Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
awesome-devsecops
https://github.com/H4CK3RT3CH/awesome-devsecops
Last synced: 6 days ago
JSON representation
-
Resources
-
Secure Development Guidelines
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Application Security Verification Standard - _OWASP_ - A framework of security requirements and controls to help developers design and develop secure web applications.
- Coding Standards - _CERT_ - A collection of secure development standards for C, C++, Java and Android development.
- Fundamental Practices for Secure Software Development - _SAFECode_ - Guidelines for implementing key secure development practices throughout the SDLC.
- Proactive Controls - _OWASP_ - OWASP's list of top ten controls that should be implemented in every software development project.
- Secure Coding Guidelines - _Mozilla_ - A guideline containing specific secure development standards for secure web application development.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
- Secure Coding Practices Quick Reference Guide - _OWASP_ - A checklist to verify that secure development standards have been followed.
-
Secure Development Lifecycle Framework
- Software Assurance Maturity Model - _OWASP_ - A framework to measure and improve the maturity of the secure development lifecycle.
- Secure Development Lifecycle - _Microsoft_ - A collection of tools and practices that serve as a framework for the secure development lifecycle.
- Secure Software Development Framework - _NIST_ - A framework consisting of practices, tasks and implementation examples for a secure development lifecycle.
-
Training
- Application Security Education - _Duo Security_ - Training materials created by the Duo application security team, including introductory and advanced training presentations and hands-on labs.
- Cybrary - _Cybrary_ - Subscription based online courses with dedicated categories for cybersecurity and DevSecOps.
- PentesterLab - _PentesterLab_ - Hands on labs to understand and exploit simple and advanced web vulnerabilities.
- Secure Code Warrior - _Secure Code Warrior_ - Gamified and hands-on secure development training with support for courses, assessments and tournaments.
- SecureFlag - _OWASP_ - Hands-on secure coding training for Developers and Build/Release Engineers.
- Security Training for Engineers - _Pager Duty_ - A presentation created and open-sourced by PagerDuty to provide security training to software engineers.
- Security Training for Everyone - _Pager Duty_ - A presentation created and open-sourced by PagerDuty to provide security training employees.
- Web Security Academy - _PortSwigger_ - A set of materials and labs to learn and exploit common web vulnerabilities.
- WeHackPuple - _WeHackPurple_ - Online courses that teach application security theory and hands-on technical lessons.
- SafeStack - _SafeStack_ - Security training for software development teams, designed to be accessible to individuals and small teams as well as larger organisations.
-
Articles
- Our Approach to Employee Security Training - _Pager Duty_ - Guidelines to running security training within an organisation.
-
Books
- Alice and Bob Learn Application Security - _Tanya Janca_ - An accessible and thorough resource for anyone seeking to incorporate, from the beginning of the System Development Life Cycle, best security practices in software development.
-
Communities
- MyDevSecOps - _Snyk_ - A community that runs conferences, a blog, a podcast and a Slack workspace dedicated to DevSecOps.
-
Conferences
- AppSec Day - _OWASP_ - An Australian application security conference run by OWASP.
-
Newsletters
- Shift Security Left - _Cossack Labs_ - A free biweekly newsletter for security-aware developers covering application security, secure architecture, DevSecOps, cryptography, incidents, etc. that can be useful for builders and (to a lesser extent) for breakers.
-
Podcasts
- Absolute AppSec - _Seth Law & Ken Johnson_ - Discussions about current events and specific topics related to application security.
- BeerSecOps - _Aqua Security_ - Breaking down the silos of Dev, Sec and Ops, discussing topics that span these subject areas.
- DevSecOps Podcast Series - _OWASP_ - Discussions with thought leaders and practitioners to integrate security into the development lifecycle.
- The Secure Developer - _Snyk_ - Discussion about security tools and best practices for software developers.
-
Wikis
- SecureFlag Knowledge Base - _OWASP_ - A repository of information about software vulnerabilities and how to prevent them.
-
-
Tools
-
Dependency Management
- Deepfence ThreatMapper - Apache v2, powerful runtime vulnerability scanner for kubernetes, virtual machines and serverless.
