Awesome GitHub RepositoriesSecurity Profiles

This project is a suite of specialized tools for linting, minifying, analyzing, and managing container images and their associated registries. It provides a set of utilities including an image minifier to reduce image size, a security profiler to harden running containers, an image analyzer for static inspection, and a registry manager for organizing multi-architecture indices. The toolset distinguishes itself through behavior-based optimization and security. It uses dynamic analysis to track executed instructions and file access to remove unused binary data, and records kernel interactions t

Slim is a comprehensive suite for container lifecycle management, providing tools for image inspection, optimization, security hardening, and service troubleshooting. It functions as a platform for analyzing containerized applications through both static metadata review and dynamic behavioral probing, enabling users to understand image composition and runtime dependencies. The project distinguishes itself by automating the creation of minimal, production-ready container images. It achieves this by removing unnecessary files and components, flattening image layers, and synthesizing restrictive

This project is a security hardening guide and privacy configuration manual for macOS. It provides a comprehensive set of instructions for configuring system settings to improve privacy, reduce the attack surface, and implement a malware defense framework. The guide covers technical methods for validating software notarization, verifying application sandboxing, and auditing system activity. It distinguishes itself by providing detailed workflows for restricting high-risk features and applying advanced security configurations to protect the operating system. The documentation covers several k

systemd is a comprehensive system and service manager for Linux that orchestrates the entire operating system lifecycle. It functions as the primary init system, managing the transition from firmware to a fully initialized user space while providing a unified framework for service orchestration, hardware management, and resource control. The project distinguishes itself through its declarative, unit-based configuration model and dynamic dependency resolution, which allow for efficient, on-demand service activation and socket-based process management. It integrates deep system observability th

Lynis is an automated security auditing and system hardening framework designed for UNIX-based operating systems. It functions as a command-line utility that inspects local system configurations to identify security vulnerabilities, configuration weaknesses, and compliance gaps. By executing a series of modular tests, the tool generates actionable reports and remediation suggestions to assist in strengthening system defenses. The project distinguishes itself through a highly modular architecture that relies on shell-script-based execution and native system inspection. Users can define custom

Waydroid is a containerized mobile runtime that executes a full Android operating system directly on Linux desktop environments. By utilizing Linux kernel namespaces, it isolates the mobile environment while sharing the host kernel to provide native-like performance and hardware access for mobile applications. The project distinguishes itself through deep integration with the host system, bridging mobile display buffers to native desktop windows and translating host input events into mobile gestures. It enables multi-window management, allowing mobile applications to run alongside native desk

Talos is a minimal, immutable Linux distribution designed specifically for deploying and managing Kubernetes clusters. It functions as an API-driven infrastructure manager that replaces traditional shell access with a declarative gRPC interface to control operating system state and configuration. The system is distinguished by its use of a read-only root filesystem and a security-hardened kernel, which removes standard GNU utilities to reduce the attack surface. It ensures environment consistency by distributing the operating system as versioned, signed images and utilizes TPM-backed verified

This project is a comprehensive Linux server hardening guide and infrastructure documentation resource. It provides a set of validated security baselines and step-by-step instructions for implementing security controls and configuration best practices to protect production environments. The guide focuses on aligning systems with industry-standard security benchmarks, specifically those provided by the Center for Internet Security and Security Technical Implementation Guides. It includes a framework for using OpenSCAP to scan system configurations, verify compliance against reference profiles,

Kata Containers is an OCI container runtime that launches containers inside lightweight virtual machines to combine hardware-level isolation with container operational speed. It functions as a hardware-isolated container engine and lightweight VM hypervisor, providing a virtual machine monitor interface that abstracts multiple hypervisors to optimize for performance or specific hardware emulation. The project distinguishes itself through a confidential computing runtime that leverages hardware-backed trusted execution environments, such as Intel TDX and AMD SEV-SNP, to protect data in use. It

Simplewall is an application firewall manager and network traffic filter that provides a graphical interface for the Windows Filtering Platform. It controls inbound and outbound network access for individual programs and services by intercepting and filtering traffic at the kernel level. The project identifies specific binaries using file hashes to prevent spoofing and allows users to define custom firewall rules based on IP addresses, CIDR ranges, and port numbers. It includes a system for blocking operating system telemetry and managing blocklists of known malicious IP addresses. The tool

