The practical, continuously verified guide to selecting and implementing open-source security tools at every CI/CD pipeline stage.
92 metadata-verified repositories · 6 recipe-tested controls · catalog verified July 16, 2026
Start with a working pipeline, not an empty checklist. The included GitHub Actions baseline runs Gitleaks, Semgrep, OSV-Scanner, Trivy, Syft, and keyless Cosign against a safe demo, retains machine-readable evidence, and passed end to end in 2m21s on GitHub-hosted runners.
Maintenance promise: repository status is checked weekly, license and documentation evidence monthly, and the tested recipe after every relevant change and at least monthly. Classification rules and exceptions are public in the methodology.
Run the tested pipeline → · Choose controls for your project · Browse tools by pipeline stage · Read the verification methodology
| If you want to… | Start with |
|---|---|
| See a complete working implementation | 10-minute quick start |
| Understand the architecture and measured implementation findings | Technical implementation article |
| Understand every job, artifact, permission, and failure mode | Security demo guide |
| Review user-visible release changes and verification evidence | Changelog |
| Choose a smaller or more specialized stack | Project-type selection matrix |
| Compare GitHub Actions security tools and permissions | Open-source stack comparison |
| Choose an SBOM generator and validation workflow | SBOM tools comparison |
| Inspect continuously tested SBOM compatibility history | SBOM benchmark reports |
| Evaluate why these tools were selected | Reference stack decision |
| Check how projects are selected and classified | Curation and verification methodology |
The fastest safe trial is to run the committed demo in a fork. It requires only a GitHub account and GitHub Actions; it requires no cloud account, custom secret, registry, or deployment.
- Fork this repository and enable GitHub Actions in the fork.
- Open Actions → Security Baseline → Run workflow and select the default branch.
- Confirm the Secrets, SAST, Dependencies, IaC, Build, and Package jobs pass.
- Inspect the named scan reports, CycloneDX SBOM, exported image, and immutable digest under Artifacts.
- To test keyless signing, push the unchanged workflow to the fork's default branch or a
v*tag. Manual and pull-request runs intentionally skip signing.
To adapt the baseline in another repository, copy these paths first, then change the examples/security-demo/app scan and build paths to your application:
.github/workflows/security-baseline.yml
.gitleaks.toml
.semgrep/security-baseline.yml
examples/security-demo/ # replace after the first green run
The default policy fails on detected secrets, configured high-confidence SAST findings, any published dependency vulnerability, and fixed HIGH/CRITICAL configuration or image findings. SARIF upload requires GitHub code scanning support; all reports remain downloadable workflow artifacts. See the demo guide before changing thresholds or permissions.
Use the smallest set that covers the artifacts you actually ship. “Regulated” below is a starting architecture, not a compliance claim.
| Project type | Start with | Add when applicable | Why |
|---|---|---|---|
| Library | Gitleaks, Semgrep, OSV-Scanner | Syft for release SBOMs; Cosign for signed release files | Protect source and dependencies without container-only stages. |
| Web application | Gitleaks, Semgrep, OSV-Scanner | ZAP against a controlled test deployment | Combine source/dependency gates with explicit dynamic testing. |
| Container service | Tested baseline: Gitleaks, Semgrep, OSV-Scanner, Trivy, Syft, Cosign | Runtime detection such as Falco when operating the service | Cover source, image, SBOM, and signed-package risks. |
| Kubernetes service | Container-service baseline | Trivy manifest scanning, Kyverno or Gatekeeper admission policy, runtime detection | Separate build-time evidence from cluster admission and runtime controls. |
| Regulated project | Relevant baseline above with retained SARIF, SBOM, digest, and signature | Organization-specific policy, approvals, provenance, and evidence retention | Produce reviewable evidence while leaving control mapping to the applicable framework. |
- Start here
- 10-minute quick start
- Choose your baseline
- Tool catalog
- Pre-commit & Secrets Detection
- SBOM Generation
- Artifact Signing & Verification
- Supply Chain Compliance
- Software Composition Analysis (SCA)
- Static Application Security Testing (SAST)
- Infrastructure as Code Security
- Container Security
- Kubernetes Security
- Policy as Code
- Secret Management
- API & Dynamic Testing (DAST)
- Cloud Security
- Legacy and Reference Tools
- Reading the Badges
- Contributing
- License
Entries below are organized by where they operate in a delivery pipeline. Status reflects repository activity, not security effectiveness; stars indicate adoption, not quality. Multi-purpose tools may appear in more than one category with a category-specific description.
