cdxgen/cdxgen 💎 hidden gem
Writes a standard list of every package inside a project or a container image, in both of the common formats.
anchore/syft
Lists every package inside a container image or a folder as a standard bill of materials, in SPDX or CycloneDX, and changes nothing.
AdguardTeam/AdGuardHome
A home DNS server that refuses to answer for advertising and tracking addresses, with encrypted DNS built in.
Yelp/detect-secrets
Lists the passwords and keys that were typed into code by mistake, and records the known ones in a baseline so only new findings are reported.
pi-hole/pi-hole
Blocks advertising and tracking for every device on a network by refusing to look up those addresses.
anchore/grype
Lists published security holes found in a container image, a folder, or a parts list of software.
ory/polis
Translates a company's own single sign-on into the ordinary modern login your application already understands.
GitGuardian/ggshield 💎 hidden gem
Detects more than 500 kinds of hardcoded secret, as a pre-commit hook, a CI action or a command.
trufflesecurity/trufflehog
Finds passwords and keys in a code history, container images and storage buckets, and then checks which of them still work.
lldap/lldap
A deliberately simplified LDAP authentication server with a web page for users and groups, so several self-hosted programs can share one account list.
Luzifer/ots 💎 hidden gem
A one-time secret page: the text is encrypted in the browser with 256-bit AES and destroyed the first time it is read.
authelia/authelia
A single sign-in page with a second factor, placed in front of every private web service behind a reverse proxy.
Forceu/Gokapi 💎 hidden gem
A self-hosted page for sending files, where each link expires after a set number of downloads or days and only the owner can upload.
crowdsecurity/crowdsec
It reads a server's own log files, decides who is attacking, blocks them, and shares what it found with everyone else running it.
garethgeorge/backrest
A web screen that schedules restic backups, applies retention rules and restores single files by browsing a snapshot.
dani-garcia/vaultwarden
A password server that the official Bitwarden apps connect to, small enough to run on the cheapest machine you can rent.
gitleaks/gitleaks
It searches a Git repository, including its whole history, for passwords and keys that were committed by mistake.
TecharoHQ/anubis
It makes a visiting browser do a small piece of work before a page is served, which most scrapers will not pay for.
zizmorcore/zizmor
It reads the GitHub Actions files in your project and reports the security mistakes in them, without running or changing anything.
getsops/sops
Encrypts the values inside a YAML, JSON, ENV or INI file while leaving the names readable, so the file can live in your code history.
kanidm/kanidm
One identity server with its own embedded storage, speaking OAuth2, OpenID Connect and LDAP, with passkeys as the normal way in.
rustic-rs/rustic
It makes encrypted backups that only store each piece of a file once, in restic's own repository format.
FiloSottile/age
Locks one file with a single command using short text keys, and unlocks it with another, with no key ring and almost no options.
pgbackrest/pgbackrest
Point-in-time backup and restore for PostgreSQL, which a file-level snapshot cannot give you.
pocket-id/pocket-id
A small OIDC identity provider that signs people in with passkeys and nothing else.
mongodb/kingfisher 💎 hidden gem
Finds keys left in your code, then checks with the provider which of them still work.
warp-tech/warpgate
A guarded front door for a server, with two-factor sign-in and a recording of every session.
logto-io/logto
Identity service with social sign-in — because 'choose a password' is the most expensive field on the internet.
orestbida/cookieconsent
Vanilla-JS GDPR consent with real script blocking — the banner that becomes necessary the day analytics goes live.
altcha-org/altcha 💎 hidden gem
The invisible little box in front of every form, and Google is not reading the room.
data-privacy-stack/presidio
Detects and masks names, emails, phone and card numbers in text before anything is sent to a model.
No repository in this area carries every tag you picked.
Get the next edition in your inbox
A dozen repositories, opened and checked. The licence read, the last release dated, and the ones that did not make it named with the reason. It is the half most lists leave out.
No tracking pixels. One click to leave. The archive stays free either way.
We use your address to send the edition and nothing else. Confirm by email, leave in one click. How we handle it.