Awesome Security Pipeline

The practical, continuously verified guide to selecting and implementing open-source security tools at every CI/CD pipeline stage.

**78 actively maintained tools · 15 legacy references · status and supply-chain checks refreshed weekly**

Start with a working pipeline, not an empty checklist. The included GitHub Actions baseline runs Gitleaks, Semgrep, OSV-Scanner, Trivy, Syft, and keyless Cosign against a safe demo, retains machine-readable evidence, and passed end to end in 2m21s on GitHub-hosted runners.

Maintenance promise: repository status is checked weekly, license and documentation evidence monthly, and the tested recipe after every relevant change and at least monthly. Classification rules and exceptions are public in the methodology.

Run the tested pipeline → · Choose controls for your project · Browse tools by pipeline stage · Read the verification methodology

Weekly supply-chain report → Every tool in this list is scanned each week at its latest release: dependencies and known vulnerabilities, vulnerable code in the shipped binary, release signature verification, OpenSSF Scorecard, a GitHub Actions workflow audit, CISA KEV and EPSS context, and what changed since last week. Per-advisory pages show which tools match each advisory and which ship the vulnerable code; data is available as JSON, CSV, and Atom feeds. Method.

Start here

If you want to…	Start with
See a complete working implementation	10-minute quick start
Understand the architecture and measured implementation findings	Technical implementation article
Understand every job, artifact, permission, and failure mode	Security demo guide
Review user-visible release changes and verification evidence	Changelog
Choose a smaller or more specialized stack	Project-type selection matrix
Compare GitHub Actions security tools and permissions	Open-source stack comparison
Choose an SBOM generator and validation workflow	SBOM tools comparison
See every listed tool's dependencies, known vulnerabilities, and week-over-week changes	Weekly supply-chain report
Evaluate why these tools were selected	Reference stack decision
Check how projects are selected and classified	Curation and verification methodology

10-minute quick start

The fastest safe trial is to run the committed demo in a fork. It requires only a GitHub account and GitHub Actions; it requires no cloud account, custom secret, registry, or deployment.

Fork this repository and enable GitHub Actions in the fork.
Open Actions → Security Baseline → Run workflow and select the default branch.
Confirm the Secrets, SAST, Dependencies, IaC, Build, and Package jobs pass.
Inspect the named scan reports, CycloneDX SBOM, exported image, and immutable digest under Artifacts.
To test keyless signing, push the unchanged workflow to the fork's default branch or a v* tag. Manual and pull-request runs intentionally skip signing.

To adapt the baseline in another repository, copy these paths first, then change the examples/security-demo/app scan and build paths to your application:

.github/workflows/security-baseline.yml
.gitleaks.toml
.semgrep/security-baseline.yml
examples/security-demo/        # replace after the first green run

The default policy fails on detected secrets, configured high-confidence SAST findings, any published dependency vulnerability, and fixed HIGH/CRITICAL configuration or image findings. SARIF upload requires GitHub code scanning support; all reports remain downloadable workflow artifacts. See the demo guide before changing thresholds or permissions.

Choose your baseline

Use the smallest set that covers the artifacts you actually ship. “Regulated” below is a starting architecture, not a compliance claim.

Project type	Start with	Add when applicable	Why
Library	Gitleaks, Semgrep, OSV-Scanner	Syft for release SBOMs; Cosign for signed release files	Protect source and dependencies without container-only stages.
Web application	Gitleaks, Semgrep, OSV-Scanner	ZAP against a controlled test deployment	Combine source/dependency gates with explicit dynamic testing.
Container service	Tested baseline: Gitleaks, Semgrep, OSV-Scanner, Trivy, Syft, Cosign	Runtime detection such as Falco when operating the service	Cover source, image, SBOM, and signed-package risks.
Kubernetes service	Container-service baseline	Trivy manifest scanning, Kyverno or Gatekeeper admission policy, runtime detection	Separate build-time evidence from cluster admission and runtime controls.
Regulated project	Relevant baseline above with retained SARIF, SBOM, digest, and signature	Organization-specific policy, approvals, provenance, and evidence retention	Produce reviewable evidence while leaving control mapping to the applicable framework.

