# Security: what’s taking off on GitHub

Magnitude (0–10) measures how fast and how unusually interest in a repository is growing right now. It is not a quality score. Days are UTC. “So far today” is a fact; “expected by the end of the day” is a forecast.

Data as of 2026-10-30 11:02 UTC, updated every 30 minutes.

1. **qybaihe/bla** — 8.0 · Early signal · Security · TypeScript · +400 stars measured 2026-10-30, 00:15–10:48 UTC, ≈ 855 by evening
   BLA (Blind LLM Agents) is a defensive tool that poisons release artifacts (binaries, Electron/ASAR, JS bundles, Python, WASM, models, SQLite) so AI reverse-engineering agents hit resource budgets, follow decoys, and burn tokens while…
   Full card: https://gitnova.dev/en/r/qybaihe/bla.md
2. **interplains/Zero-Breach-Toolkit** — 6.5 · Peaking · Security · Python · +127 stars measured 2026-10-30, 00:15–10:48 UTC, ≈ 405 by evening
   Free offline scanner for traces of known mercenary spyware (Pegasus, Predator, Graphite, Candiru) on Windows computers, Android phones and iPhone backups. Read-only, makes no network requests, and states the limits of every check.
   Full card: https://gitnova.dev/en/r/interplains/Zero-Breach-Toolkit.md
3. **MarkBlah/smsofdeath** — 6.2 · Early signal · Security · Java · +75 stars measured 2026-10-30, 00:16–10:48 UTC, ≈ 184 by evening
   Proof-of-concept Android app that sends a crafted 8-byte WAP Push PDU via SMS to crash com.android.phone on the target handset, dropping active calls without user interaction.
   Full card: https://gitnova.dev/en/r/MarkBlah/smsofdeath.md
4. **KeygraphHQ/shannon** — 5.9 · Breakout · Security · TypeScript · +96 stars measured 2026-10-30, 00:16–10:49 UTC, ≈ 218 by evening
   Autonomous AI pentester for web applications and APIs: analyzes source code, finds attack vectors, and runs real exploits, reporting only vulnerabilities with a working proof-of-concept.
   Full card: https://gitnova.dev/en/r/KeygraphHQ/shannon.md
5. **soimy/c3rb3r-rescue** — 5.8 · Early signal · Security · Python · +43 stars measured 2026-10-30, 05:51–10:49 UTC, ≈ 110 by evening
   Evidence-based recovery toolkit for C3RB3R/.L0CK3D ransomware on Synology DSM NAS: preserve the scene, capture RAM to extract session keys, decrypt file copies, and validate results. Aimed at admins and AI assistants handling a live…
   Full card: https://gitnova.dev/en/r/soimy/c3rb3r-rescue.md
6. **johncassil/dontallow** — 5.6 · Early signal · Security · Swift · +35 stars measured 2026-10-30, 00:16–10:49 UTC, ≈ 71 by evening
   A macOS utility that automatically presses "Don't Allow" on the system prompt asking whether an app may find devices on local networks. Runs as a launchd agent via Accessibility, uses zero CPU while idle, and survives reboots.
   Full card: https://gitnova.dev/en/r/johncassil/dontallow.md
7. **YuJunZhiXue/dsh-purge** — 5.4 · Peaking · Security · JavaScript · +483 stars measured 2026-10-30, 00:16–10:49 UTC, ≈ 1,000 by evening
   A local DeepSeek Harness plugin that reversibly patches installed @deepseek-ai packages to strip built-in refusals and swap prompts per model. Intended for red-team research and robustness evaluation in an authorized local environment.
   Full card: https://gitnova.dev/en/r/YuJunZhiXue/dsh-purge.md
8. **jmanico/grim-prompter** — 5.3 · Early signal · Security · +41 stars measured 2026-10-30, 00:16–10:49 UTC, ≈ 90 by evening
   A prompt library and runbook that turns Claude Code, Codex or any coding agent into a threat-modeling assistant for your repository, with 36 architecture workflows and 29 analysis methods. Findings are traced to file-and-line evidence.
   Full card: https://gitnova.dev/en/r/jmanico/grim-prompter.md
9. **crystalmasta/unbihex** — 5.1 · Early signal · Security · Rust · +23 stars measured 2026-10-30, 00:16–10:49 UTC, ≈ 68 by evening
   VPN client with its own Rust networking core, compatible with Xray servers (VLESS, REALITY, XTLS Vision, XHTTP, Shadowsocks, SOCKS5) and available for Windows, Linux, macOS, Android and iOS.
   Full card: https://gitnova.dev/en/r/crystalmasta/unbihex.md
10. **cloudflare/security-audit-skill** — 4.6 · Steady · Security · JavaScript · +494 stars measured 2026-10-30, 00:16–10:49 UTC, ≈ 1,103 by evening
   A coding-agent skill that turns the agent into a security auditor, running a multi-phase code audit with independently verified, machine-readable findings.
   Full card: https://gitnova.dev/en/r/cloudflare/security-audit-skill.md
11. **hevnsnt/CVEngine** — 4.3 · Early signal · Security · Python · +36 stars measured 2026-10-30, 00:17–10:49 UTC, ≈ 73 by evening
   Self-hosted external attack surface assessment platform: discovers internet-facing assets, fingerprints services and versions, matches live CVEs, and validates findings with safe read-only checks.
   Full card: https://gitnova.dev/en/r/hevnsnt/CVEngine.md
12. **infosave2007/aivpn** — 4.2 · Early signal · Security · Rust · Not enough measurements today
   Experimental Rust VPN that encrypts traffic over a UDP tunnel and masks it with profile-based packet shaping to resist deep packet inspection.
