Data

Tools

Indexes

Applications

Experiments

Awesome

An open API service indexing awesome lists of open source software.

awesome-devsecops

Curating the best DevSecOps resources and tooling.
https://github.com/jakob-pennington/awesome-devsecops

Last synced: 17 days ago
JSON representation

    • Threat Modelling

  • Resources

    • Articles

    • Books

      • Alice and Bob Learn Application Security - _Tanya Janca_ - An accessible and thorough resource for anyone seeking to incorporate, from the beginning of the System Development Life Cycle, best security practices in software development.

    • Communities

      • TAG Security - _Cloud Native Computing Foundation_ - TAG Security facilitates collaboration to discover and produce resources that enable secure access, policy control, and safety for operators, administrators, developers, and end-users across the cloud native ecosystem.
      • DevSecCon - _Snyk_ - A community that runs conferences, a blog, a podcast and a Discord dedicated to DevSecOps.

    • Conferences

      • AppSec Day - _OWASP_ - An Australian application security conference run by OWASP.

    • Newsletters

      • Shift Security Left - _Cossack Labs_ - A free biweekly newsletter for security-aware developers covering application security, secure architecture, DevSecOps, cryptography, incidents, etc. that can be useful for builders and (to a lesser extent) for breakers.

    • Podcasts

      • Absolute AppSec - _Seth Law & Ken Johnson_ - Discussions about current events and specific topics related to application security.
      • DevSecOps Podcast Series - _OWASP_ - Discussions with thought leaders and practitioners to integrate security into the development lifecycle.
      • The Secure Developer - _Snyk_ - Discussion about security tools and best practices for software developers.
      • Application Security Podcast - _Security Journey_ - Interviews with industry experts about specific application security concepts.

    • Secure Development Guidelines

    • Secure Development Lifecycle Framework

    • Toolchains

    • Training

      • Application Security Education - _Duo Security_ - Training materials created by the Duo application security team, including introductory and advanced training presentations and hands-on labs.
      • Cybrary - _Cybrary_ - Subscription based online courses with dedicated categories for cybersecurity and DevSecOps.
      • PentesterLab - _PentesterLab_ - Hands on labs to understand and exploit simple and advanced web vulnerabilities.
      • SafeStack - _SafeStack_ - Security training for software development teams, designed to be accessible to individuals and small teams as well as larger organisations.
      • Secure Code Warrior - _Secure Code Warrior_ - Gamified and hands-on secure development training with support for courses, assessments and tournaments.
      • SecureFlag - _OWASP_ - Hands-on secure coding training for Developers and Build/Release Engineers.
      • Security Training for Engineers - _Pager Duty_ - A presentation created and open-sourced by PagerDuty to provide security training to software engineers.
      • Security Training for Everyone - _Pager Duty_ - A presentation created and open-sourced by PagerDuty to provide security training employees.
      • Semgrep Academy - _Semgrep_ - Free, on-demand courses covering topics including API security, secure coding and application security.
      • Web Security Academy - _PortSwigger_ - A set of materials and labs to learn and exploit common web vulnerabilities.

    • Wikis

  • Tools

    • Dependency Management

      • Deepfence ThreatMapper - Apache v2, powerful runtime vulnerability scanner for kubernetes, virtual machines and serverless.
      • Dependabot - _GitHub_ - Automatically scan GitHub repositories for vulnerabilities and create pull requests to merge in patched dependencies.
      • Dependency-Check - _OWASP_ - Scans dependencies for publicly disclosed vulnerabilities using CLI or build server plugins.
      • Dependency-Track - _OWASP_ - Monitor the volume and severity of vulnerable dependencies across multiple projects over time.
      • JFrog XRay - _JFrog_ - Security and compliance analysis for artifacts stored in JFrog Artifactory.
      • NPM Audit - _NPM_ - Vulnerable package auditing for node packages built into the npm CLI.
      • Renovate - _WhiteSource_ - Automatically monitor and update software dependencies for multiple frameworks and languages using a CLI or git repository apps.
      • Requires.io - _Olivier Mansion & Alexis Tabary_ - Automated vulnerable dependency monitoring and upgrades for Python projects.
      • Snyk Open Source - _Snyk_ - Automated vulnerable dependency monitoring and upgrades using Snyk's dedicated vulnerability database.