Tool catalog
Pre-commit & Secrets Detection
SBOM Generation
Artifact Signing & Verification
Supply Chain Compliance
Software Composition Analysis (SCA)
Static Application Security Testing (SAST)
- Multi-language
- Language-specific
Infrastructure as Code Security
Container Security
- Image Scanning
- Runtime Security
Kubernetes Security
Policy as Code
Secret Management
API & Dynamic Testing (DAST)
Cloud Security
Legacy and Reference Tools

Contributing
License

Tool catalog

Entries are organized by where they operate in a delivery pipeline. Status reflects repository activity, not security effectiveness; stars indicate adoption, not quality. Multi-purpose tools may appear in more than one category with a category-specific description.

Status: 🟢 Active (commit in the last 6 months) · 🟡 Stale (6–12 months) · 🔴 Unmaintained (over 12 months) · ⚪ Archived. Unmaintained and archived tools move to Legacy automatically and return when they are active again. Scorecard (OpenSSF, out of 10) and Release (whether the Linux release file's signature, provenance, or attestation verifies) come from the weekly supply-chain report; select a Scorecard value for the tool's full report. Every column is refreshed weekly from each tool's file in tools/.

Pre-commit & Secrets Detection

Catch secrets and credentials before they enter your repository.

Tool	What it does	Status	★	Scorecard	Release
detect-secrets	Prevent secrets from entering codebases	🟡 Stale _{Apr 2026}	4.7k	3.5	—
gitleaks	Detect and prevent secrets in git repos	🟢 Active _{Oct 2026}	30.6k	report	Checksums
pre-commit	Manage multi-language pre-commit hooks	🟢 Active _{Oct 2026}	15.7k	4.5	—
talisman	Detect secrets with pre-push and pre-commit hooks	🟡 Stale _{Nov 2025}	2.1k	3.3	Checksums
trufflehog	Find credentials in git history and live systems	🟢 Active _{Nov 2026}	28.8k	7.9	✓ Verified

SBOM Generation

Generate Software Bill of Materials for supply chain visibility.

Tool	What it does	Status	★	Scorecard	Release
cdxgen	Create CycloneDX SBOMs for various languages	🟢 Active _{Nov 2026}	1.1k	report	Checksums
cyclonedx-cli	Inspect, convert, and merge CycloneDX SBOMs	🟢 Active _{Jul 2026}	552	report	—
sbom-tool	Generate SBOMs for build artifacts and source repositories	🟢 Active _{Sep 2026}	2.1k	report	—
sbomlyze	Compare SBOMs to detect supply-chain drift _{Maintained by this list's maintainer.}	🟢 Active _{Nov 2026}	26	7.9	✓ Verified
syft	Generate SBOMs from container images and filesystems	🟢 Active _{Nov 2026}	9.8k	8.7	✓ Verified

Artifact Signing & Verification

Sign and verify container images and artifacts for supply chain security.

Tool	What it does	Status	★	Scorecard	Release
cosign	Sign and verify container images	🟢 Active _{Oct 2026}	6.4k	8.2	✓ Verified
notation	Sign and verify OCI artifacts with Notary Project specifications	🟢 Active _{Oct 2026}	502	6.5	Checksums
rekor	Record signed artifacts in a tamper-resistant transparency log	🟢 Active _{Oct 2026}	1.2k	8.6	✓ Verified

Supply Chain Compliance

Audit and verify supply chain security against industry benchmarks.

Tool	What it does	Status	★	Scorecard	Release
in-toto	Protect software supply-chain integrity with signed metadata	🟢 Active _{Aug 2026}	1.1k	6.5	—
scorecard	Measure open-source project security practices with OpenSSF checks	🟢 Active _{Oct 2026}	5.8k	8.6	✓ Verified
slsa-verifier	Verify SLSA provenance for supply chain security	🟢 Active _{Aug 2026}	352	report	✓ Verified

Software Composition Analysis (SCA)

Scan dependencies for known vulnerabilities.

