for detecting and preventing hardcoded secrets like passwords, api keys, and tokens in git repos
      • git-secrets - AWSLabs tool for detecting secrets in git. No longer maintained
      • ggshield - GitGuardian secrets detection.
      • SecretScanner - Deepfence SecretScanner can find unprotected secrets in container images or file systems. Integrated into [ThreatMapper 1.3.0](https://github.com/deepfence/ThreatMapper)
      • DumpsterDiver - Tool to search secrets in various filetypes. No longer maintained
      • keyscope - SpectralOps tool for secrets validation
      • leaky-repo - benchmarking repo with secrets in it to test and evaluate detection tools
      • Skyscanner/whispers - Identify hardcoded secrets in static structured text
      • auth0/repo-supervisor - Scan your code for security misconfiguration, search for passwords and secrets
      • Ocotopii - An AI-powered Personal Identifiable Information (PII) scanner
      • secretlint - Pluggable linting tool to prevent committing credentials.
      • auth0/repo-supervisor - Scan your code for security misconfiguration, search for passwords and secrets

    • Supply chain security

      • OWASP dependency-check - software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies
      • awesome supply chain security
      • chain-bench - open-source tool for auditing your software supply chain stack for security compliance based on a new CISs Software Supply Chain benchmark
      • legitify - Detect and remediate misconfigurations and security risks across all your GitHub assets
      • steampipe (GitHub compliance mod)
      • harden-runner - Security agent for GitHub-hosted runner: block egress traffic & detect code overwrite to prevent breaches
      • scorecard - OpenSSF Scorecard - Security health metrics for Open Source
      • CVE Prioritizer - Streamline vulnerability patching with CVSS, EPSS, and CISA's Known Exploited Vulnerabilities
      • ossf/allstar - GitHub App to set and enforce security policies
      • OSSGadget - Collection of tools for analyzing open source packages
      • oak - Oak is a software platform for building distributed systems providing externally verifiable (or falsifiable) claims about system behaviors in a transparent way

    • Threat modelling

      • Deciduous - security decision tree generator that serves as a threat modelling tool

  • Artifact signing and attestation

    • Threat modelling

      • SLSA - Software Attestations
      • Cosign - code signing and transparency for containers and binaries
      • grafeas - Artifact Metadata API to audit and govern software supply chains
      • in-toto - a framework to protect supply chain integrity
      • notary - project that allows anyone to have trust over arbitrary collections of data

  • Bug tracking

    • Threat modelling

  • Chaos engineering

    • Threat modelling

      • Chaos Toolkit - the Open Source Platform for Chaos Engineering
      • Chaos Monkey - a resiliency tool that helps applications tolerate random instance failures
      • Toxiproxy - simulate network and system conditions for chaos and resiliency testing
      • Pumba - chaos testing, network emulation and stress testing tool for containers
      • Litmus - Cloud Native Chaos Engineering platform
      • KubeInvaders - Chaotic fun

  • Chat and ChatOps

    • Threat modelling

      • Rocket - open source team communication
      • Mattermost - messaging platform that enables secure team collaboration
      • CloudBot - simple, fast, expandable, open-source Python IRC Bot
      • Hubot - a customizable life embetterment robot
      • Lita - a robot companion for your company's chat room
      • Botkube - chat bot for Kubernetes
      • Rootly - Incident management in Slack

  • Cloud asset inventory

    • Threat modelling

      • Steampipe - `# select * from cloud;`
      • Cloudquery - Sync cloud assets to any database, transform and visualize
      • Cloudgraph - The universal GraphQL API and CSPM tool for AWS, Azure, GCP, K8s, and tencent
      • Cloudmapper - CloudMapper helps you analyze your AWS environments
      • AWS ClickOps notifier - Get notified when users are taking actions in the AWS Console
      • driftctl - Detect, track and alert on infrastructure drift
      • Scoutsuite - Multi-Cloud Security Auditing Tools
      • prowler - perform AWS security best practices assessments, audits, incident response, continuous monitoring
      • saw - Fast, multi-purpose tool for searching AWS CloudWatch Logs
      • magpie - Magpie is a free, open-source framework and a collection of community developed plugins that can be used to build complete end-to-end security tools such as a CSPM

