OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm: https://www.npmjs.com/package/@openai/codex-security

nodejs cli npm security typescript sdk cybersecurity openai application-security codex devsecops vulnerability-scanning code-scanning ai-security codex-security

• Updated Nov 12, 2026
• TypeScript

Extensions to the PHP Reflection API, static code scanning, and code generation

code-generation code-scanning reflection-api

• Updated Nov 10, 2026
• PHP

Actions for running CodeQL analysis

ci actions code-scanning semmle-ql codeql advanced-security

• Updated Nov 12, 2026
• TypeScript

Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/

javascript python java go dart php typescript static-analysis code-quality python-security devsecops ai-agents code-scanning sast github-actions dead-code prompt-injection ai-generated-code ai-code-review dead-code-detection

• Updated Nov 12, 2026
• Python

🚀 Useful README.md, LICENSE, CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md, GitHub Issues, Pull Requests and Actions templates to jumpstart your projects.

github template readme issues documentation pr docs bug-tracker labels docs-generator issue code-of-conduct pull-requests documentation-generator code-scanning merge-request code-of-conduct-template github-actions pull-requests-template

• Updated Aug 10, 2024
• Python

📝 Source repository of Qodana Help

javascript kotlin python java php typescript static-code-analysis continuous-integration ci jetbrains static-analysis code-review code-quality code-scanning

• Updated Nov 12, 2026

⚙️ Scan your Go, Java, Kotlin, PHP, Python, JavaScript, TypeScript, .NET projects at GitHub with Qodana. This repository contains Qodana for Azure, GitHub, CircleCI and Gradle

javascript kotlin python java go php typescript static-code-analysis dotnet static-analysis actions code-review code-quality sarif devsecops code-scanning azure-pipelines github-actions azure-extensions qodana

• Updated Oct 29, 2026
• JavaScript

Evidence-grounded cryptographic inventory and post-quantum migration planning for software repositories. Local static analysis, zero mandatory runtime dependencies, SARIF and CycloneDX output.

python security cryptography static-analysis post-quantum-cryptography sarif code-scanning pqc cyclonedx cryptographic-inventory

• Updated Sep 5, 2026
• Python

🔧 JetBrains Qodana’s official command line tool

javascript kotlin python java cli php typescript static-code-analysis ci code-review code-quality sarif devsecops code-scanning qodana sarif-report

• Updated Nov 12, 2026
• Go

Telling tales on you for leaking secrets!

go golang aws security static-analysis secrets git-tool hacktoberfest leak-detection security-tools devsecops code-scanning sarif-report leaking-secrets

• Updated Oct 21, 2026
• Go

This repository contains CodeQL queries and libraries which support various Coding Standards.

cpp14 coding-standards cert misra autosar code-scanning functional-safety iso26262 codeql

• Updated Nov 11, 2026
• CodeQL

High-performance open-source security scanner combining SAST, SCA, Secret Detection, and IaC analysis, built for developers and CI/CD pipelines, using AI for recommendation!

ai static-analysis application-security sca security-scanner devsecops code-scanning vulnerability-scanner cloud-security sast dependency-scanning open-source-security iac-security shift-left-security secret-detection cicd-security ai-remediation

• Updated Oct 26, 2026
• Go

NaiveSystems Analyze is a static analysis tool for code security and compliance.

static-analysis cpp14 coding-standards cert cppcheck misra autosar code-scanning functional-safety iso26262 misra-c

• Updated Dec 29, 2025
• C++

codemillx is a tool for CodeQL, extract the comments in the code and generate codeql module. 强化Go开源项目安全检测(内含开源项目漏洞挖掘方法)

code-scanning codeql codeql-models

• Updated Mar 19, 2022
• Go

GitHub Action that detects the Shai-Hulud 2.0 (Nov 2025) and ChainDrop (Aug 2026) npm supply-chain attacks. Scans dependencies, lockfiles and CI workflows against a daily-updated database of 1,200+ compromised packages, flags malicious install scripts, TruffleHog secret theft and SHA1HULUD runners. SARIF output for GitHub Code Scanning.

nodejs npm security ioc sarif devsecops code-scanning malware-detection threat-detection credential-theft github-actions github-action dependency-scanning open-source-security supply-chain-security npm-security shai-hulud supply-chain-attack chaindrop shai-hulud-2

• Updated Nov 12, 2026
• TypeScript

Static Code Analysis for security teams with Inter file taint analysis. Built for finding vulnerabilities, advanced structural search, derive insights and supports MCP

security static-code-analysis mcp static-analysis application-security security-tools ai-agents code-scanning sast structural-search mcp-server ai-sast

• Updated Jul 10, 2026
• Go

GitHub Advance Security Compliance Action

security security-automation devsecops code-scanning ghas

• Updated Dec 14, 2022
• Python

Free, MIT-licensed MCP security testing from ClearFrame. Scan, audit, compare, and review locally; continue in the ClearFrame CLI or Mac app.

cli security mcp developer-tools regression-testing sarif code-scanning ai-security github-action supply-chain-security ai-agent model-context-protocol mcp-server agent-security mcp-security schema-drift ai-supply-chain mcp-testing mcp-ci clearframe

• Updated Nov 12, 2026
• TypeScript

GPU-accelerated secret scanner for code, Git history, containers, cloud, browser assets, and CI. 923 detectors, live verification, CUDA, Metal, WGPU.

rust credentials static-analysis pre-commit simd gpu-acceleration git-history sarif devsecops hyperscan code-scanning cloud-security sast container-security api-keys secrets-detection secret-scanning secret-scanner ci-cd-security api-key-scanner

• Updated Nov 12, 2026
• Rust

The sound, open SAST for modern apps: code, dependencies, secrets, infrastructure and AI, in one tool

security static-analysis symbolic-execution cybersecurity z3 application-security program-analysis taint-analysis appsec security-scanner separation-logic secure-coding sarif security-tools devsecops code-scanning vulnerability-scanner sast ai-security llm

• Updated Nov 11, 2026
• Python