Tool	What it does	Status	★	Scorecard	Release
bomber	Scan SBOMs for vulnerabilities	🟡 Stale _{Feb 2026}	629	report	Checksums
dependency-track	Track components and analyze dependency risk from SBOMs	🟢 Active _{Nov 2026}	4.4k	7.5	—
grype	Scan filesystems and SBOMs for dependency vulnerabilities	🟢 Active _{Oct 2026}	13.2k	7.9	✓ Verified
osv-scanner	Scan dependencies for vulnerabilities in the OSV database	🟢 Active _{Oct 2026}	11.3k	8.6	✓ Verified
safe-chain	Block malicious packages during npm/pip install	🟢 Active _{Oct 2026}	1.8k	4.5	✓ Verified
snyk-cli	Find and fix vulnerabilities in dependencies	🟢 Active _{Oct 2026}	5.7k	report	Checksums
trivy	Scan operating-system and language dependencies for vulnerabilities	🟢 Active _{Oct 2026}	38.9k	7.1	✓ Verified
vet	Enforce dependency policies and report supply-chain risks	🟢 Active _{Nov 2026}	1.1k	7.4	✓ Verified

Static Application Security Testing (SAST)

Analyze source code for security vulnerabilities.

Multi-language

Tools that support multiple programming languages.

Tool	What it does	Status	★	Scorecard	Release
bearer	Trace sensitive data flows and detect security risks in code	🟢 Active _{Oct 2026}	2.8k	6.3	Checksums
codeql	Analyze code semantically with GitHub's query engine	🟢 Active _{Oct 2026}	10.3k	5.8	—
semgrep	Scan source code with multi-language static-analysis rules	🟢 Active _{Oct 2026}	17.4k	report	—
sonarqube	Inspect code continuously for quality and security issues	🟢 Active _{Oct 2026}	11.1k	4.9	—
spotbugs	Find bug patterns in Java bytecode	🟢 Active _{Nov 2026}	4k	4.6	—

Language-specific

Specialized tools for individual programming languages.

Python

Tool	What it does	Status	★	Scorecard	Release
bandit	Find common security issues in Python code	🟢 Active _{Oct 2026}	8.4k	5.8	—
safety	Check Python dependencies for vulnerabilities	🟢 Active _{Sep 2026}	2k	4.7	—

JavaScript/Node.js

Tool	What it does	Status	★	Scorecard	Release
eslint-plugin-security	Detect security patterns in Node.js with ESLint rules	🟢 Active _{Oct 2026}	2.4k	report	—
njsscan	Analyze Node.js applications with semantic SAST rules	🟢 Active _{Oct 2026}	458	5.5	—

Go

Tool	What it does	Status	★	Scorecard	Release
gosec	Find security issues in Go source code	🟢 Active _{Oct 2026}	9k	6.6	✓ Verified
govulncheck	Report reachable Go vulnerabilities in source and binaries	🟢 Active _{Oct 2026}	532	3.7	—

Ruby

Tool	What it does	Status	★	Scorecard	Release
brakeman	Scan Ruby on Rails applications with static analysis	🟢 Active _{Oct 2026}	7.3k	6.0	—

PHP

Tool	What it does	Status	★	Scorecard	Release
phpstan	Analyze PHP code without running it	🟢 Active _{Nov 2026}	14.1k	4.8	—
psalm	Analyze PHP code for type and security issues	🟢 Active _{Nov 2026}	5.9k	4.7	—

Rust

Tool	What it does	Status	★	Scorecard	Release
cargo-audit	Audit Cargo.lock for crates with security vulnerabilities	🟢 Active _{Oct 2026}	2k	report	—

Infrastructure as Code Security

Scan infrastructure configurations for security misconfigurations.