Firejail is a Linux application sandbox and kernel security wrapper that isolates untrusted applications from the host system. It uses kernel namespaces and seccomp filters to restrict filesystem access, drop kernel capabilities, and limit the system attack surface. The project is distinguished by its use of predefined security profiles to automatically apply filesystem restrictions and syscall limits based on the executable being launched. It provides specialized isolation for portable packages such as AppImages and implements X11 display isolation via proxy servers to prevent keyboard loggi

Nettacker este un framework de testare a penetrării automatizat, conceput pentru a orchestra recunoașterea, scanarea porturilor și detectarea vulnerabilităților. Acesta funcționează ca un instrument de recunoaștere a rețelei și scaner de vulnerabilități care identifică porturile deschise, amprentează serviciile și verifică sistemele împotriva bazelor de date cu defecte de securitate cunoscute. Framework-ul se distinge prin combinarea unui crawler de aplicații web pentru descoperirea căilor ascunse prin fuzzing cu un sistem de gestionare a vulnerabilităților care persistă rezultatele scanării într-o bază de date pentru a urmări evaluările istorice. Include, de asemenea, capabilități specializate pentru enumerarea subdomeniilor, brute forcing-ul credențialelor și capacitatea de a ruta traficul prin proxy-uri pentru anonimizare. Sistemul acoperă o suprafață largă de capabilități de securitate, inclusiv descoperirea activelor de rețea, auditarea serviciilor multi-protocol și auditarea configurațiilor. Suportă scanarea multi-țintă pe intervale IP și blocuri CIDR și oferă instrumente pentru generarea de rapoarte de securitate în formate multiple. Controlul programatic este disponibil printr-o interfață bazată pe REST, permițând integrarea framework-ului în pipeline-uri de securitate și fluxuri de automatizare.

w3af is a web penetration testing suite and security audit framework designed to identify and exploit vulnerabilities in web applications. It functions as a vulnerability scanner that crawls targets to find injection points and a fuzzer used to discover hidden endpoints and test input validation. The project distinguishes itself by providing an intercepting HTTP proxy for capturing and modifying traffic, combined with a knowledge-base driven exploitation system. It enables the execution of security exploits to gain remote shell access and supports post-exploitation activities, such as routing

Kanidm is a centralized identity management server designed to handle authentication, authorization, and directory services across distributed infrastructure. It provides a comprehensive framework for managing human and service accounts, utilizing a schema-driven database to store identity records, group memberships, and system attributes. The platform supports a wide range of authentication methods, including passkeys, passwords, and standard protocols like OAuth2, OIDC, LDAP, and RADIUS. The system distinguishes itself through a granular access control engine that enforces security policies

node-oidc-provider este un framework pentru construirea de servere de autorizare și furnizori de identitate OpenID Certified în medii Node.js. Oferă o suită cuprinzătoare de instrumente pentru gestionarea întregului ciclu de viață al serviciilor OAuth 2.0 și OpenID Connect, inclusiv autentificarea utilizatorilor, înregistrarea clienților și emiterea și validarea token-urilor de identitate și acces. Proiectul se distinge printr-o arhitectură extrem de modulară care permite dezvoltatorilor să integreze servicii de autentificare direct în stack-urile de aplicații web existente. Suportă personalizarea avansată printr-un pipeline de request bazat pe middleware, hook-uri de ciclu de viață bazate pe evenimente și o abordare bazată pe strategii pentru implementarea tipurilor de grant unice. Această flexibilitate se extinde la gestionarea datelor, unde un sistem de adaptoare pluggable permite utilizarea bazelor de date externe pentru persistența sesiunilor și a token-urilor. Dincolo de conformitatea cu protocolul de bază, framework-ul include capabilități extinse de securitate și operaționale. Suportă politici de autorizare fine-grained, gestionarea cheilor criptografice cu integrare de semnare externă și profiluri de securitate avansate pentru a proteja tranzacțiile sensibile. Sistemul oferă, de asemenea, observabilitate încorporată prin monitorizarea evenimentelor din ciclul de viață și descoperirea automată a metadatelor pentru a facilita interacțiunea programatică cu clienții externi.

Argus is a modular network reconnaissance framework designed for gathering network intelligence, mapping infrastructure, and assessing security postures through automated discovery tasks. It operates as a containerized security toolset that allows for the consistent execution of specialized information-gathering modules across different operating systems. The system functions as an infrastructure audit tool and a web application security scanner, performing tasks such as DNS lookups, port scanning, and the inspection of HTTP headers to detect vulnerabilities. It also serves as a threat intell