- Dependency-Check - _OWASP_ - Scans dependencies for publicly disclosed vulnerabilities using CLI or build server plugins.
- Dependency-Track - _OWASP_ - Monitor the volume and severity of vulnerable dependencies across multiple projects over time.
- JFrog XRay - _JFrog_ - Security and compliance analysis for artifacts stored in JFrog Artifactory.
- Renovate - _WhiteSource_ - Automatically monitor and update software dependencies for multiple frameworks and languages using a CLI or git repository apps.
- Requires.io - _Olivier Mansion & Alexis Tabary_ - Automated vulnerable dependency monitoring and upgrades for Python projects.
- Snyk Open Source - _Snyk_ - Automated vulnerable dependency monitoring and upgrades using Snyk's dedicated vulnerability database.
- Dependabot - _GitHub_ - Automatically scan GitHub repositories for vulnerabilities and create pull requests to merge in patched dependencies.
-
Dynamic Analysis
- Automatic API Attack Tool - _Imperva_ - Perform automated security scanning against an API based on an API specification.
- Gauntlt - _Gauntlt_ - A Behaviour Driven Development framework to run security scans using common security tools and test output, defined using Gherkin syntax.
- Netz - _Spectral_ - Discover internet-wide misconfigurations, using zgrab2 and others.
- SSL Labs Scan - _SSL Labs_ - Automated scanning for SSL / TLS configuration issues.
- Zed Attack Proxy (ZAP) - _OWASP_ - An open-source web application vulnerability scanner, including an API for CI/CD integration.
- BurpSuite Enterprise Edition - _PortSwigger_ - BurpSuite's web application vulnerability scanner used widely by penetration testers, modified with CI/CD integration and continuous monitoring over multiple web applications.
-
Infrastructure as Code Analysis
- Checkov - _Bridgecrew_ - Scan Terraform, AWS CloudFormation and Kubernetes templates for insecure configuration.
- KICS - _Checkmarx_ - Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle.
- Cfn Nag - _Stelligent_ - Scan AWS CloudFormation templates for insecure configuration.
- Clair - _Quay_ - Scan App Container and Docker containers for publicly disclosed vulnerabilities.
- Docker-Bench-Security - _Docker_ - The Docker Bench for Security is a script that checks for dozens of common best-practices around deploying Docker containers in production.
- Hadolint - _Hadolint_ - Checks a Dockerfile against known rules and validates inline bash code in RUN statements.
- Trivy - _Aqua Security_ - Simple and comprehensive vulnerability scanner for containers.
- Regula - _Fugue_ - Evaluate Terraform infrastructure-as-code for potential security misconfigurations and compliance violations prior to deployment.
- Kube-Score - _Gustav Westling_ - Scan Kubernetes object definitions for security and performance misconfiguration.
- Kubectrl Kubesec - _ControlPlane_ - Plugin for kubesec.io to perform security risk analysis for Kubernetes resources.
- Spectral DeepConfig - _Spectral_ - Find misconfiguration both in infrastructure as well as apps as early as commit time.
- Anchore Engine - _Anchore, Inc_ - Deep inspection of Docker images for CVEs and checking against custom policies. Engine behind their enterprise products that integrate against registries, orchestrators and CI/CD products.
- Snyk Container - _Snyk_ - Scan Docker and Kubernetes applications for security vulnerabilities during CI/CD or via continuous monitoring.
- Terraform Compliance - _terraform-compliance_ - A lightweight, security and compliance focused test framework against terraform to enable negative testing capability for your infrastructure-as-code.
- Dagda - _Elías Grande_ - Compares OS and software dependency versions installed in Docker containers with public vulnerability databases, and also performs virus scanning.
- Ansible-Lint - _Ansible Community_ - Checks playbooks for practices and behaviour that could potentially be improved. As a community backed project ansible-lint supports only the last two major versions of Ansible.
-
Intentionally Vulnerable Applications
- Bad SSL - _The Chromium Project_ - A container running a number of webservers with poor SSL / TLS configuration. Useful for testing tooling.