Tool	What it does	Status	★	Scorecard	Release
cfn-lint	Lint AWS CloudFormation templates with security rules	🟢 Active _{Oct 2026}	2.6k	6.0	—
checkov	Scan cloud infrastructure configurations	🟢 Active _{Oct 2026}	9.1k	report	—
kics	Find security vulnerabilities and compliance issues in IaC	🟢 Active _{Oct 2026}	2.7k	report	—
snyk-cli	Scan infrastructure as code for security issues	🟢 Active _{Oct 2026}	5.7k	report	Checksums
trivy	Scan Terraform, CloudFormation, and other IaC for misconfigurations	🟢 Active _{Oct 2026}	38.9k	7.1	✓ Verified
zizmor	Analyze GitHub Actions workflows for security issues	🟢 Active _{Oct 2026}	6.9k	report	✓ Verified

Container Security

Secure container images and runtime environments.

Image Scanning

Scan container images for vulnerabilities before deployment.

Tool	What it does	Status	★	Scorecard	Release
clair	Analyze container images for known vulnerabilities	🟢 Active _{Oct 2026}	11.1k	5.0	—
dive	Inspect image layers and contents; it does not scan vulnerability databases	🟢 Active _{Oct 2026}	54.7k	3.4	Checksums
docker-bench-security	Check Docker deployment against CIS benchmarks	🟢 Active _{Jun 2026}	9.7k	6.7	—
dockle	Lint container images for security best practices	🟢 Active _{Jul 2026}	3.3k	4.1	Checksums
grype	Scan container images for operating-system and library vulnerabilities	🟢 Active _{Oct 2026}	13.2k	7.9	✓ Verified
hadolint	Lint Dockerfiles for security and build best practices	🟢 Active _{Oct 2026}	12.5k	4.7	✓ Verified
trivy	Scan container images for operating-system and library vulnerabilities	🟢 Active _{Oct 2026}	38.9k	7.1	✓ Verified

Runtime Security

Monitor and protect containers at runtime.

Tool	What it does	Status	★	Scorecard	Release
falco	Detect runtime threats in cloud-native environments	🟢 Active _{Oct 2026}	9.5k	7.5	—
sysdig-inspect	Visualize system calls and analyze containers	🟢 Active _{Jul 2026}	1k	report	—
tetragon	Observe and enforce runtime security with eBPF	🟢 Active _{Oct 2026}	5.1k	report	—
tracee	Trace Linux runtime activity and security events with eBPF	🟢 Active _{Sep 2026}	4.7k	7.0	Checksums

Kubernetes Security

Secure Kubernetes clusters, manifests, and workloads.

Tool	What it does	Status	★	Scorecard	Release
kube-bench	Check Kubernetes against CIS benchmarks	🟢 Active _{Oct 2026}	8.2k	5.8	Checksums
kube-linter	Analyze Kubernetes YAML and Helm charts before deployment	🟢 Active _{Oct 2026}	3.5k	7.4	Signed
kubescape	Analyze Kubernetes security risk and configuration compliance	🟢 Active _{Oct 2026}	11.8k	7.6	✓ Verified
KubeStellar Console	View security signals across multiple Kubernetes clusters	🟢 Active _{Nov 2026}	152	report	✓ Verified
kyverno	Enforce policies with Kubernetes-native resources	🟢 Active _{Nov 2026}	8.3k	7.8	✓ Verified
polaris	Validate Kubernetes best practices and policies	🟢 Active _{Oct 2026}	3.4k	5.1	Signed
trivy-operator	Generate Kubernetes-native security reports	🟢 Active _{Oct 2026}	2k	7.5	✓ Verified

Policy as Code

Define and enforce security policies as code across your infrastructure.

