Octoscan
Octoscan is a static vulnerability scanner designed specifically for GitHub action workflows. It analyzes workflow files to identify potential security risks and misconfigurations. The tool offers various functionalities: 1. Downloading remote workflows from GitHub repositories for analysis. 2. Scanning local or downloaded workflows for vulnerabilities. 3. Implementing multiple security rules to detect issues such as dangerous checkouts, expression injections, and known vulnerabilities. 4. Providing options to customize scans, including enabling/disabling specific rules and filtering triggers. 5. Offering different output formats, including JSON, for easy integration into security pipelines. Octoscan helps security teams and developers identify and mitigate risks in their CI/CD pipelines, focusing on GitHub Actions-specific vulnerabilities and best practices.
FEATURES
ALTERNATIVES
An API security platform that combines discovery, compliance monitoring, and protection capabilities to defend against API attacks, automated threats, and data exposure.
ARM TrustZone provides a secure execution environment for applications on ARM processors.
A source code search engine for searching alphanumeric snippets, signatures, or keywords in web page HTML, JS, and CSS code.
A simple Swagger-ui scanner that detects old versions vulnerable to various XSS attacks
AWS Web Application Firewalls (WAFs) protect web applications and APIs from attacks, providing prebuilt security rules and the ability to create custom rules.
An automated code remediation tool that integrates with source control platforms to automatically fix security vulnerabilities in code through AI-driven analysis and one-click implementations.
Real-time, eBPF-based Security Observability and Runtime Enforcement component
A free book providing design and implementation guidelines for writing secure programs in various languages.
PINNED
InfoSecHired
An AI-powered career platform that automates the creation of cybersecurity job application materials and provides company-specific insights for job seekers.
Mandos Brief Newsletter
A weekly newsletter providing cybersecurity leadership insights, industry updates, and strategic guidance for security professionals advancing to management positions.
CTIChef.com Detection Feeds
A tiered cyber threat intelligence service providing detection rules from public repositories with varying levels of analysis, processing, and guidance for security teams.
ImmuniWeb® Discovery
ImmuniWeb Discovery is an attack surface management platform that continuously monitors an organization's external digital assets for security vulnerabilities, misconfigurations, and threats across domains, applications, cloud resources, and the dark web.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.