   Full card: https://gitnova.dev/en/r/infosave2007/aivpn.md
13. **NVIDIA/SkillSpector** — 4.1 · Peaking · Security · Python · +92 stars measured 2026-10-30, 00:16–10:50 UTC, ≈ 213 by evening
   Security scanner for AI agent skills: detects vulnerabilities, malicious patterns, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before installation.
   Full card: https://gitnova.dev/en/r/NVIDIA/SkillSpector.md
14. **lalalune/pumpfun-source** — 4.1 · Early signal · Security · Python · +13 stars measured 2026-10-30, 00:17–10:50 UTC, ≈ 30 by evening
   Research project reconstructing the source of Pump.fun Solana programs: collects byte-exact deployment evidence and tooling to compare rebuilt artifacts against the original. Reconstruction is incomplete.
   Full card: https://gitnova.dev/en/r/lalalune/pumpfun-source.md
15. **DrWhax/unfairplay** — 3.9 · Cooling · Security · Go · +22 stars measured 2026-10-30, 00:16–10:50 UTC, ≈ 48 by evening
   A Go utility that recovers a FairPlay model from an enrolled Mac and uses it to decrypt personalized iOS IPAs. It does not sign in to Apple or download apps — it only decrypts IPAs you already have.
   Full card: https://gitnova.dev/en/r/DrWhax/unfairplay.md
16. **NationalSecurityAgency/ghidra** — 3.8 · Steady · Security · Java · +146 stars measured 2026-10-30, 00:17–10:50 UTC, ≈ 329 by evening
   A software reverse engineering framework from the NSA: disassembly, decompilation, graphing and scripting for analyzing compiled code on Windows, macOS and Linux.
   Full card: https://gitnova.dev/en/r/NationalSecurityAgency/ghidra.md
17. **AhmadHassan-BTed/Turnitout-Humanizer** — 3.7 · Steady · Security · HTML · +274 stars measured 2026-10-30, 00:17–10:50 UTC, ≈ 614 by evening
   A tool for removing AI and plagiarism traces from text, LaTeX, DOCX and source code: it strips invisible Unicode characters, C2PA metadata and watermarks to evade detectors like Turnitin and GPTZero without using LLMs.
   Full card: https://gitnova.dev/en/r/AhmadHassan-BTed/Turnitout-Humanizer.md
18. **guillaumemeyer/watermarks-remover** — 3.7 · Steady · Security · Python · +62 stars measured 2026-10-30, 00:16–10:50 UTC, ≈ 141 by evening
   A Python service and agent skill that strips AI provenance marks (invisible Unicode, statistical watermarks, C2PA/EXIF/XMP metadata) from text and files you own.
   Full card: https://gitnova.dev/en/r/guillaumemeyer/watermarks-remover.md
19. **beenuar/AiSOC** — 3.7 · Peaking · Security · Python · +79 stars measured 2026-10-30, 00:16–10:50 UTC, ≈ 200 by evening
   A self-hostable AI Security Operations Center: ingests telemetry, correlates alerts, investigates incidents with an LLM agent whose every step is auditable, and proposes human-approved actions.
   Full card: https://gitnova.dev/en/r/beenuar/AiSOC.md
20. **usestrix/strix** — 3.4 · Steady · Security · Python · +78 stars measured 2026-10-30, 00:17–10:51 UTC, ≈ 176 by evening
   Open-source AI pentesting tool: autonomous agents run your code, find vulnerabilities, and validate them with working PoCs. For developers and security teams needing fast testing without manual pentests or static-analysis false positives.
   Full card: https://gitnova.dev/en/r/usestrix/strix.md
21. **janderson1017/Hiddify-Manager** — 3.4 · Breakout · Security · Python · +0 stars measured 2026-10-30, 00:17–10:51 UTC, ≈ 32 by evening
   Multi-user anti-censorship panel with effortless installation, supporting over 20 protocols (Reality, Telegram proxy, etc.) and user management.
   Full card: https://gitnova.dev/en/r/janderson1017/Hiddify-Manager.md
22. **sanjayadanushka712/Ghost-Night** — 3.2 · Early signal · Security · Python · +3 stars measured 2026-10-30, 00:17–10:51 UTC, ≈ 16 by evening
   Local-only CLI toolkit for authorized pentesting: rotates IPs via Tor/obfs4/proxies and coherent browser fingerprints to test tracking, rate-limiting, and bans on web apps.
   Full card: https://gitnova.dev/en/r/sanjayadanushka712/Ghost-Night.md
23. **trhhubsd/ARTEX** — 3.2 · Steady · Security · Go · +51 stars measured 2026-10-30, 00:18–10:51 UTC, ≈ 107 by evening
   AI autonomous penetration testing system with a Go backend and Next.js frontend: agents explore assets, find vulnerabilities and re-test them. Supports asset sync from ScopeSentry, traffic recording, MCP and human-in-the-loop approvals.
   Full card: https://gitnova.dev/en/r/trhhubsd/ARTEX.md
24. **SnailSploit/Claude-Red** — 3.1 · Steady · Security · Python · +47 stars measured 2026-10-30, 00:18–10:51 UTC, ≈ 106 by evening
   A curated library of drop-in SKILL.md files for the Claude Skills system that primes Claude with offensive security methodology, from SQL injection to EDR evasion and exploit development.
   Full card: https://gitnova.dev/en/r/SnailSploit/Claude-Red.md
25. **YOURSJEYO/claude-switcher** — 3.1 · Steady · Security · PowerShell · +66 stars measured 2026-10-30, 00:18–10:51 UTC, ≈ 130 by evening
   Fail-closed account environment manager for Claude that runs 11 fingerprint checks before launch, performs STUN-based WebRTC leak detection, kill-switch on tunnel loss, and multi-account snapshot isolation to prevent real IP exposure.
