추천 보안 오픈소스 프로젝트

Open-source authentication and authorization server adding two-factor login and single sign-on to web apps via a portal used with reverse proxies.

A CLI tool for detecting hardcoded secrets such as passwords, API keys and tokens in git repos, files and stdin.

Ghidra is an open-source software reverse engineering framework from the NSA, offering disassembly, decompilation, graphing and scripting for compiled code.

Mounts multiple cloud drives and S3/WebDAV-style storage as one local folder, with rclone-compatible end-to-end encryption.

A lightweight, self-hosted OpenID Connect identity provider for small teams, with password login, mandatory TOTP, RBAC and shared SSO.

Self-hosted control plane that issues, renews, discovers, inventories and deploys TLS certificates across your infrastructure.

Open-source cookie consent manager and GDPR cookie banner for React, Next.js, Vue, Nuxt, Svelte, Astro and plain HTML.

A framework-agnostic authentication and authorization framework for TypeScript, with a plugin system for features like 2FA and multi-tenancy.

Self-hostable authentication server for consumer apps, offering passkeys, passwordless login, MFA, social and enterprise SSO, with a pre-built login UI.

Self-hosted, cookie-free CAPTCHA alternative that uses a proof-of-work challenge to block spam and bots, with WCAG 2.2 AA accessibility.

A CLI tool that extracts TLS/SSL certificates from servers and exports them as print output, PEM, DER, or p12/JKS truststores.

A forensic tool that processes, analyzes and visualizes Google Chrome browsing artifacts such as history, logins, downloads and cache.

An MCP server that exposes Ghidra's reverse engineering functions so LLM clients can decompile and analyze binaries.

Open-source Python SDK and service for detecting and anonymizing PII in text, images and structured data.

A Python command-line tool that decompiles Android APK files with jadx and scans them for URLs, endpoints and hardcoded secrets.

A Python scanner that checks MCP servers and tools for security threats using Cisco AI Defense, YARA rules, and LLM-based analysis.

A self-hosted, email-first dead man's switch that delivers end-to-end encrypted messages to your loved ones if you stop checking in.

AI-powered OSINT tool that searches dark web engines through Tor, uses an LLM to refine queries and filter results, and writes an investigation summary.

A terminal-based autonomous penetration testing agent that runs security tools, tracks engagement state, and coordinates multiple specialist subagents.

Open-source graph-based OSINT investigation platform that links entities like domains, IPs, emails and wallets through automated enrichers.