Awesome GitHub RepositoriesInfrastructure and Configuration

Grype is a command-line security scanner designed to identify known vulnerabilities within container images, filesystems, and software manifests. It functions as a software composition analysis tool that detects security flaws in application components and open-source libraries to support supply chain security. The tool distinguishes itself by reconstructing the final state of container images through layered filesystem inspection and normalizing diverse package formats into a unified dependency graph. It maintains a local cache of security advisories synchronized from multiple upstream sourc

Hadolint is a Dockerfile linter and Haskell-based static analysis tool. It analyzes container image configuration files against a set of rules to ensure valid syntax and adherence to best practices. The tool functions as a wrapper for shell checkers to inspect inline shell commands and scripts within build instructions, identifying scripting errors and bugs. It also includes security auditing capabilities to warn when images are pulled from registries not explicitly listed as trusted. The analysis engine covers quality assurance through label schema validation, syntax pattern verification, a

Clair is a container vulnerability scanner that performs static analysis of container images to identify known security vulnerabilities. It functions as an analyzer for OCI and Docker images, indexing their contents to detect security risks and outdated packages without requiring the containers to be running. The tool identifies vulnerabilities by matching indexed container components against security databases to find common vulnerabilities and exposures. This process involves analyzing filesystem layers to track the provenance and versioning of packages across the image hierarchy. The proj

Gixy is a static configuration analyzer and security auditor for Nginx. It functions as an infrastructure-as-code security scanner and web server configuration linter designed to identify vulnerabilities and misconfigurations in server definitions before deployment. The tool focuses on detecting high-risk security flaws, including host header spoofing, server-side request forgery, and path traversal. It specifically audits Nginx configurations for risks such as HTTP splitting, multiline header issues, and unauthorized third-party access resulting from incorrect Referer or Origin header patter

tfsec is a static analysis tool and security scanner for infrastructure as code, specifically designed to detect misconfigurations and compliance violations in Terraform and cloud infrastructure definitions before deployment. It functions as a cloud security policy engine that identifies vulnerabilities across multiple cloud platforms. The tool provides capabilities for cloud compliance auditing and scanning of Cloud Development Kit code. It supports custom security policy enforcement and allows for the definition of organization-specific security requirements. The scanner includes features

Bloaty est un profileur de taille binaire et un analyseur de format exécutable qui attribue chaque octet d'un binaire à des symboles ou des unités de compilation spécifiques. Il fonctionne comme un profileur d'unité de compilation et un démangleur de symboles C++, mappant la taille binaire vers les fichiers sources et traduisant les noms mangled en formats lisibles par l'humain. Le projet se distingue comme un outil de diff binaire capable de comparer deux versions d'un binaire pour isoler des symboles ou des sections spécifiques responsables de régressions de taille. Il fournit une prise en charge spécialisée pour récupérer les symboles dans les binaires stripés en les associant à des fichiers de débogage externes utilisant des identifiants de build. L'outil fournit une analyse binaire complète pour les formats ELF, Mach-O, PE/COFF et WebAssembly. Ses capacités incluent l'analyse des sections de l'éditeur de liens, des segments mémoire et des archives de bibliothèques statiques, ainsi que l'identification de l'espace consommé par les fonctions inlinées. Les utilisateurs peuvent isoler davantage les données en utilisant le filtrage par expression régulière et exporter les résultats de profilage dans des formats CSV ou TSV.

KubeLinter is a static analysis tool that checks Kubernetes YAML files and Helm charts to ensure the applications represented in them adhere to best practices.

Container Image Linter for Security, Helping build the Best-Practice Docker Image, Easy to start

A FAST Kubernetes manifests validator, with support for Custom Resources!

CloudFormation Linter

CLI tool for linting and testing Helm charts

Twiggy🌱 is a code size profiler

Guard offers a policy-as-code domain-specific language (DSL) to write rules and validate JSON- and YAML-formatted data such as CloudFormation Templates, K8s configurations, and Terraform JSON plans/configurations against those rules. Take this survey to provide feedback about cfn-guard: https://amazonmr.au1.qualtrics.com/jfe/form/SV_bpyzpfoYGGuuUl0

A binary static analysis tool that provides security and correctness results for Windows Portable Executable and *nix ELF binary formats

Packj stops :zap: Solarwinds-, ESLint-, and PyTorch-like attacks by flagging malicious/vulnerable open-source dependencies ("weak links") in your software supply-chain

A best practices checker for Kubernetes clusters. 🤠

Linker/Compiler/Tool detector for Windows, Linux and MacOS.

The Jakstab static analysis platform for binaries

A linter for Kubernetes resources with a customizable rule set

A 'realtime' kubernetes resource linter