   Full card: https://gitnova.dev/en/r/YOURSJEYO/claude-switcher.md
26. **interplains/zero-breach** — 3.0 · Steady · Security · Python · +19 stars measured 2026-10-30, 00:17–10:51 UTC, ≈ 56 by evening
   A local, read-only Python scanner that looks for traces of the AdFection / Candiru spyware campaign on a machine: browser history and cookies, caches, autostart entries, file hashes and the DNS resolver cache. No admin rights, no…
   Full card: https://gitnova.dev/en/r/interplains/zero-breach.md
27. **vaishantsah/watson-AI-osint-all-in-one** — 3.0 · Early signal · Security · TypeScript · +7 stars measured 2026-10-30, 00:16–10:51 UTC, ≈ 14 by evening
   Free OSINT tool for Windows that searches profiles and mentions of a person by nickname, email, phone or website across 3,100+ public sources. No account or API keys required, results can be saved as PDF.
   Full card: https://gitnova.dev/en/r/vaishantsah/watson-AI-osint-all-in-one.md
28. **Cd1s/safarier** — 2.9 · Early signal · Security · Swift · +3 stars measured 2026-10-30, 00:16–10:51 UTC, ≈ 13 by evening
   Native macOS browser built on WebKit with isolated profiles, built-in sing-box proxy routing, and engine-level privacy protection. Lets you run dozens of independent accounts side by side while appearing as genuine Safari.
   Full card: https://gitnova.dev/en/r/Cd1s/safarier.md
29. **AdguardTeam/AdGuardHome** — 2.9 · Breakout · Security · TypeScript · Not enough measurements today
   Self-hosted DNS server that blocks ads and trackers across all devices on a network by sinkholing tracking domains, with a web admin interface and support for encrypted DNS.
   Full card: https://gitnova.dev/en/r/AdguardTeam/AdGuardHome.md
30. **reacher-z/Awesome-REA** — 2.9 · Peaking · Security · Python · +28 stars measured 2026-10-30, 00:18–10:51 UTC, ≈ 60 by evening
   An independent curated collection of reverse-engineering tools, case studies and research papers covering websites, games, apps, native binaries, firmware and protocols. It indexes 3,300+ resources and organizes them by target and task.
   Full card: https://gitnova.dev/en/r/reacher-z/Awesome-REA.md
31. **mmparko/dsh-purge** — 2.8 · Cooling · Security · JavaScript · +41 stars measured 2026-10-30, 00:18–10:53 UTC, ≈ 84 by evening
   A red-team plugin for the official DeepSeek Harness: patches host policies and prompts on a local install to separate host-layer blocks from model refusals.
   Full card: https://gitnova.dev/en/r/mmparko/dsh-purge.md
32. **KillaBoi/StealMyBitcoin-PoC** — 2.8 · Cooling · Security · Python · +5 stars measured 2026-10-30, 00:17–10:52 UTC, ≈ 14 by evening
   A single-file Python proof of concept reproducing a PHP 8.4.26 memory-exhaustion exploit chain: leaks heap and code addresses via session cookies, then forges a HashTable to reach zif_system and run a command.
   Full card: https://gitnova.dev/en/r/KillaBoi/StealMyBitcoin-PoC.md
33. **smicallef/spiderfoot** — 2.8 · Steady · Security · Python · +17 stars measured 2026-10-30, 00:17–10:52 UTC, ≈ 42 by evening
   Python OSINT automation tool that gathers data about a target from 200+ modules (DNS, breaches, social media, threat intel) via web UI or CLI. Used for reconnaissance in pentests and for assessing your own attack surface.
   Full card: https://gitnova.dev/en/r/smicallef/spiderfoot.md
34. **openssl/openssl** — 2.6 · Steady · Security · C · +11 stars measured 2026-10-30, 00:20–10:53 UTC, ≈ 23 by evening
   OpenSSL is a general-purpose cryptography library and implementation of TLS, DTLS and QUIC protocols, including libssl, libcrypto and a command-line tool. It is used for encryption, certificate handling and secure network connections.
   Full card: https://gitnova.dev/en/r/openssl/openssl.md
35. **jiwoochris/artex-global** — 2.6 · Steady · Security · Go · +25 stars measured 2026-10-30, 00:19–10:53 UTC, ≈ 46 by evening
   Korean-localized edition of ARTEX, an autonomous penetration-testing framework driven by multi-agent LLMs (Go backend + Next.js) that plans and executes attack steps on its own. Aimed at security practitioners studying and defending…
   Full card: https://gitnova.dev/en/r/jiwoochris/artex-global.md
36. **anthropics/sandbox-runtime** — 2.6 · Cooling · Security · TypeScript · +14 stars measured 2026-10-30, 00:18–10:53 UTC, ≈ 32 by evening
   A lightweight sandboxing tool that enforces filesystem, network and Unix socket restrictions on arbitrary processes at the OS level without containers, using sandbox-exec, bubblewrap and proxies.
   Full card: https://gitnova.dev/en/r/anthropics/sandbox-runtime.md
37. **projectdiscovery/nuclei** — 2.6 · Steady · Security · Go · +14 stars measured 2026-10-30, 00:19–10:53 UTC, ≈ 32 by evening
   A vulnerability scanner driven by YAML templates that checks applications, APIs, networks, DNS and cloud configurations for known vulnerabilities. Community-contributed templates mimic real-world exploitation steps to reduce false…
   Full card: https://gitnova.dev/en/r/projectdiscovery/nuclei.md
38. **EthanArbuckle/fairplay-decrypt** — 2.5 · Cooling · Security · C · +13 stars measured 2026-10-30, 00:19–10:53 UTC, ≈ 29 by evening
   Tool for offline decryption of FairPlay-protected App Store IPAs: retrieves a 16-byte credential from a jailbroken device and decrypts arm64 Mach-O pages. Runs on macOS and Linux.