    • Dynamic Analysis

      • Automatic API Attack Tool - _Imperva_ - Perform automated security scanning against an API based on an API specification.
      • Gauntlt - _Gauntlt_ - A Behaviour Driven Development framework to run security scans using common security tools and test output, defined using Gherkin syntax.
      • Netz - _Spectral_ - Discover internet-wide misconfigurations, using zgrab2 and others.
      • RESTler - _Microsoft_ - A stateful RESTful API scanner based on peer-reviewed research papers.
      • SSL Labs Scan - _SSL Labs_ - Automated scanning for SSL / TLS configuration issues.
      • Zed Attack Proxy (ZAP) - _OWASP_ - An open-source web application vulnerability scanner, including an API for CI/CD integration.

    • Infrastructure as Code Analysis

      • Checkov - _Bridgecrew_ - Scan Terraform, AWS CloudFormation and Kubernetes templates for insecure configuration.
      • KICS - _Checkmarx_ - Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle.
      • Spectral DeepConfig - _Spectral_ - Find misconfiguration both in infrastructure as well as apps as early as commit time.
      • Terrascan - _Accurics_ - Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.
      • Cfn Nag - _Stelligent_ - Scan AWS CloudFormation templates for insecure configuration.
      • Clair - _Red Hat_ - Scan App Container and Docker containers for publicly disclosed vulnerabilities.
      • Dagda - _Elías Grande_ - Compares OS and software dependency versions installed in Docker containers with public vulnerability databases, and also performs virus scanning.
      • Docker-Bench-Security - _Docker_ - The Docker Bench for Security is a script that checks for dozens of common best-practices around deploying Docker containers in production.
      • Hadolint - _Hadolint_ - Checks a Dockerfile against known rules and validates inline bash code in RUN statements.
      • Snyk Container - _Snyk_ - Scan Docker and Kubernetes applications for security vulnerabilities during CI/CD or via continuous monitoring.
      • Trivy - _Aqua Security_ - Simple and comprehensive vulnerability scanner for containers.
      • Regula - _Fugue_ - Evaluate Terraform infrastructure-as-code for potential security misconfigurations and compliance violations prior to deployment.
      • Terraform Compliance - _terraform-compliance_ - A lightweight, security and compliance focused test framework against terraform to enable negative testing capability for your infrastructure-as-code.
      • Tfsec - _Liam Galvin_ - Scan Terraform templates for security misconfiguration and noncompliance with AWS, Azure and GCP security best practice.
      • Kubescape - _Cloud Native Computing Foundation_ - An open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters.
      • Kube-Score - _Gustav Westling_ - Scan Kubernetes object definitions for security and performance misconfiguration.
      • Kubectrl Kubesec - _ControlPlane_ - Plugin for kubesec.io to perform security risk analysis for Kubernetes resources.
      • Ansible-Lint - _Ansible Community_ - Checks playbooks for practices and behaviour that could potentially be improved. As a community backed project ansible-lint supports only the last two major versions of Ansible.

    • Intentionally Vulnerable Applications

      • Bad SSL - _The Chromium Project_ - A container running a number of webservers with poor SSL / TLS configuration. Useful for testing tooling.
      • Cfngoat - _Bridgecrew_ - Cloud Formation templates for creating stacks of intentionally insecure services in AWS. Ideal for testing the Cloud Formation Infrastructure as Code Analysis tools above.
      • CI/CD Goat - _Cider Security_ - A deliberately vulnerable CI/CD environment. Learn CI/CD security through multiple challenges.
      • Damn Vulnerable Web App - _Ryan Dewhurst_ - A web application that provides a safe environment to understand and exploit common web vulnerabilities.
      • Kubernetes Goat - _Madhu Akula_ - Intentionally vulnerable cluster environment to learn and practice Kubernetes security.
      • NodeGoat - _OWASP_ - A Node.js web application that demonstrates and provides ways to address common security vulnerabilities.
      • Pentest-Ground - _Pentest-Tools.com_ - Pentest-Ground is a free playground with deliberately vulnerable web applications and network services.
      • Terragoat - _Bridgecrew_ - Terraform templates for creating stacks of intentionally insecure services in AWS, Azure and GCP. Ideal for testing the Terraform Infrastructure as Code Analysis tools above.
      • WrongSecrets - _OWASP_ - Vulnerable app with examples showing how to not use secrets
      • Vulnerable Web Apps Directory - _OWASP_ - A collection of vulnerable web applications for learning purposes.
      • Vulnerable Web Apps Directory - _OWASP_ - A collection of vulnerable web applications for learning purposes.