  • Cloud cost management

    • Threat modelling

      • Infracost - Predict cost of infrastructure from Terraform code
      • Terracost - Cloud cost estimation for Terraform in your CLI
      • Zesty - Automated cloud cost optimization for EC2 & RDS
      • Vantage - Automated cloud cost optimization
      • Scalr - Terraform platform that has cost-optimization features
      • Finout - Cloud cost monitoring platform
      • Opencost - Cross-cloud cost allocation models for Kubernetes workloads
      • Harness Cloud Cost Management - Detect and stop cloud cost anomalies as they occur
      • usage.ai - Automated cloud cost optimization for EC2, RDS, ElasticSearch, RedShift
      • cast.ai - Kubernetes automated cost savings
      • Loft - Kubernetes automated cost savings
      • Scalr - Terraform platform that has cost-optimization features
      • Vantage - Automated cloud cost optimization
      • Scalr - Terraform platform that has cost-optimization features
      • Harness Cloud Cost Management - Detect and stop cloud cost anomalies as they occur
      • usage.ai - Automated cloud cost optimization for EC2, RDS, ElasticSearch, RedShift

  • Containers

    • Shell into containers

      • cdebug - cdebug - a swiss army knife of container debugging
      • docker-opener - Shell-in to any docker container easily
      • debug-ctr - Command-line tool for interactive container troubleshooting
      • docker-debug - troubleshooting running docker containers

    • Threat modelling

      • Dockle - Docker image linting
      • Container-scan - Dockle + Trivy [Deprecated]
      • HadoLint - Dockerfile linter, validate inline bash, written in Haskell
      • docker-bench - checks for dozens of common best-practices
      • aquasecurity/docker-bench
      • Dive - A tool for exploring a docker image, layer contents, and discovering ways to shrink the size of your Docker/OCI image
      • cadvisor - Analyzes resource usage and performance characteristics of running containers
      • Docker-slim - Don't change anything in your Docker container image and minify it by up to 30x
      • dfimage - Reverse-engineer a Dockerfile from a Docker image
      • Whaler - Go program to reverse Docker images into Dockerfiles
      • anchore-engine - A service that analyzes docker images and scans for vulnerabilities
      • grype - A vulnerability scanner for container images and filesystems
      • Trivy - Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
      • docker-trim - create a trimmed docker image that contains only parts of the original file system of an existing docker image
      • diffoci - diffoci compares Docker and OCI container images for helping reproducible builds
      • tini - A tiny but valid `init` for containers
      • ko - ko is a simple, fast container image builder for Go applications
      • go-containerregistry - Google Go library for working with container images. Includes tools like `crane`, `gcrane`, `krane` & `k8schain`
      • testcontainers - open source framework for providing throwaway, lightweight instances of anything that can run in a Docker container
      • distroless - Language focused docker images, minus the operating system
      • confidential-containers - leverage Trusted Execution Environments to protect containers and data and to deliver cloud native confidential computing
      • copacetic - CLI tool for directly patching container images!
      • runc - CLI tool for spawning and running containers according to the OCI specification

  • Continuous deployment

    • Shell into containers

      • ArgoCD - Declarative continuous deployment for Kubernetes
      • Flux - Open and extensible continuous delivery solution for Kubernetes
      • dagger - programmable CI/CD engine that runs your pipelines in containers

  • Continuous integration

    • Shell into containers

      • Spacelift - Spacelift is a sophisticated CI/CD platform for Terraform, CloudFormation, Pulumi, and Kubernetes
      • atlantis - Terraform Pull Request Automation
      • scalr - Terraform Cloud alternative
      • env0 - Manage, deploy, scale, and control all your Terraform, Terragrunt, Pulumi, and related frameworks
      • batect - Build And Testing Environments as Code Tool
      • autorelease - Release automation for GitHub
      • cashapp/hermit - consistent tooling across environments
      • meta/hermit - hermetically isolated sandboxes to control program execution
      • semantic-release - Fully automated version management and package publishing
      • release-please - generate release PRs based on the conventionalcommits.org spec
      • git-cliff - A highly customizable Changelog Generator that follows Conventional Commit specifications ⛰️