   Full card: https://gitnova.dev/en/r/EthanArbuckle/fairplay-decrypt.md
39. **keepassxreboot/keepassxc** — 2.4 · Steady · Security · C++ · +10 stars measured 2026-10-30, 00:19–10:53 UTC, ≈ 24 by evening
   Cross-platform offline password manager with KDBX-encrypted databases, password generator, TOTP, YubiKey support, and browser integration.
   Full card: https://gitnova.dev/en/r/keepassxreboot/keepassxc.md
40. **mitmproxy/mitmproxy** — 2.4 · Cooling · Security · Python · +11 stars measured 2026-10-30, 00:19–10:53 UTC, ≈ 26 by evening
   An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers. It lets you inspect, modify, and debug HTTP/1, HTTP/2, and WebSocket traffic via console, CLI, or web interface.
   Full card: https://gitnova.dev/en/r/mitmproxy/mitmproxy.md
41. **gitleaks/gitleaks** — 2.4 · Steady · Security · Go · +15 stars measured 2026-10-30, 00:19–10:54 UTC, ≈ 38 by evening
   Gitleaks is a Go tool that detects hardcoded secrets like passwords, API keys, and tokens in git repos, files, directories, and stdin. It is aimed at developers and DevSecOps engineers to prevent credential leaks via commits.
   Full card: https://gitnova.dev/en/r/gitleaks/gitleaks.md
42. **chaitin/SafeLine** — 2.4 · Peaking · Security · Go · +23 stars measured 2026-10-30, 00:20–10:54 UTC, ≈ 44 by evening
   SafeLine is a self-hosted Web Application Firewall (WAF) and reverse proxy written in Go. It filters and monitors HTTP/HTTPS traffic to protect web apps from SQL injection, XSS, RCE, SSRF, bot abuse, and other attacks.
   Full card: https://gitnova.dev/en/r/chaitin/SafeLine.md
43. **liseami/CCBaga** — 2.3 · Steady · Security · Rust · +20 stars measured 2026-10-30, 00:19–10:54 UTC, ≈ 43 by evening
   A native macOS toolkit that cleans up local Claude data, rotates a companion browser's fingerprint, applies region-based system settings, and verifies browser readings against the real network exit.
   Full card: https://gitnova.dev/en/r/liseami/CCBaga.md
44. **aixisstudio/Snitch** — 2.3 · Steady · Security · Python · +7 stars measured 2026-10-30, 00:19–10:54 UTC, ≈ 16 by evening
   A local real-time network traffic visualizer that shows who your computer connects to, where they are, and which app is responsible. Runs offline; data never leaves the machine.
   Full card: https://gitnova.dev/en/r/aixisstudio/Snitch.md
45. **angusdevgo/Seep-Reverse-Lab** — 2.3 · Steady · Security · Lua · +11 stars measured 2026-10-30, 00:20–10:54 UTC, ≈ 23 by evening
   Agent-native reverse engineering workbench for binaries and CWE-602 client-side authorization auditing: unifies Radare2, JADX, Apktool, Frida and IDA via 23 MCP tools with automatic task routing.
   Full card: https://gitnova.dev/en/r/angusdevgo/Seep-Reverse-Lab.md
46. **zgsfsec/Full-Chain-Sentinel-System** — 2.3 · Steady · Security · TypeScript · +19 stars measured 2026-10-30, 00:22–10:54 UTC, ≈ 37 by evening
   An authorized penetration-testing agent (built on the pi agent harness) with a Chinese web console and per-project containerized Kali work environments. It guides recon, enumeration, exploitation and reporting while keeping an audit trail.
   Full card: https://gitnova.dev/en/r/zgsfsec/Full-Chain-Sentinel-System.md
47. **aquasecurity/trivy** — 2.1 · Steady · Security · Go · +12 stars measured 2026-10-30, 00:20–10:54 UTC, ≈ 27 by evening
   Security scanner that finds vulnerabilities, misconfigurations, secrets and SBOM in containers, Kubernetes, code repositories, clouds and filesystems. Aimed at developers and DevOps for checking artifact security.
   Full card: https://gitnova.dev/en/r/aquasecurity/trivy.md
48. **wazuh/wazuh** — 2.1 · Steady · Security · C++ · +10 stars measured 2026-10-30, 00:21–10:55 UTC, ≈ 22 by evening
   Open source security platform with endpoint agents and a management server: intrusion detection, log analysis, file integrity monitoring, vulnerability detection and incident response.
   Full card: https://gitnova.dev/en/r/wazuh/wazuh.md
49. **amnezia-vpn/amnezia-client** — 2.0 · Steady · Security · C++ · Not enough measurements today
   Open-source VPN client for desktop and mobile that can automatically deploy your own VPN server on your machine via SSH. Supports OpenVPN, WireGuard, IKEv2 and obfuscated protocols (Cloak, Shadowsocks, AmneziaWG, XRay).
   Full card: https://gitnova.dev/en/r/amnezia-vpn/amnezia-client.md
50. **google/gvisor** — 2.0 · Steady · Security · Go · +8 stars measured 2026-10-30, 00:21–10:55 UTC, ≈ 17 by evening
   gVisor is an application kernel implementing a Linux-like interface in userspace in Go. It isolates containers from the host kernel, reducing container escape risk when running untrusted code.
