code-scanning

Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/

🚀 Useful README.md, LICENSE, CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md, GitHub Issues, Pull Requests and Actions templates to jumpstart your projects.

Evidence-grounded cryptographic inventory and post-quantum migration planning for software repositories. Local static analysis, zero mandatory runtime dependencies, SARIF and CycloneDX output.

GitHub Advance Security Compliance Action

Code scanner to check for issues in prompts and LLM calls

CodeScanAI is an open source tool that utilizes powerful AI models (OpenAI, Gemini, and even self-hosted servers) to scan your codebase for possible security vulnerabilities.

Codeaudit - Modern Python source code security analyzer based on distrust.

Find and fix web-app vulnerabilities in one command — SAST + DAST + AI, for devs who aren't security experts.

A GitHub action for organizations that enables advanced security code scanning on all new repos

Real-time AI safety guardrails for LLM apps. 10 scanners: prompt injection, PII, harmful content, code vulnerabilities, obfuscation detection. Sub-ms latency. Python + TypeScript SDKs. MCP proxy. Claude Code hooks.

Static auditor for randomness and nonce hygiene in Python source - flags weak PRNGs, hardcoded keys, reused counters, static IVs, short salts. CWE-330 mapped, CI-gating exit codes. Python 3.11, stdlib only.

Offline-first, multi-language SAST with semantic data-flow analysis, deterministic security rules, SARIF/PDF reporting, Docker isolation, and optional local Ollama enrichment.

Introdução Guiada ao Code Scanning

🔒 Security scanner for AI Skills | Detect dangerous commands, prompt injection, secrets, and suspicious patterns before install

A secret scanner wrapper to aggregate results across multiple secret scanning tools

Lets Threat Model is an AI-driven tool that helps teams identify and manage threats early in the development lifecycle. Built with extensibility and automation in mind, it brings security into agile workflows by generating actionable threat models.

Run NVIDIA SkillSpector in GitHub Actions to scan AI agent SKILL.md repos, upload SARIF, and report PR findings.

Free security scanner for AI-generated code. SAST + secret detection on every PR. 24-line YAML, 30-second setup. Built for vibe coding.

Adapters and tools for lintrunner

Automated security auditing CLI for AI agent code — quarantine-first workflow for repos, packages, and agent tooling