Tool	What it does	Status	★	Scorecard	Release
conftest	Test configuration files against OPA policies	🟢 Active _{Oct 2026}	3.3k	7.2	✓ Verified
gatekeeper	Enforce OPA policies through Kubernetes admission control	🟢 Active _{Oct 2026}	4.3k	report	✓ Verified
opa	Evaluate policy as code across application and infrastructure systems	🟢 Active _{Nov 2026}	12.4k	8.2	✓ Verified

Secret Management

Securely manage and distribute secrets in Kubernetes and GitOps workflows.

Tool	What it does	Status	★	Scorecard	Release
external-secrets	Sync secrets from AWS/Vault/Azure into Kubernetes	🟢 Active _{Oct 2026}	6.9k	8.3	—
infisical	Manage application secrets with automation integrations	🟢 Active _{Nov 2026}	30.2k	6.9	—
sealed-secrets	Encrypt secrets locally, decrypt only in cluster	🟢 Active _{Oct 2026}	9.3k	6.8	Signed
sops	Encrypt structured files while preserving editor workflows	🟢 Active _{Oct 2026}	23.6k	report	✓ Verified
vault	Manage secrets, encryption, and privileged access	🟢 Active _{Oct 2026}	36.5k	6.5	—

API & Dynamic Testing (DAST)

Test running applications for vulnerabilities.

Tool	What it does	Status	★	Scorecard	Release
Dark-Moon	Autonomous AI penetration testing platform that exercises running web, API, Active Directory and Kubernetes targets with proof of exploitation	🟢 Active _{Oct 2026}	1.2k	3.8	—
nikto	Scan web servers for dangerous files and known vulnerabilities	🟢 Active _{Aug 2026}	10.8k	3.8	—
nuclei	Scan applications and infrastructure with customizable templates	🟢 Active _{Oct 2026}	32.5k	6.8	Checksums
sqlmap	Detect and validate SQL injection vulnerabilities	🟢 Active _{Oct 2026}	38.8k	4.9	—
wapiti	Scan web applications for vulnerabilities with black-box testing	🟢 Active _{Oct 2026}	1.9k	report	—
zap	Scan web applications dynamically with OWASP ZAP	🟢 Active _{Nov 2026}	16.1k	6.8	—

Cloud Security

Assess and audit cloud infrastructure security posture.

Tool	What it does	Status	★	Scorecard	Release
cartography	Map infrastructure relationships and attack surface	🟢 Active _{Nov 2026}	4.2k	8.1	—
cloudquery	Inventory cloud assets and analyze them with SQL	🟢 Active _{Nov 2026}	6.6k	6.0	Checksums
cloudsplaining	Assess AWS IAM policies for risky permissions	🟢 Active _{Oct 2026}	2.3k	5.7	—
prowler	Assess AWS, Azure, and GCP security configurations	🟢 Active _{Oct 2026}	15.2k	report	—
steampipe	Query cloud resources using SQL	🟢 Active _{Nov 2026}	8k	6.8	✓ Verified

Legacy and Reference Tools

These projects are kept for migration research and historical context, not recommended for new adoption. They are listed here because their repositories are archived or have had no commit for over 12 months. Prefer the alternative noted beside an entry or a maintained tool from the matching category above.

Pre-commit & Secrets Detection

Tool	What it did	Status	★	Use instead
git-secrets	Prevent committing AWS credentials and secrets	🔴 Unmaintained _{Sep 2025}	13.4k	—
whispers	Identify hardcoded secrets in static code analysis	⚪ Archived _{Oct 2021}	506	—

SBOM Generation

Tool	What it did	Status	★	Use instead
spdx-sbom-generator	Generate SPDX format SBOMs from source code	⚪ Archived _{Jan 2025}	427	—
tern	Analyze container images for software composition	🔴 Unmaintained _{Dec 2023}	1k	—

Supply Chain Compliance

Tool	What it did	Status	★	Use instead
chain-bench	Audit supply chain against CIS benchmarks	🔴 Unmaintained _{Jul 2024}	772	—

Static Application Security Testing (SAST) › Multi-language

Tool	What it did	Status	★	Use instead
horusec	Analyze source code across multiple languages	🔴 Unmaintained _{Aug 2023}	1.3k	—

