Whispers
Whispers is a static code analysis tool designed for parsing various common data formats in search of hardcoded credentials and dangerous functions. Whispers can run in the CLI or you can integrate it in your CI/CD pipeline. It detects Passwords, API tokens, AWS keys, Private keys, Hashed credentials, Authentication tokens, Dangerous functions, and Sensitive files. Whispers supports formats like YAML, JSON, XML, .npmrc, .pypirc, .htpasswd, .properties, pip.conf, conf/ini, Dockerfile, Dockercfg, Shell scripts, Python3, JavaScript, Java, Go, PHP, AWS credentials files, JDBC connection strings, Jenkins config files, SpringFramework Beans config files, Java Properties files, Dockercfg private registry auth files, and Github tokens. Python3 files are parsed as ASTs because of native language support. Whispers is intended to be a structured text parser, not a code parser.
FEATURES
EXPLORE BY TAGS
SIMILAR TOOLS
Security design review automation tool that scans design documents and provides security requirements to development teams during the planning phase.
A web application security testing platform that helps you test your knowledge on web application security through realistic scenarios with known vulnerabilities.
DECAF++ is a fast whole-system dynamic taint analysis framework with improved performance and elasticity.
A free online tool that scans and fixes common security issues in WordPress websites.
Cutting-edge technology for developing security applications within the Linux kernel.
Instrumentation-based approach for resolving reflective calls in Android apps.
A tool to conduct preliminary security checks in code, infrastructure, or IAM configurations using various open-source tools.
PINNED
Mandos
Fractional CISO service that helps B2B companies implement security leadership to win enterprise deals, achieve compliance, and develop strategic security programs.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.