   Full card: https://gitnova.dev/en/r/google/gvisor.md
51. **armanlife/firefox-vpn-client** — 1.9 · Steady · Security · Go · +8 stars measured 2026-10-30, 00:17–10:55 UTC, ≈ 19 by evening
   Free VPN client for Android, Windows, macOS, and Linux that routes traffic through Mozilla's servers over HTTP/2 and HTTP/3 using Firefox Accounts with multi-account rotation.
   Full card: https://gitnova.dev/en/r/armanlife/firefox-vpn-client.md
52. **Z4nzu/hackingtool** — 1.9 · Steady · Security · Python · +8 stars measured 2026-10-30, 00:20–10:55 UTC, ≈ 19 by evening
   A console toolkit bundling 215 pentesting tools across 21 categories (recon, OSINT, web, wireless, forensics, etc.) with an AI layer that maps a plain-English goal to the right tool and command. Aimed at pentesters, red/blue teams, OSINT…
   Full card: https://gitnova.dev/en/r/Z4nzu/hackingtool.md
53. **songjianyang/xss-audit** — 1.9 · Cooling · Security · +7 stars measured 2026-10-30, 00:20–10:55 UTC, ≈ 15 by evening
   A static XSS audit skill for React, TypeScript and JavaScript codebases with 14 layers of checks, from DOM injection to Trusted Types, writing findings to xss-audit-report.md.
   Full card: https://gitnova.dev/en/r/songjianyang/xss-audit.md
54. **Maldev-Academy/WhisperHijack** — 1.9 · Steady · Security · C · +0 stars measured 2026-10-30, 09:23–10:55 UTC, ≈ 4 by evening
   A process injection PoC that delivers x64 shellcode via Thread Name-Calling and executes it through Waiting Thread Hijacking, without cross-process writes.
   Full card: https://gitnova.dev/en/r/Maldev-Academy/WhisperHijack.md
55. **openai/codex-security** — 1.6 · Steady · Security · TypeScript · +5 stars measured 2026-10-30, 00:21–10:56 UTC, ≈ 11 by evening
   OpenAI's CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in code, and for drafting SECURITY.md security policy.
   Full card: https://gitnova.dev/en/r/openai/codex-security.md
56. **zacharybenson/arken-protocol** — 1.6 · Steady · Security · Rust · +1 star measured 2026-10-30, 07:15–10:56 UTC, ≈ 3 by evening
   Passwordless authentication middleware for Express and FastAPI based on DID signatures: the client signs a one-time nonce with a secp256k1 key, and the server verifies it without passwords, sessions, or a user database.
   Full card: https://gitnova.dev/en/r/zacharybenson/arken-protocol.md
57. **ikow/php2shell-poc** — 1.6 · Cooling · Security · Python · +11 stars measured 2026-10-30, 00:22–10:56 UTC, ≈ 21 by evening
   A proof-of-concept toolkit for two PHP pre-auth RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting PHP 5.4.0 through 8.5.11, with exploits, detection rules, and a lab environment.
   Full card: https://gitnova.dev/en/r/ikow/php2shell-poc.md
58. **anchore/syft** — 1.6 · Steady · Security · Go · +3 stars measured 2026-10-30, 00:21–10:56 UTC, ≈ 7 by evening
   A CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images, filesystems, and archives. Supports many packaging ecosystems and output formats (CycloneDX, SPDX).
   Full card: https://gitnova.dev/en/r/anchore/syft.md
59. **openbao/openbao** — 1.6 · Steady · Security · Go · +8 stars measured 2026-10-30, 00:21–10:56 UTC, ≈ 15 by evening
   OpenBao is an open-source secrets management system for storing, encrypting, and distributing credentials, keys, and certificates, with dynamic secrets and auditing. A community-governed fork of Vault.
   Full card: https://gitnova.dev/en/r/openbao/openbao.md
60. **theorem-labs/oss-verify-proofs** — 1.6 · Cooling · Security · Rocq Prover · +3 stars measured 2026-10-30, 00:22–10:56 UTC, ≈ 6 by evening
   Rocq proofs that OSS-Fuzz fuzz targets for 25 libraries (OpenSSL, zstd, simdjson, etc.) never trigger sanitizer errors on any input within stated limits, checked against compiled RISC-V binaries via the LPS Linux process model.
   Full card: https://gitnova.dev/en/r/theorem-labs/oss-verify-proofs.md
61. **haiou-666/Haiou-workshop** — 1.6 · Steady · Security · +8 stars measured 2026-10-30, 00:24–10:56 UTC, ≈ 15 by evening
   An AI workbench for reverse engineering, authorized penetration testing and security development, combining Codex, Claude Code and DeepSeek Harness with a built-in skill library, REA analysis and toolchains (Ghidra, Frida, YARA, Nuclei,…
   Full card: https://gitnova.dev/en/r/haiou-666/Haiou-workshop.md
62. **WoYun520/dsh-purge** — 1.5 · Cooling · Security · JavaScript · +3 stars measured 2026-10-30, 00:22–10:57 UTC, ≈ 7 by evening
   A red-team plugin for the official DeepSeek Harness that patches host-layer prompt rewriting, approval gates and sandbox policy on your own install, letting you separate host blocks from model refusals for controlled evaluation.
   Full card: https://gitnova.dev/en/r/WoYun520/dsh-purge.md
63. **x86rc/unthemidator** — 1.5 · Cooling · Security · C++ · +2 stars measured 2026-10-30, 00:19–10:57 UTC, ≈ 5 by evening
   A universal unpacker for binaries protected with Themida, Code Virtualizer and WinLicense (v3.0–v4), with PE rebuild, import restoration and VM version identification.