Catch secrets and credentials before they enter your repository.
- detect-secrets - Prevent secrets from entering codebases.
- git-secrets - Prevent committing AWS credentials and secrets.
- gitleaks - Detect and prevent secrets in git repos.
- pre-commit - Manage multi-language pre-commit hooks.
- talisman - Detect secrets with pre-push and pre-commit hooks.
- trufflehog - Find credentials in git history and live systems.
Generate Software Bill of Materials for supply chain visibility.
- cdxgen - Create CycloneDX SBOMs for various languages.
- cyclonedx-cli - Inspect, convert, and merge CycloneDX SBOMs.
- sbom-tool - Generate SBOMs for build artifacts and source repositories.
- sbomlyze - Compare SBOMs to detect supply-chain drift.
- syft - Generate SBOMs from container images and filesystems.
Sign and verify container images and artifacts for supply chain security.
- cosign - Sign and verify container images.
- notation - Sign and verify OCI artifacts with Notary Project specifications.
- rekor - Record signed artifacts in a tamper-resistant transparency log.
Audit and verify supply chain security against industry benchmarks.
- in-toto - Protect software supply-chain integrity with signed metadata.
- scorecard - Measure open-source project security practices with OpenSSF checks.
- slsa-verifier - Verify SLSA provenance for supply chain security.
Scan dependencies for known vulnerabilities.
- bomber - Scan SBOMs for vulnerabilities.
- dependency-track - Track components and analyze dependency risk from SBOMs.
- grype - Scan filesystems and SBOMs for dependency vulnerabilities.
- osv-scanner - Scan dependencies for vulnerabilities in the OSV database.
- safe-chain - Block malicious packages during npm/pip install.
- snyk-cli - Find and fix vulnerabilities in dependencies.
- trivy - Scan operating-system and language dependencies for vulnerabilities.
- vet - Enforce dependency policies and report supply-chain risks.
Analyze source code for security vulnerabilities.
Tools that support multiple programming languages.
- bearer - Trace sensitive data flows and detect security risks in code.
- codeql - Analyze code semantically with GitHub's query engine.
- semgrep - Scan source code with multi-language static-analysis rules.
- sonarqube - Inspect code continuously for quality and security issues.
- spotbugs - Find bug patterns in Java bytecode.
Specialized tools for individual programming languages.
- bandit - Find common security issues in Python code.
- safety - Check Python dependencies for vulnerabilities.
- eslint-plugin-security - Detect security patterns in Node.js with ESLint rules.
- gosec - Find security issues in Go source code.
- govulncheck - Report reachable Go vulnerabilities in source and binaries.
- brakeman - Scan Ruby on Rails applications with static analysis.
- phpstan - Analyze PHP code without running it.
- psalm - Analyze PHP code for type and security issues.
- cargo-audit - Audit Cargo.lock for crates with security vulnerabilities.
Scan infrastructure configurations for security misconfigurations.
- cfn-lint - Lint AWS CloudFormation templates with security rules.
- checkov - Scan cloud infrastructure configurations.
- kics - Find security vulnerabilities and compliance issues in IaC.
- snyk-iac - Scan infrastructure as code for security issues.
- trivy - Scan Terraform, CloudFormation, and other IaC for misconfigurations.
- zizmor - Analyze GitHub Actions workflows for security issues.
Secure container images and runtime environments.
Scan container images for vulnerabilities before deployment.
- clair - Analyze container images for known vulnerabilities.
- docker-bench-security - Check Docker deployment against CIS benchmarks.
- dockle - Lint container images for security best practices.
- grype - Scan container images for operating-system and library vulnerabilities.
- hadolint - Lint Dockerfiles for security and build best practices.
- trivy - Scan container images for operating-system and library vulnerabilities.
Monitor and protect containers at runtime.
- falco - Detect runtime threats in cloud-native environments.
- tetragon - Observe and enforce runtime security with eBPF.
- tracee - Trace Linux runtime activity and security events with eBPF.
