Learn to code securely while having fun through our popular open source in-editor experience, designed for developers, students, and anyone curious about security. Get started for free in under 2 minutes, playing right from your browser.
Static Value-Flow Analysis Framework for Source Code
Lightweight, container-free sandbox for running commands with network and filesystem restrictions
Globstar is a fast, feature-rich, and open-source static analysis toolkit for writing and running code checkers. Based on tree-sitter.
Prevent merging of malicious code in pull requests
A security scanner as fast as a linter, written in Rust. Live in the terminal? It also comes with a TUI triage for secrets, post-quantum audits, diff-scans and more 🦊
Django application that performs SAST and Malware Analysis for Android APKs
Focused malicious code detection ruleset, with a high protection-to-noise ratio
AISecOps (AI Security Operations) framework for deterministic verification of AI systems. QWED verifies LLM outputs using math, logic, and symbolic execution — creating an auditable trust boundary for agentic AI systems. Not generation. Verification.
AI-powered SAST scanner that finds auth bypass, IDOR, and logic bugs Semgrep/CodeQL miss. Free GitHub Action. Supports Python, JS/TS, Go, PHP, Ruby.
OpenVul: An Open-Source Post-Training Framework for LLM-Based Vulnerability Detection
Codeaudit - Modern Python source code security analyzer based on distrust.
AI code generation and improvement
The purpose of this document is to outline the security risks and vulnerabilities that may arise when implementing ai in web applications and to provide best practices for mitigating these risks.
Multi-language static analysis with cross-file taint tracking. Scan your repo, triage findings in your browser, commit triage state with your code. No cloud, no account.
Security gate for AI-generated code - blocks the build until vulnerabilities are fixed
Detect and patch vulnerabilities in AI-generated Python code — VS Code extension
A fast and powerful CLI tool for finding secrets and other data in files, web pages, and other text sources. Supports multi-threading and advanced pattern matching.
Dismiss GitHub Code Scanning alerts from SARIF suppression data
LLM <-- MCP --> CodeQL( AST | CFG | CLI | LSP )
Add a description, image, and links to the code-security topic page so that developers can more easily learn about it.
To associate your repository with the code-security topic, visit your repo's landing page and select "manage topics."