   Full card: https://gitnova.dev/en/r/x86rc/unthemidator.md
64. **rfjakob/gocryptfs** — 1.5 · Steady · Security · Go · +3 stars measured 2026-10-30, 00:21–10:57 UTC, ≈ 7 by evening
   Encrypted overlay filesystem written in Go on top of FUSE, inspired by EncFS and fixing its security issues. It transparently encrypts directories on disk.
   Full card: https://gitnova.dev/en/r/rfjakob/gocryptfs.md
65. **V4bel/InfinityCore** — 1.5 · Steady · Security · C · +3 stars measured 2026-10-30, 00:22–10:57 UTC, ≈ 6 by evening
   A document with technical analysis of six Linux kernel vulnerabilities (Timer, Signal, MM, Futex, Scheduler, SLAB) enabling LPE and container escape, with CVEs and PoCs.
   Full card: https://gitnova.dev/en/r/V4bel/InfinityCore.md
66. **elder-plinius/T3MP3ST** — 1.4 · Steady · Security · TypeScript · +4 stars measured 2026-10-30, 00:22–10:57 UTC, ≈ 8 by evening
   Multi-agent red-teaming platform that turns an existing AI coding agent into a vulnerability-hunting harness, automating the recon → exploit → report kill chain for web apps, CTFs, smart contracts, and source code.
   Full card: https://gitnova.dev/en/r/elder-plinius/T3MP3ST.md
67. **Ernket/CodeScan-Artex** — 1.4 · Steady · Security · Go · +2 stars measured 2026-10-30, 00:22–10:57 UTC, ≈ 5 by evening
   A static code audit platform (Go backend, Next.js frontend) where multiple LLM agents read source code in parallel and build asset and exploration graphs. Read-only: no network, commands, or code execution.
   Full card: https://gitnova.dev/en/r/Ernket/CodeScan-Artex.md
68. **aarsaputra/php2shell** — 1.4 · Cooling · Security · Python · +3 stars measured 2026-10-30, 00:23–10:58 UTC, ≈ 7 by evening
   Research toolkit reproducing an unauthenticated RCE chain in PHP 5.4–8.4.26 (CVE-2026-109619/109618) over pure HTTP with JA3 impersonation and capped proof-of-access commands.
   Full card: https://gitnova.dev/en/r/aarsaputra/php2shell.md
69. **logto-io/logto** — 1.4 · Steady · Security · TypeScript · +4 stars measured 2026-10-30, 00:23–10:57 UTC, ≈ 8 by evening
   Open-source authentication and authorization infrastructure built on OIDC and OAuth 2.1 for SaaS and AI apps, with multi-tenancy, SSO, and RBAC. It ships pre-built sign-in flows, customizable UIs, and SDKs for 30+ frameworks.
   Full card: https://gitnova.dev/en/r/logto-io/logto.md
70. **9bie/php2shell-bypass-aslr-exp** — 1.4 · Cooling · Security · Python · +5 stars measured 2026-10-30, 00:23–10:57 UTC, ≈ 11 by evening
   A proof-of-concept exploit that achieves RCE against PHP 8.4.26 on Apache prefork/mod_php using only HTTP multipart requests, bypassing ASLR via heap and libphp leak, without session_start() or target-side files.
   Full card: https://gitnova.dev/en/r/9bie/php2shell-bypass-aslr-exp.md
71. **projectdiscovery/nuclei-templates** — 1.3 · Steady · Security · JavaScript · +5 stars measured 2026-10-30, 00:22–10:57 UTC, ≈ 9 by evening
   A community-curated collection of templates for the nuclei vulnerability scanner, covering CVEs, exposures, panels and known exploited vulnerabilities. It helps pentesters and bug bounty hunters quickly find issues in applications.
   Full card: https://gitnova.dev/en/r/projectdiscovery/nuclei-templates.md
72. **zitadel/zitadel** — 1.3 · Steady · Security · Go · +2 stars measured 2026-10-30, 00:22–10:58 UTC, ≈ 5 by evening
   Open-source identity and access management platform with SSO, MFA, Passkeys, OIDC, SAML, SCIM and multi-tenancy. Suits teams needing a self-hosted or cloud identity provider without vendor lock-in.
   Full card: https://gitnova.dev/en/r/zitadel/zitadel.md
73. **ZigZagBoi1/PS5-14.10-Research** — 1.3 · Cooling · Security · Assembly · +4 stars measured 2026-10-30, 00:22–10:58 UTC, ≈ 8 by evening
   Open research into the PS5 firmware 14.10 kernel attack surface: 62 Lua probes via a userland loader on TCP 9026 map syscalls, memory, networking, and exploit paths.
   Full card: https://gitnova.dev/en/r/ZigZagBoi1/PS5-14.10-Research.md
74. **KatrielMoses/voidaccess** — 1.2 · Steady · Security · Python · +0 stars measured 2026-10-30, 00:23–10:58 UTC, ≈ 2 by evening
   Self-hosted OSINT platform that turns dark-web research queries into structured threat intelligence through a 13-step pipeline with collection, enrichment, relationship graphs, and exports.
   Full card: https://gitnova.dev/en/r/KatrielMoses/voidaccess.md
75. **Fluepke/emudrahahahahaha** — 1.2 · Cooling · Security · Go · +0 stars measured 2026-10-30, 00:24–10:58 UTC, ≈ 1 by evening
   A Go project for working with private keys, published under the name Private Keys. Details are unclear because the repository has no README.