- Cfngoat - _Bridgecrew_ - Cloud Formation templates for creating stacks of intentionally insecure services in AWS. Ideal for testing the Cloud Formation Infrastructure as Code Analysis tools above.
- NodeGoat - _OWASP_ - A Node.js web application that demonstrates and provides ways to address common security vulnerabilities.
- Terragoat - _Bridgecrew_ - Terraform templates for creating stacks of intentionally insecure services in AWS, Azure and GCP. Ideal for testing the Terraform Infrastructure as Code Analysis tools above.
- Damn Vulnerable Web App - _Ryan Dewhurst_ - A web application that provides a safe environment to understand and exploit common web vulnerabilities.
- Juice Shop - _OWASP_ - A web application containing the OWASP Top 10 security vulnerabilities and more.
-
Secrets Management
- BlackBox - _StackExchange_ - Encrypt credentials within your code repository.
- Chef Vault - _Chef_ - Securely store secrets within Chef.
- CredStash - _Fugue_ - Securely store secrets within AWS using KMS and DynamoDB.
- Gopass - _Gopass_ - Password manager for teams relying on Git and gpg. Manages secrets in encrypted files and repositories.
- Keyscope - _Spectral_ - Keyscope is an open source key and secret workflow tool (validation, invalidation, etc.) built in Rust.
- Pinterest Knox - _Pinterest_ - Securely store, rotate and audit secrets.
- AWS Key Management Service (KMS) - _Amazon AWS_ - Create and manage cryptographic keys in AWS.
- AWS Secrets Manager - _Amazon AWS_ - Securely store retrievable application secrets in AWS.
- Docker Secrets - _Docker_ - Store and manage access to secrets within a Docker swarm.
- HashiCorp Vault - _HashiCorp_ - Securely store secrets via UI, CLI or HTTP API.
- Secrets Operations (SOPS) - _Mozilla_ - Encrypt keys stored within YAML, JSON, ENV, INI and BINARY files.
- Teller - _Spectral_ - A secrets management tool for developers - never leave your command line for secrets.
-
Secrets Scanning
- Detect Secrets - _Yelp_ - An aptly named module for (surprise, surprise) detecting secrets within a code base.
- Repo-supervisor - _Auth0_ - Secrets scanning tool that can run as a CLI, as a Docker container or in AWS Lambda.
- truffleHog - _Truffle Security_ - Searches through git repositories for secrets, digging deep into commit history and branches.
- CredScan - _Microsoft_ - A credential scanning tool that can be run as a task in Azure DevOps pipelines.
- GitGuardian - _GitGuardian_ - A web-based solution that scans and monitors public and private git repositories for secrets.
- git-secrets - _AWS Labs_ - Scans commits, commit messages and merges for secrets. Native support for AWS secret patterns, but can be configured to support other patterns.
-
Static Analysis
- DevSkim - _Microsoft_ - A set of IDE plugins, CLIs and other tools that provide security analysis for a number of programming languages.
- Hawkeye - _Hawkeyesec_ - Modularised CLI tool for project security, vulnerability and general risk highlighting.
- FlawFinder - _David Wheeler_ - Scan C / C++ code for potential security weaknesses.
- Puma Scan - _Puma Security_ - A Visual Studio plugin to scan .NET projects for potential security flaws.
- SpotBugs - _SpotBugs_ - Static code analysis for Java applications.
- Golang Security Checker - _securego_ - CLI tool to scan Go code for potential security flaws.
- Security Code Scan - _Security Code Scan_ - Static code analysis for C# and VB.NET applications.
- Phan - _Phan_ - Broad static analysis for PHP applications with some support for security scanning features.
- PHPCS Security Audit - _Floe_ - PHP static analysis with rules for PHP, Drupal 7 and PHP related CVEs.
- Progpilot - _Design Security_ - Static analysis for PHP source code.
- Bandit - _Python Code Quality Authority_ - Find common security vulnerabilities in Python code.
- Brakeman - _Justin Collins_ - Static analysis tool which checks Ruby on Rails applications for security vulnerabilities.
