AppThreat

dep-scan

OWASP dep-scan is an open-source security audit based on known vulnerabilities and advisories for project dependencies. Supports both local repos and container images. Integrates with various CI environments such as Azure Pipelines, CircleCI, and Google CloudBuild. No server is required!

sast-scan

Fully open-source SAST scanner supporting a range of languages and frameworks. Integrates with major CI pipelines and IDE such as Azure DevOps, Google CloudBuild, VS Code and Visual Studio. No server required!

vulnerability-db

Vulnerability database and package search for sources such as Linux, OSV, NVD, GitHub and npm. Powered by sqlite, CVE 5.0, purl, and vers.

atom

Atom is a novel intermediate representation for applications and a standalone tool that is powered by chen.

blint

BLint is a Binary Linter to check the security properties, and capabilities in your executables. It is powered by lief.

joern-lib

Python library for code analysis with CPG and Joern

dep-scan-action

Fully open-source security audit for project dependencies based on known vulnerabilities and advisories. No server required!

vuln-list

Linux upstream vulnerabilities data suitable for dep-scan

cpggen

Generate CPG for multiple languages for code and threat analysis

threat-db

A graph database for components, vulnerabilities and threats powered by dgraph

hub_scan

Scan reports for popular docker hub and gcr images

docs

Docs that are published at https://appthreat.io

blint-action

Action to run BLint, the binary linter.

cve-annotations

UNUSED: Community powered annotations for CVE to identify source, sink, exploits and other information.

depscan-bin

Binary builds for dep-scan - The Dependency Scanner

rosa

An experiment that looks very promising so far.

scan-reports

Library for producing gorgeous html reports from AppThreat scan results. Compatible with SARIF and grafeas format.

vulpy

Vulnerable Python Application To Learn Secure Development

.github

annotator

charts

Helm charts for cloudsec apps

cpggen-action

Generate CPG for multiple languages for use with joern

ide

An IDE with AppThreat scanners built-in. Secure coding is here.

joern11

Joern v1.1.1742 with backported fixes from 1.2.x. Use temporarily before a full upgrade to 1.2.x

joern2

Experimental joern.

scan-base

Base docker image for scanners

shst

vdb

Precompiled AppThreat vulnerability database for dep-scan

vuln-list-update

Collects vulnerability data from a range of sources.

WebGoat

WebGoat 8.0