Static Application Security Testing (SAST) › Language-specific › Python

Tool	What it did	Status	★	Use instead
pyre-check	Analyze Python types and selected security properties	⚪ Archived _{Jun 2026}	7.2k	—

Infrastructure as Code Security

Tool	What it did	Status	★	Use instead
terrascan	Detect compliance and security violations in IaC	⚪ Archived _{Nov 2025}	5.2k	—
tfsec	Scan Terraform code for security issues	🔴 Unmaintained _{May 2025}	7.1k	—

Container Security › Image Scanning

Tool	What it did	Status	★	Use instead
anchore-engine	Analyze containers and evaluate image policies	⚪ Archived _{Jan 2023}	1.6k	syft, grype

Kubernetes Security

Tool	What it did	Status	★	Use instead
kube-hunter	Hunt for security weaknesses in Kubernetes clusters	🔴 Unmaintained _{Mar 2024}	5.1k	—
kubiscan	Scan Kubernetes RBAC for risky permissions	🔴 Unmaintained _{May 2025}	1.4k	—

Policy as Code

Tool	What it did	Status	★	Use instead
datree	Prevent Kubernetes misconfigurations	⚪ Archived _{Aug 2023}	6.3k	—

API & Dynamic Testing (DAST)

Tool	What it did	Status	★	Use instead
arachni	Scan web applications for security issues	⚪ Archived _{Apr 2026}	4k	zap, nuclei

Cloud Security

Tool	What it did	Status	★	Use instead
ScoutSuite	Audit security configurations across multiple cloud providers	🔴 Unmaintained _{May 2024}	7.9k	—

Contributing

Contributions are welcome! Please read the contribution guidelines first.

To add a tool, add one JSON file in tools/; the catalog above is generated from those files. Before submitting:

Repository must be at least 1 month old (anti-spam requirement)
Repository must have at least 5 stars
Tool must have been updated within the last 12 months
You must disclose any affiliation with the tool

See CONTRIBUTING.md for full details.

License

To the extent possible under law, the contributors have waived all copyright and related or neighboring rights to this work.

Name		Name	Last commit message	Last commit date
.github		.github
.semgrep		.semgrep
assets		assets
benchmarks/supply-chain		benchmarks/supply-chain
comparisons		comparisons
docs		docs
examples/security-demo		examples/security-demo
scripts		scripts
tests		tests
tools		tools
.gitignore		.gitignore
.gitleaks.toml		.gitleaks.toml
CHANGELOG.md		CHANGELOG.md
CODE_OF_CONDUCT.md		CODE_OF_CONDUCT.md
CONTRIBUTING.md		CONTRIBUTING.md
LICENSE		LICENSE
README.md		README.md

Latest commit

History

Folders and files

Repository files navigation

Awesome Security Pipeline

Start here

10-minute quick start

Choose your baseline

Contents

Tool catalog

Pre-commit & Secrets Detection

SBOM Generation

Artifact Signing & Verification

Supply Chain Compliance

Software Composition Analysis (SCA)

Static Application Security Testing (SAST)

Multi-language

Language-specific

Python

JavaScript/Node.js

Go

Ruby

PHP

Rust

Infrastructure as Code Security

Container Security

Image Scanning

Runtime Security

Kubernetes Security

Policy as Code

Secret Management

API & Dynamic Testing (DAST)

Cloud Security

Legacy and Reference Tools

Pre-commit & Secrets Detection

SBOM Generation

Supply Chain Compliance

Static Application Security Testing (SAST) › Multi-language

Static Application Security Testing (SAST) › Language-specific › Python

Infrastructure as Code Security

Container Security › Image Scanning

Kubernetes Security

Policy as Code

API & Dynamic Testing (DAST)

Cloud Security

Contributing

License

About

Topics

Resources

Code of conduct

Contributing

Stars

Watchers

Forks

Releases

Contributors

Languages