Open source appsec projects
Every project in the registry tagged appsec, ranked by real GitHub adoption.
Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabi
SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.
Next generation web scanner
Open Source Vulnerability Management Platform
AI-powered bug bounty hunting toolkit that works with or without subscription.
Open-Source Unified Vulnerability Management, DevSecOps & ASPM
Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS b
safely install npm packages by auditing them pre-install stage
Open-source AI pentester that proves every finding. Machine oracles re-run each exploit; verified bugs ship a proof capsule you can replay yourself.
OWASP Mutillidae II is a free, open-source, deliberately vulnerable web application providing a target for web-security training. This is an easy-to-use web hac
Fast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix, JSON output,
A free, open-source alternative to Burp Suite: an intercepting proxy and web app security testing suite with Repeater, Intruder, Collaborator and a built-in OWA
Open Source Static Scanning tool to detect data flows in your code, find data security vulnerabilities & generate accurate Play Store Data Safety Report.
Related tags
Frequently asked questions
How many open source appsec projects are there?
This registry tracks 13 projects tagged appsec, with 108,614 GitHub stars between them. The most-adopted is shannon at 50,872 stars.
Are these appsec projects free to use?
Yes — 13 of the 13 carry an explicit open-source licence across 7 distinct licences, so there is no licence fee. Where a project also sells a hosted or enterprise version, the self-hosted path remains free.
Which appsec project should I choose?
The list above is ranked by GitHub stars, but stars measure attention rather than fit. Check three things on each card: the licence (permissive versus copyleft), the language it is written in, and the last-push date — a high-star project that has not been pushed in a year is a liability.
Are these appsec projects still maintained?
12 of the 13 were pushed in the last 90 days, and every card shows its exact last-push date so you can see the rest. Sort your shortlist by that date before committing to a migration.