Awesome GitHub RepositoriesAccess Rules

File Browser is a self-hosted application that provides a web-based interface for managing files and directories on a server. It functions as a virtual file system abstraction, allowing users to browse, organize, and edit text-based files directly within their browser without requiring local access to the server. The platform distinguishes itself through a comprehensive command-line interface that enables full administrative control over system configurations, user accounts, and automation hooks. It supports a flexible, event-driven architecture where custom shell scripts can be triggered aut

OpenZeppelin Contracts is a library of modular, secure, and reusable smart contract components designed for the development of decentralized applications. It provides a foundational framework for building standard-compliant contracts, offering battle-tested implementations for token standards, access control, and common utility patterns. The project distinguishes itself through its comprehensive support for complex architectural patterns, including proxy-based upgradeability, role-based access control, and account abstraction. It enables developers to implement modular logic injection via hoo

NetBird is a zero-trust networking platform that builds secure, encrypted peer-to-peer overlay networks using the WireGuard protocol. It functions as a software-defined perimeter, connecting distributed infrastructure across cloud environments and physical locations while hiding network resources from the public internet. By integrating with external identity providers, the platform enforces granular access control and identity-based segmentation for every user and device. The platform distinguishes itself through extensive automation and programmatic management capabilities. It provides a ce

Wagtail is an open-source content management system built on the Django web framework. It provides a structured, tree-based approach to content modeling, allowing developers to define custom page types and reusable content components that are managed through a highly customizable administrative interface. The platform distinguishes itself through its flexible, block-based content composition system, which enables editors to assemble complex page layouts dynamically. It also offers robust support for multi-site and multi-lingual environments, allowing organizations to manage distinct websites

Sandboxie is an operating system-level virtualization tool designed to run Windows applications in isolated, secure environments. By intercepting system calls and redirecting file system and registry modifications to a separate, discardable storage area, it prevents untrusted software from making permanent changes to the host system. This containment ensures that browser history, temporary files, and potential malware remain trapped within the sandbox, protecting the integrity and privacy of the underlying host. The software distinguishes itself through granular control over the isolation env

Nebula is a scalable, decentralized overlay networking tool designed to create secure, encrypted peer-to-peer connections between distributed hosts. By utilizing a certificate-based identity authority, it enables the construction of private communication fabrics across disparate physical infrastructures, such as multiple cloud providers or on-premises data centers, without requiring central authentication servers. The project distinguishes itself through a zero-trust architecture that enforces granular, policy-driven firewall filtering based on certificate-derived group memberships. It facili

LibSQL is a high-performance, distributed SQL database engine that extends SQLite to support remote network access, edge computing, and real-time synchronization. It functions as an embedded database library that integrates directly into application processes while providing the infrastructure to maintain consistency across multiple geographic regions. The platform distinguishes itself by enabling database interaction over standard HTTP protocols, allowing applications to query remote data sources in serverless and edge environments without requiring local filesystem access. It includes nativ

CrowdSec is a collaborative, distributed security engine designed for threat detection and infrastructure protection. It functions as an intrusion detection system that parses logs and network traffic to identify malicious patterns, utilizing a bucket-based threshold detection model to aggregate events and trigger alerts. The platform is built on a modular architecture that includes a centralized local API server for managing security signals and a relational database for persistent storage of remediation decisions. What distinguishes the project is its decoupled enforcement model, which offl

This project is a version control documentation tool designed to automate the generation of release notes and changelogs. It functions as a pipeline-based engine that parses repository history, categorizes commits, and transforms them into structured documentation. By leveraging conventional commit patterns or custom regular expressions, it provides a consistent method for tracking project evolution and managing semantic versioning. What distinguishes this tool is its highly flexible template-driven architecture, which allows for deep customization of output formatting, grouping, and sorting.