Secure Kubernetes clusters, manifests, and workloads.
- kube-bench - Check Kubernetes against CIS benchmarks.
- kube-linter - Analyze Kubernetes YAML and Helm charts before deployment.
- kubescape - Analyze Kubernetes security risk and configuration compliance.
- KubeStellar Console - View security signals across multiple Kubernetes clusters.
- kyverno - Enforce policies with Kubernetes-native resources.
- polaris - Validate Kubernetes best practices and policies.
- trivy-operator - Generate Kubernetes-native security reports.
Define and enforce security policies as code across your infrastructure.
- conftest - Test configuration files against OPA policies.
- gatekeeper - Enforce OPA policies through Kubernetes admission control.
- opa - Evaluate policy as code across application and infrastructure systems.
Securely manage and distribute secrets in Kubernetes and GitOps workflows.
- external-secrets - Sync secrets from AWS/Vault/Azure into Kubernetes.
- infisical - Manage application secrets with automation integrations.
- sealed-secrets - Encrypt secrets locally, decrypt only in cluster.
- sops - Encrypt structured files while preserving editor workflows.
- vault - Manage secrets, encryption, and privileged access.
Test running applications for vulnerabilities.
- nikto - Scan web servers for dangerous files and known vulnerabilities.
- nuclei - Scan applications and infrastructure with customizable templates.
- sqlmap - Detect and validate SQL injection vulnerabilities.
- wapiti - Scan web applications for vulnerabilities with black-box testing.
- zap - Scan web applications dynamically with OWASP ZAP.
Assess and audit cloud infrastructure security posture.
- cartography - Map infrastructure relationships and attack surface.
- cloudquery - Inventory cloud assets and analyze them with SQL.
- cloudsplaining - Assess AWS IAM policies for risky permissions.
- prowler - Assess AWS, Azure, and GCP security configurations.
- steampipe - Query cloud resources using SQL.
These projects are retained for migration research and historical context, not recommended for new adoption. They are separated from the active catalog because their repositories are archived or exceed the project's unmaintained threshold. Prefer the maintained alternatives noted beside an entry or select one from the active category above.
- whispers - Identify hardcoded secrets in static code analysis.
- spdx-sbom-generator - Generate SPDX format SBOMs from source code.
- tern - Analyze container images for software composition.
- chain-bench - Audit supply chain against CIS benchmarks.
- horusec - Analyze source code across multiple languages.
- pyre-check - Analyze Python types and selected security properties.
- njsscan - Analyze Node.js applications with semantic SAST rules.
- terrascan - Detect compliance and security violations in IaC.
- tfsec - Scan Terraform code for security issues.
- anchore-engine - Analyze containers and evaluate image policies.
(Migrate to Syft + Grype)
- dive - Inspect image layers and contents; it does not scan vulnerability databases.
- sysdig-inspect - Visualize system calls and analyze containers.
- kube-hunter - Hunt for security weaknesses in Kubernetes clusters.
- kubiscan - Scan Kubernetes RBAC for risky permissions.
- datree - Prevent Kubernetes misconfigurations.
- ScoutSuite - Audit security configurations across multiple cloud providers.
Each tool displays status and activity badges for transparency.
Status badges are automatically updated every week by our GitHub Action to reflect current maintenance status.
| Badge | Meaning |
|---|---|
 |
Active - Updated within the last 6 months |
 |
Stale - No updates in 6-12 months; use with caution |
 |
Unmaintained - No updates in 12+ months; consider alternatives |
 |
Archived - Repository has been archived by owner |
 |
Deprecated - Officially superseded; migration recommended |
| Badge | Meaning |
|---|---|
 |
GitHub star count - indicates community adoption |
 |
Last commit date - shows exact update time |
Tip: While we update status badges weekly, always verify the "Last Commit" badge for the most current information before adopting a tool.
Contributions are welcome! Please read the contribution guidelines first.
Before submitting:
- Repository must be at least 1 month old (anti-spam requirement)
- Repository must have at least 5 stars
- Tool must have been updated within the last 12 months
- You must disclose any affiliation with the tool
See CONTRIBUTING.md for full details.
To the extent possible under law, the contributors have waived all copyright and related or neighboring rights to this work.