5 projects
depsweep
Find supply-chain risks in npm and pip dependency files: install hooks, non-registry sources, insecure URLs, typosquats.
sshield
Audit SSH server and client configuration files for weak settings.
cicheck
Security linter for non-GitHub CI pipelines: GitLab CI, CircleCI, Azure Pipelines, Bitbucket, Drone, Travis.
siftscan
Scan AI agent instruction files (CLAUDE.md, .cursorrules, AGENTS.md, mcp.json) for hidden or planted instructions.
jwtlint
Offline static security analysis for JWTs.