    • Monitoring

      • Csper - _Csper_ - A set of Content Security Policy tools that can test policies, monitor CSP reports and provide metrics and alerts.
      • Streamdal - _Streamdal_ - Embed privacy controls in your application code to detect and monitor PII as it enters and leaves your systems, preventing it from reaching unintended databases, data streams, or pipelines.

    • Secrets Management

      • AWS Key Management Service (KMS) - _Amazon AWS_ - Create and manage cryptographic keys in AWS.
      • AWS Secrets Manager - _Amazon AWS_ - Securely store retrievable application secrets in AWS.
      • BlackBox - _StackExchange_ - Encrypt credentials within your code repository.
      • Chef Vault - _Chef_ - Securely store secrets within Chef.
      • CredStash - _Fugue_ - Securely store secrets within AWS using KMS and DynamoDB.
      • Docker Secrets - _Docker_ - Store and manage access to secrets within a Docker swarm.
      • Git Secrets - _Amazon AWS_ - Scan git repositories for secrets committed within code or commit messages.
      • Gopass - _Gopass_ - Password manager for teams relying on Git and gpg. Manages secrets in encrypted files and repositories.
      • HashiCorp Vault - _HashiCorp_ - Securely store secrets via UI, CLI or HTTP API.
      • Keyscope - _Spectral_ - Keyscope is an open source key and secret workflow tool (validation, invalidation, etc.) built in Rust.
      • Pinterest Knox - _Pinterest_ - Securely store, rotate and audit secrets.
      • Secrets Operations (SOPS) - _Mozilla_ - Encrypt keys stored within YAML, JSON, ENV, INI and BINARY files.
      • Teller - _Spectral_ - A secrets management tool for developers - never leave your command line for secrets.
      • CyberArk Application Access Manager - _CyberArk_ - Secrets management for applications including secret rotation and auditing.

    • Secrets Scanning

      • CredScan - _Microsoft_ - A credential scanning tool that can be run as a task in Azure DevOps pipelines.
      • Detect Secrets - _Yelp_ - An aptly named module for (surprise, surprise) detecting secrets within a code base.
      • GitGuardian - _GitGuardian_ - A web-based solution that scans and monitors public and private git repositories for secrets.
      • Gitleaks - _Zachary Rice_ - Gitleaks is a SAST tool for detecting hardcoded secrets like passwords, api keys, and tokens in git repositories.
      • Repo-supervisor - _Auth0_ - Secrets scanning tool that can run as a CLI, as a Docker container or in AWS Lambda.
      • truffleHog - _Truffle Security_ - Searches through git repositories for secrets, digging deep into commit history and branches.
      • SpectralOps - _Spectral_ - Automated code security, secrets, tokens and sensitive data scanning.

    • Static Analysis

      • DevSkim - _Microsoft_ - A set of IDE plugins, CLIs and other tools that provide security analysis for a number of programming languages.
      • Graudit - _Eldar Marcussen_ - Grep source code for potential security flaws with custom or pre-configured regex signatures.
      • Hawkeye - _Hawkeyesec_ - Modularised CLI tool for project security, vulnerability and general risk highlighting.
      • SemGrep - _r2c_ - Semgrep is a fast, open-source, static analysis tool that finds bugs and enforces code standards at editor, commit, and CI time.
      • FlawFinder - _David Wheeler_ - Scan C / C++ code for potential security weaknesses.
      • Puma Scan - _Puma Security_ - A Visual Studio plugin to scan .NET projects for potential security flaws.
      • Conftest - _Instrumenta_ - Create custom tests to scan any configuration file for security flaws.
      • Selefra - _Selefra_ - An open-source policy-as-code software that provides analytics for multi-cloud and SaaS.
      • Deep Dive - _Discotek.ca_ - Static analysis for JVM deployment units including Ear, War, Jar and APK.
      • Find Security Bugs - _OWASP_ - SpotBugs plugin for security audits of Java web applications. Supports Eclipse, IntelliJ, Android Studio and SonarQube.
      • SpotBugs - _SpotBugs_ - Static code analysis for Java applications.
      • ESLint - _JS Foundation_ - Linting tool for JavaScript with multiple security linting rules available.
      • Golang Security Checker - _securego_ - CLI tool to scan Go code for potential security flaws.
      • Security Code Scan - _Security Code Scan_ - Static code analysis for C# and VB.NET applications.
      • Phan - _Phan_ - Broad static analysis for PHP applications with some support for security scanning features.
      • PHPCS Security Audit - _Floe_ - PHP static analysis with rules for PHP, Drupal 7 and PHP related CVEs.
      • Progpilot - _Design Security_ - Static analysis for PHP source code.
      • Bandit - _Python Code Quality Authority_ - Find common security vulnerabilities in Python code.
      • Brakeman - _Justin Collins_ - Static analysis tool which checks Ruby on Rails applications for security vulnerabilities.
      • DawnScanner - _Paolo Perego_ - Security scanning for Ruby scripts and web application. Supports Ruby on Rails, Sinatra and Padrino frameworks.
      • SonarQube - _SonarSource_ - Scan code for security and quality issues with support for a wide variety of languages.