   Full card: https://gitnova.dev/en/r/Fluepke/emudrahahahahaha.md
76. **NCSC-NL/php2shell** — 1.2 · Cooling · Security · Python · +4 stars measured 2026-10-30, 00:23–10:58 UTC, ≈ 8 by evening
   Operational information on the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 allowing unauthenticated RCE: patching guidance, detection material and affected software inventories.
   Full card: https://gitnova.dev/en/r/NCSC-NL/php2shell.md
77. **dimasma0305/CVE-2026-111497-POC** — 1.1 · Steady · Security · Python · +1 star measured 2026-10-30, 00:23–10:58 UTC, ≈ 3 by evening
   PoC for CVE-2026-111497: a malformed Brotli stream triggers an out-of-bounds write in Node.js decoders, reaching RCE in three lab profiles. Ships with local Docker labs, a scanner, and defender detection rules.
   Full card: https://gitnova.dev/en/r/dimasma0305/CVE-2026-111497-POC.md
78. **PandaSI-Labs/pandasi-agent** — 1.1 · Cooling · Security · Python · +3 stars measured 2026-10-30, 00:23–10:58 UTC, ≈ 7 by evening
   Deterministic offline evidence-policy checker for PandaSI: reads a JSON packet about a BNB Smart Chain token and returns RESEARCH or ABSTAIN, never authorizing execution.
   Full card: https://gitnova.dev/en/r/PandaSI-Labs/pandasi-agent.md
79. **openai/php2shell-checker** — 1.1 · Cooling · Security · JavaScript · +3 stars measured 2026-10-30, 00:24–10:58 UTC, ≈ 6 by evening
   A Node.js CLI that checks a website's PHP version via HTTP headers or a local php -v binary for vulnerability to php2shell. Returns OK, VULNERABLE, or UNKNOWN with matching exit codes.
   Full card: https://gitnova.dev/en/r/openai/php2shell-checker.md
80. **eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC** — 1.1 · Cooling · Security · Shell · +4 stars measured 2026-10-30, 00:24–10:58 UTC, ≈ 7 by evening
   Repository with a PoC exploit for two critical RCE flaws in the PHP core (php2shell), plus detection and patching guidance. Intended for security researchers and administrators.
   Full card: https://gitnova.dev/en/r/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC.md
81. **assetnote/php2shell-scanner** — 1.1 · Cooling · Security · Python · +1 star measured 2026-10-30, 00:22–10:58 UTC, ≈ 3 by evening
   Python CLI scanner for detecting php2shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP applications. It sends multipart probes and flags targets based on memory-exhaustion errors, PHP-FPM worker failures, or known…
   Full card: https://gitnova.dev/en/r/assetnote/php2shell-scanner.md
82. **Alejandros17487/ai-jailbreaks** — 1.1 · Cooling · Security · +2 stars measured 2026-10-30, 00:24–10:58 UTC, ≈ 5 by evening
   A collection of 35 paste-ready jailbreak prompts for 25+ models: system prompts, AGENTS.md files, Modelfiles and configs for AI red-teaming and security research.
   Full card: https://gitnova.dev/en/r/Alejandros17487/ai-jailbreaks.md
83. **Bodila51/reverse-engineer-Wi-Fi-router** — 1.0 · Cooling · Security · Python · +1 star measured 2026-10-30, 00:24–10:59 UTC, ≈ 3 by evening
   A Claude Code skill that reverse-engineers your Wi-Fi router's admin API from a photo to audit privacy and fix slow Wi-Fi, without manuals or exploits.
   Full card: https://gitnova.dev/en/r/Bodila51/reverse-engineer-Wi-Fi-router.md
84. **LSPosed/dexsql-release** — 1.0 · Steady · Security · Python · +2 stars measured 2026-10-30, 00:24–10:59 UTC, ≈ 4 by evening
   A tool for querying classes, methods, strings and call references in Android APK and DEX files using SQL, usable from the CLI or by connecting it to an AI agent via MCP.
   Full card: https://gitnova.dev/en/r/LSPosed/dexsql-release.md
85. **thomasunise/argus** — 1.0 · Cooling · Security · Python · +0 stars measured 2026-10-30, 00:23–10:59 UTC, ≈ 1 by evening
   Self-hosted multi-tenant security operations platform where AI agents only analyze evidence from an evidence graph, while a separate approval-gated action broker is the only component allowed to change infrastructure.
   Full card: https://gitnova.dev/en/r/thomasunise/argus.md
86. **murrez/php2shell** — 0.9 · Steady · Security · Python · +2 stars measured 2026-10-30, 00:24–10:59 UTC, ≈ 4 by evening
   A PHP security research framework that probes PHP core vulnerabilities (CVE-2026-109618, 109619, 115560) and discovers application upload handlers, including automatic LFI parameter discovery.
   Full card: https://gitnova.dev/en/r/murrez/php2shell.md
87. **whokilleddb/TTs** — 0.9 · Steady · Security · Python · +1 star measured 2026-10-30, 00:24–10:59 UTC, ≈ 2 by evening
   Payload builder that packages XOR-encrypted shellcode into a C# assembly and .tt file for execution via TextTransform.exe without VirtualAlloc appearing in the stack trace.
   Full card: https://gitnova.dev/en/r/whokilleddb/TTs.md
88. **usestrix/firewall** — 0.8 · Steady · Security · Rust · +0 stars measured 2026-10-30, 00:24–10:59 UTC, ≈ 0 by evening
   A Rust tool that blocks installation of malicious packages from npm, PyPI, crates.io, Go and RubyGems by checking Strix's blocklist and holding back new versions. Runs locally: either machine-wide on macOS/Windows or as a command prefix.
