KICS
Keeping Infrastructure as Code Secure KICS stands for Keeping Infrastructure as Code Secure, it is open source and is a must-have for any cloud native project. Getting Started Setting up and using KICS is super-easy. First, see how to install and get KICS running. Then explore KICS output results format and quickly fix the issues detected. Interested in more advanced stuff? Deep dive into KICS queries. Understand how to integrate KICS in your favourite CI/CD pipelines. See KICS documentation for more details and topics. How it Works What makes KICS really powerful and popular is its built-in extensibility. This extensibility is achieved by: Fully customizable and adjustable heuristics rules, called queries. These can be easily edited, extended and added. Robust but yet simple architecture, which allows quick addition of support for new Infrastructure as Code solutions. Community You're welcome to
FEATURES
SIMILAR TOOLS
A local privilege escalation vulnerability in the Linux kernel known for its catchy name and potential damages.
A tool to run YARA rules against node_module folders to identify suspicious scripts
A collection of SQL injection cheat sheets for various databases
CSET is a free software tool for identifying vulnerabilities in enterprise and industrial control cyber systems.
Linux privilege escalation auditing tool for detecting security deficiencies in Linux kernels.
A utility for testing AWS Lambda functions for SQL Injection vulnerabilities using SQLMap attacks.
An open source project for static analysis of vulnerabilities in application containers
Fuzzapi is a Rails application with a user-friendly UI for API_Fuzzer gem and Docker setup.
PINNED
Mandos
Fractional CISO service that helps B2B companies implement security leadership to win enterprise deals, achieve compliance, and develop strategic security programs.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.