    • Supply Chain Security

      • Harden Runner GitHub Action - _StepSecurity_ - installs a security agent on the GitHub-hosted runner (Ubuntu VM) to prevent exfiltration of credentials, detect compromised dependencies and build tools, and detect tampering of source code during the build.
      • Overlay - _SCAR_ - a browser extension helping developers evaluate open source packages before picking them.
      • Preflight - _Spectral_ - helps you verify scripts and executables to mitigate supply chain attacks in your CI and other systems, such as in the recent [Codecov hack](https://spectralops.io/blog/credentials-risk-supply-chain-lessons-from-the-codecov-breach/).
      • Sigstore - sigstore is a set of free to use and open source tools, including [fulcio](https://github.com/sigstore/fulcio), [cosign](https://github.com/sigstore/cosign) and [rekor](https://github.com/sigstore/rekor), handling digital signing, verification and checks for provenance needed to make it safer to distribute and use open source software.
      • Syft - _Anchore_ - A CLI tool for generating a Software Bill of Materials (SBOM) from container images and filesystems.

    • Threat Modelling

      • Awesome Threat Modelling - _Practical DevSecOps_ - A curated list of threat modelling resources.
      • SecuriCAD - _Forseeti_ - Treat modelling and attack simulations for IT infrastructure.
      • Raindance Project - _DevSecOps_ - Use attack maps to identify attack surface and adversary strategies that may lead to compromise.
      • SD Elements - _Security Compass_ - Identify and rank threats, generate actionable tasks and track related tickets.
      • Threat Dragon - _OWASP_ - Threat model diagramming tool.
      • Threat Modelling Tool - _Microsoft_ - Threat model diagramming tool.
      • Threatspec - _Threatspec_ - Define threat modelling as code.
Programming Languages
Go 14 Python 7 Ruby 5 JavaScript 4 Java 4 HTML 4 PHP 3 C# 3 TypeScript 2 Shell 2
Categories
Tools 100 Resources 36 Related Lists 1
Sub Categories
Static Analysis 21 Infrastructure as Code Analysis 18 Secrets Management 14 Secure Development Guidelines 11 Intentionally Vulnerable Applications 11 Training 10 Dependency Management 9 Threat Modelling 8 Secrets Scanning 7 Dynamic Analysis 6 Supply Chain Security 5 Podcasts 4 Secure Development Lifecycle Framework 3 Monitoring 2 Communities 2 Books 1 Toolchains 1 Conferences 1 Wikis 1 Newsletters 1 Articles 1
Keywords
security 23 devsecops 11 static-analysis 9 kubernetes 8 devops 8 security-tools 8 static-code-analysis 8 docker 7 golang 6 appsec 6 linter 5 aws 5 go 5 azure 4 vulnerability-scanners 4 gcp 4 infrastructure-as-code 4 owasp 4 vulnerabilities 4 cloudsecurity 3 security-scanner 3 containers 3 analysis 3 vulnerability-detection 3 php 3 terraform 3 compliance 3 cloudformation 3 aws-security 3 ruby 3 ci 2 cybersecurity 2 k8s 2 cloud-security 2 nodejs 2 scanner 2 secret-management 2 analyzer 2 secrets 2 cspm 2 rails 2 cloud-native 2 testing 2 python 2 security-audit 2 security-automation 2 ctf 2 vault 2 vulnerable-web-app 2 iac 2