github-security

Tool to detect and monitor GitHub org users' public repositories for secrets and sensitive files

GitGoat is an open source tool that was built to enable DevOps and Engineering teams to design and implement a sustainable misconfiguration prevention strategy. It can be used to test products with access to GitHub repositories without a risk to your production environment.

Self-hosted GitHub security dashboard — tracks org security checks (MFA, branch protection, scanning) with score trends, plus automated Actions cache cleanup. FastAPI + Next.js + PostgreSQL.

Ready-to-wear project templates for GitHub repositories 👔

OSINT Exposure Toolkit: A modular, passive reconnaissance CLI that inspects emails, domains, and usernames for leaks and misconfigurations. Generates interactive HTML, JSON and Markdown reports and a visual exposure graph. Includes GitHub secret scans, HIBP/LeakCheck support, Shodan, Google dorks, JS and metadata scanning.

gitghost — find secrets in a GitHub account's public repos, including ones 'deleted' but still recoverable from git history. Exposure score + HTML dossier. Detection-only, zero dependencies.

GitHub API Data Gatherer, Supports multi-token rotation, deep fetching, field filtering, and linked requests. Built as a proxy to the official GitHub API, it's fully compatible with the official API. ⚡ GitHub API数据采集器，支持多Token轮换、深度爬取、字段过滤，以及联动请求等功能。基于GitHub API代理实现，完全兼容官方API

GitHub security posture analysis for AI agents — 39 MCP tools, 45 checks across org, repos, Actions, secrets, supply chain, and access control

HyperGit brings IntelliJ IDEA's powerful Git & Commit modules to VS Code, enhanced with AI-powered autonomous agents for intelligent repository management. Experience Git in a higher dimension.

An extensive documentation library with guides and examples for optimizing workflows, fostering collaboration, and securing deployments through GitHub's diverse toolset.

An open-source security analysis platform for education and vulnerability discovery.

API-based platform for hunting exposed secrets across GitHub repositories

VS Code extension for project Credential Digger https://github.com/SAP/credential-digger

Security, maintenance, and audit for your GitHub account and organizations

AI-powered GitHub repo security analysis, verified on-chain via OpenGradient TEE

Self-hosted Grafana dashboard for GitHub Security Advisories. Postgres-backed, mirrors the GitHub API 1:1.

Supply-chain malware scanner for Git repos. Finds droppers committed into the repo itself — the kind npm audit can't see because there's no malicious dependency. Runs on git clone or when VS Code opens the folder. Kills the loader, scans every repo you can reach, purges it from history.

Example of how someone can leverage GitHub's capabilities to streamline both application and infrastructure development and deployment processes.

Cloud-hosted gitleaks for GitHub - hunt leaked API keys, wallet private keys & secrets across 40 services. PR refs + full git history + parallel scanning. Apify actor.

ClaudeRabbit is a free, open-source security product protecting the open-source community from malware. We clone any public GitHub repo into an isolated sandbox, run it, and return one honest safety score.