This repository provides a collection of interactive sample applications and reference implementations for the Electron framework. It serves as a library of API reference demos designed to help developers learn how to implement core desktop features. The project features visual demonstrations of cross-platform GUI management and practical examples of native operating system integration. It includes dedicated samples for handling native modules, crash reports, and the configuration of security implementations such as content security policies and process sandboxing. The codebase covers a broa

Firezone is a zero trust network access platform that uses WireGuard to provide identity-based connectivity to internal network resources. It functions as a virtual private network that synchronizes authentication and user groups via OpenID Connect providers. The system implements a group-based access control engine to enforce least privilege by restricting network resources to specific user groups. It utilizes holepunching and relay protocols for NAT traversal to establish encrypted tunnels through firewalls without requiring inbound ports. The platform includes a control plane for managing

This project is an Android RPA framework designed for automating user interfaces and system tasks on rooted Android devices using Python and ADB. It provides a suite of tools for rooted device management, allowing for programmatic control of system settings, application lifecycles, and shell command execution via a remote API. The framework distinguishes itself through a combination of dynamic instrumentation and AI integration. It can inject scripts into running processes to hook Java interfaces and modifies application behavior in real time. Additionally, it supports large language model in

This PHP routing library is an HTTP request router and matcher designed to map incoming URL paths to specific controller actions using defined patterns and configuration. It serves as a programmatic interface for defining, loading, and resolving URL patterns, while providing a URL generator to produce absolute or relative URIs from route names and parameters. The system supports diverse route loading through YAML, XML, PHP arrays, and class attributes, utilizing compiled route matching to optimize performance. It enables sophisticated request handling through regex-based path matching, sub-do

CASL is a JavaScript authorization library for defining and enforcing declarative access control rules across both frontend and backend environments. It provides an attribute-based access control system that manages permissions based on user roles and specific object properties. The library is designed for isomorphic access control, allowing a consistent set of permission rules to be shared between a server API and a client interface. It enables the serialization of permission sets as plain data objects to maintain synchronization across these different layers. Its capabilities include trans

Symfony Translation is a PHP library and framework component for internationalizing applications. It provides a complete system for managing message catalogs, handling locale-aware string translation, and formatting messages using ICU MessageFormat syntax to support pluralization, gender, and conditional selection. The component organizes translatable strings into named domains, supports key-based lookup that decouples source text from localized versions, and offers deferred rendering through translatable objects that store parameters and render only when output is needed. The library disting

FileBrowser is an open-source, self-hosted file management interface that runs as a single binary with no external dependencies. It provides a web-based interface for browsing, uploading, editing, and sharing files on a remote server, with a core architecture built on JWT-based stateless authentication and a rule-based path permission engine that controls access at the directory level. The project distinguishes itself through a comprehensive access control system that supports multi-provider authentication including OIDC, LDAP, external JWT, and two-factor authentication, alongside granular p

Entrust 是一个用于 Laravel 框架的基于角色的访问控制（RBAC）库，也是一个通用的 PHP 权限管理系统。它提供了一个后端工具，用于将用户与特定角色和权限关联，从而评估授权规则。 该系统的独特之处在于其逻辑引擎，能够进行复杂的访问规则评估，包括布尔逻辑和基于通配符的权限匹配。这允许基于模式匹配或特定要求（例如用户必须满足一组指定权限中的全部或任意一项）进行授权检查。 该库涵盖了通过中间件实现的路由访问限制，以及基于用户授权显示或隐藏界面元素的条件 UI 可见性控制。它还包括用于角色和权限分配的实用工具，以及通过数据库集成实现的角色化用户过滤功能。

KServe is an open platform for deploying and serving generative and predictive AI models on Kubernetes. It defines inference services as custom resources with declarative YAML specifications, enabling a Kubernetes-native approach to model deployment and lifecycle management. The platform leverages Knative-based serverless scaling for automatic scale-to-zero and revision management, and supports a pluggable serving runtime architecture that maps model formats to containerized execution environments. KServe distinguishes itself through model-aware autoscaling that scales replicas based on token

Kanidm is a centralized identity management server designed to handle authentication, authorization, and directory services across distributed infrastructure. It provides a comprehensive framework for managing human and service accounts, utilizing a schema-driven database to store identity records, group memberships, and system attributes. The platform supports a wide range of authentication methods, including passkeys, passwords, and standard protocols like OAuth2, OIDC, LDAP, and RADIUS. The system distinguishes itself through a granular access control engine that enforces security policies

Cerbos is an open-source authorization service that provides a centralized, language-agnostic engine for managing access control. It functions as a policy-as-code platform, allowing teams to define, test, and distribute authorization rules using declarative YAML or JSON configurations. By decoupling access logic from application code, it enables consistent permission enforcement across diverse service stacks. The project distinguishes itself through its ability to translate high-level authorization policies into native database query filters. This capability allows applications to enforce sec