- DawnScanner - _Paolo Perego_ - Security scanning for Ruby scripts and web application. Supports Ruby on Rails, Sinatra and Padrino frameworks.
- SemGrep - _r2c_ - Semgrep is a fast, open-source, static analysis tool that finds bugs and enforces code standards at editor, commit, and CI time.
- Deep Dive - _Discotek.ca_ - Static analysis for JVM deployment units including Ear, War, Jar and APK.
- ESLint - _JS Foundation_ - Linting tool for JavaScript with multiple security linting rules available.
- Conftest - _Instrumenta_ - Create custom tests to scan any configuration file for security flaws.
- Find Security Bugs - _OWASP_ - SpotBugs plugin for security audits of Java web applications. Supports Eclipse, IntelliJ, Android Studio and SonarQube.
-
Supply Chain Security
- Harden Runner GitHub Action - _StepSecurity_ - installs a security agent on the GitHub-hosted runner (Ubuntu VM) to prevent exfiltration of credentials, detect compromised dependencies and build tools, and detect tampering of source code during the build.
- Preflight - _Spectral_ - helps you verify scripts and executables to mitigate supply chain attacks in your CI and other systems, such as in the recent [Codecov hack](https://spectralops.io/blog/credentials-risk-supply-chain-lessons-from-the-codecov-breach/).
- Sigstore - sigstore is a set of free to use and open source tools, including [fulcio](https://github.com/sigstore/fulcio), [cosign](https://github.com/sigstore/cosign) and [rekor](https://github.com/sigstore/rekor), handling digital signing, verification and checks for provenance needed to make it safer to distribute and use open source software.
-
Threat Modelling
- Raindance Project - _DevSecOps_ - Use attack maps to identify attack surface and adversary strategies that may lead to compromise.
- SecuriCAD - _Forseeti_ - Treat modelling and attack simulations for IT infrastructure.
- SD Elements - _Security Compass_ - Identify and rank threats, generate actionable tasks and track related tickets.
- Threat Dragon - _OWASP_ - Threat model diagramming tool.
- Threat Modelling Tool - _Microsoft_ - Threat model diagramming tool.
- Threatspec - _Threatspec_ - Define threat modelling as code.
-
Monitoring
- Csper - _Csper_ - A set of Content Security Policy tools that can test policies, monitor CSP reports and provide metrics and alerts.
-
-
Related Lists
-
Threat Modelling
- Awesome Threat Modelling - _Practical DevSecOps_ - A curated list of threat modeling resources.
- Awesome Dynamic Analysis - _Matthias Endler_ - A collection of dynamic analysis tools and code quality checkers.
- Awesome Static Analysis - _Matthias Endler_ - A collection of static analysis tools and code quality checkers.
-
Programming Languages
Categories
Sub Categories
Secure Development Guidelines
46
Static Analysis
18
Infrastructure as Code Analysis
16
Secrets Management
12
Training
10
Threat Modelling
9
Dependency Management
8
Dynamic Analysis
6
Secrets Scanning
6
Intentionally Vulnerable Applications
6
Podcasts
4
Supply Chain Security
3
Secure Development Lifecycle Framework
3
Books
1
Wikis
1
Monitoring
1
Conferences
1
Communities
1
Newsletters
1
Articles
1
Keywords
security
21
static-analysis
9
security-tools
8
static-code-analysis
8
devsecops
8
kubernetes
6
linter
5
devops
5
go
5
golang
5
docker
5
appsec
5
vulnerabilities
4
vulnerability-scanners
4
aws-security
3
security-scanner
3
analysis
3
cloudformation
3
vulnerability-detection
3
aws
3
ruby
3
infrastructure-as-code
3
php
3
testing
3
secret-management
3
secrets
3
containers
3
compliance
3
rails
2
security-audit
2
terraform
2
analyzer
2
owasp
2
iac
2
open-policy-agent
2
rust
2
vault
2
scanner
2
owasp-top-ten
2
cybersecurity
2
nodejs
2
javascript
2
ci
2
cloudsecurity
2
python
2
security-automation
2
oci-image
1
dockerfile
1
oci
1
clair
1