  • Dashboards as code

    • Shell into containers

  • Dependency management

    • Build systems

      • Bazel - Bazel is Google's monorepo-oriented build system
      • buck2 - Buck2 is a fast, hermetic, multi-language build system designed by Meta
      • pants - a monorepo-oriented build system, used by Twitter, Foursquare and multiple other companies
      • Nx - Nx is a build system with built-in tooling and advanced CI capabilities. It helps you maintain and scale monorepos, both locally and on CI

    • Shell into containers

      • Poetry - Python packaging and dependency management
      • Renovate - Universal dependency update tool that fits into your workflows
      • Dependabot - Automating dependency updates in multiple languages
      • configrd - Sync configurations such as environment variables, application properties and secrets across build pipelines, services and environments
      • tfenv - Terraform version manager based on rbenv
      • asdf - Extendable version manager with support for Ruby, Node.js, Elixir, Erlang & more
      • mise - development environment setup tool that manages dev tools, runtimes, envvars and task runners
      • spack - A flexible package manager that supports multiple versions, configurations, platforms, and compilers
      • Lerna - Lerna is a tool for managing JavaScript projects with multiple packages, built on Yarn
      • chezmoi - Manage your dotfiles across multiple diverse machines, securely
      • just - just is a handy way to save and run project-specific commands
      • changesets - A way to manage your versioning and changelogs with a focus on monorepos
      • earthly - Super simple build framework with fast, repeatable builds and an instantly familiar syntax – like Dockerfile and Makefile had a baby.
      • knip - Find unused files, dependencies and exports in your JavaScript and TypeScript projects
      • Devbox - command-line tool that lets you easily create isolated shells for development

  • Diagrams as code

  • Documentation as code

    • Build systems

      • Doxygen - generate docs from annotated C++ code
      • terraform docs - generate docs from Terraform code
      • glow - terminal based markdown reader designed for the CLI
      • runme - Execute your runbooks, docs, and READMEs
      • JavaDoc - generate docs from Java code

  • Endpoint validation

    • Build systems

      • Goss - quick and easy server validation
Programming Languages
Go 118 Python 48 TypeScript 22 Rust 15 JavaScript 11 Java 10 Shell 6 C 5 Ruby 2 C++ 2
Categories
Application Security 61 Kubernetes 43 Containers 27 Testing 23 Dependency management 19 Linting 16 Cloud cost management 16 Git Tools 15 Identity and access management 14 Infrastructure as code 14 Diagrams as code 13 Usage-based pricing 12 Sharing 12 Continuous integration 11 Cloud asset inventory 10 API tools 10 Platform as a Service 10 Kafka 10 Secrets management 9 Policy as code 8 Internal developer platform 8 Chat and ChatOps 7 Observability 7 Chaos engineering 6 Dashboards as code 5 Documentation as code 5 Artifact signing and attestation 5 Service catalogue 4 Status pages 4 Continuous deployment 3 Endpoint validation 2 Bug tracking 1
Sub Categories
Threat modelling 79 Regex 58 Shell into containers 38 Hook management tools 27 Infrastructure from code 25 Build systems 24 Load, stress & soak testing 22 Secrets detection 15 Supply chain security 11 Kubernetes security posture management 11 API Fuzzing 10 DAST 10 Terraform 9 SCA 9 Kubernetes testing 8 Kubernetes templating 8 A/B testing 7 Infrastructure as code generation 6 Kubernetes runtime security 5 Kubernetes local development 5 SAST 5 Polyrepo operations tools 5 Kubernetes static analysis 4 Repository management tools 4 Performance testing 3 Kubernetes IAM 2
Keywords
kubernetes 52 security 46 docker 32 aws 31 golang 29 go 28 terraform 21 containers 21 devops 18 python 17 cloud 16 devsecops 16 security-tools 15 cli 14 gcp 14 static-analysis 13 git 12 infrastructure-as-code 12 testing 11 cncf 10 azure 10 openapi 10 vulnerabilities 9 k8s 9 swagger 9 helm 9 openapi3 9 javascript 8 security-audit 8 secrets 8 linter 8 api 8 github 8 rust 8 java 7 iac 7 developer-tools 7 iam 7 compliance 7 kafka 7 monitoring 7 observability 6 devops-tools 6 typescript 6 vulnerability-detection 5 sbom 5 vulnerability-scanners 5 rest-api 5 linting 5 secrets-detection 5