application-security

opentrap

+177

A free, open-source alternative to Burp Suite: an intercepting proxy and web app security testing suite with Repeater, Intruder, Collaborator and a built-in OWASP ZAP scanner. Linux, AGPL-3.0.

google/mantis

+150

A modular, stack-agnostic toolkit for AI coding agents to autonomously find, reproduce, and patch vulnerabilities.

SafeLine

+242

SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.

Claude-BugHunter

+141

A Claude Code skill bundle for bug hunting and external red-team work - 82 skills, 15 slash commands, 681 disclosed-report patterns curated across 24 core vulnerability classes, plus enterprise identity + infrastructure attack matrices.

codex-security

+85

OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm: https://www.npmjs.com/package/@openai/codex-security

CheatSheetSeries

+71

The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.

juice-shop

+69

OWASP Juice Shop: Probably the most modern and sophisticated insecure web application

bug-bounty-hunting-prompts

+84

Reusable prompts for a structured, evidence-first bug bounty hunting workflow

OWASP/wstg

+58

The Web Security Testing Guide is a comprehensive Open Source guide to testing the security of web applications and web services.