   Full card: https://gitnova.dev/en/r/usestrix/firewall.md
89. **pastawithpesto/PS5-14.10-Jailbreak-Research** — 0.8 · Cooling · Security · JavaScript · +0 stars measured 2026-10-30, 00:23–10:59 UTC, ≈ 1 by evening
   WebKit exploit research for PlayStation 5 firmware 14.10: a browser-to-kernel chain map, 90+ probes validated on the console, and analysis of known CVEs.
   Full card: https://gitnova.dev/en/r/pastawithpesto/PS5-14.10-Jailbreak-Research.md
90. **hashicorp/vault** — 0.8 · Steady · Security · Go · +1 star measured 2026-10-30, 00:25–10:59 UTC, ≈ 2 by evening
   Vault is a tool for securely storing secrets, managing keys, dynamic credentials, and auditing access.
   Full card: https://gitnova.dev/en/r/hashicorp/vault.md
91. **qkaiser/broadcom-wps** — 0.7 · Cooling · Security · Python · +1 star measured 2026-10-30, 00:24–10:59 UTC, ≈ 2 by evening
   Toolkit for detecting routers running Broadcom's vulnerable 802.11/WPS implementation: YARA rules for firmware and a live access point fingerprinting script.
   Full card: https://gitnova.dev/en/r/qkaiser/broadcom-wps.md
92. **assetnote/node2shell-scanner** — 0.7 · Cooling · Security · Python · +0 stars measured 2026-10-30, 00:22–10:59 UTC, ≈ 0 by evening
   CLI scanner for detecting CVE-2026-111497 in Node.js HTTP applications: sends control requests and a Brotli probe without executing commands.
   Full card: https://gitnova.dev/en/r/assetnote/node2shell-scanner.md
93. **devploit/php2shell** — 0.7 · Cooling · Security · Python · +1 star measured 2026-10-30, 00:25–10:59 UTC, ≈ 2 by evening
   Research toolkit for exploiting pre-auth RCE in PHP's Apache module (session.upload_progress) via CVE-2026-109618 and CVE-2026-109619, with build profiles, labs and calibration.
   Full card: https://gitnova.dev/en/r/devploit/php2shell.md
94. **JoasASantos/php2shell-exploit** — 0.7 · Cooling · Security · Python · +0 stars measured 2026-10-30, 00:24–10:59 UTC, ≈ 1 by evening
   A Python exploit framework for CVE-2026-109618/619, achieving pre-auth remote code execution in PHP via a session.upload_progress use-after-free, with ASLR bypass and webshell planting. Intended for authorized security testing and research.
   Full card: https://gitnova.dev/en/r/JoasASantos/php2shell-exploit.md
95. **IvanIVGrozny/iOS27.0.1-SPTM-Research** — 0.6 · Steady · Security · Python · +0 stars measured 2026-10-30, 00:24–10:59 UTC, ≈ 0 by evening
   An analysis of a TLB-invalidation race fix in the Secure Page Table Monitor (SPTM) between iOS 27.2 beta 1 and beta 3 on iPhone18,4 (T8150), with tooling to unpack and analyze the firmware.
   Full card: https://gitnova.dev/en/r/IvanIVGrozny/iOS27.0.1-SPTM-Research.md
96. **valimised/ivxv** — 0.5 · Steady · Security · Go · +1 star measured 2026-10-30, 00:25–11:00 UTC, ≈ 2 by evening
   Source code of the Estonian IVXV online voting system, published for public review. It is used in elections and development is supervised by the State Electoral Office of Estonia.
   Full card: https://gitnova.dev/en/r/valimised/ivxv.md
97. **JoasASantos/php2shell-scanner** — 0.5 · Steady · Security · Python · +0 stars measured 2026-10-30, 00:25–11:00 UTC, ≈ 0 by evening
   Non-destructive scanner for CVE-2026-109618 and CVE-2026-109619, RCE bugs in the PHP core. Discovers subdomains via crt.sh and subfinder, detects PHP versions from banners and error pages, and scans origin IPs behind CDNs.
   Full card: https://gitnova.dev/en/r/JoasASantos/php2shell-scanner.md
98. **dinosn/php-cve-2026-10961x-lab-poc** — 0.5 · Steady · Security · Python · +0 stars measured 2026-10-30, 00:25–11:00 UTC, ≈ 0 by evening
   Lab PoC for the PHP 8.5.11 RCE chains CVE-2026-109618/109619: unauthenticated code execution via four HTTP requests, address disclosure through PS(id)→cookie and a UAF, plus a check of the 8.5.12 patch.
   Full card: https://gitnova.dev/en/r/dinosn/php-cve-2026-10961x-lab-poc.md
99. **Barbpouncouple/Robux-Generator** — 0.4 · Quiet · Security · +0 stars measured 2026-10-30, 00:26–11:00 UTC, ≈ 1 by evening
   The repository offers a "Robux Generator" Windows installer that downloads and runs a third-party file via a PowerShell script. It claims to be a standalone build for generating Robux, which is unverified and resembles a typical malware…
   Full card: https://gitnova.dev/en/r/Barbpouncouple/Robux-Generator.md
100. **Wtrwx/vesper** — 0.4 · Steady · Security · JavaScript · +0 stars measured 2026-10-30, 00:25–11:00 UTC, ≈ 0 by evening
   iOS reverse engineering platform: MCP tools and agent skills for runtime inspection, automation, decryption, debugging and tweak development via SSH, Frida and IDA.
   Full card: https://gitnova.dev/en/r/Wtrwx/vesper.md

For agents: https://gitnova.dev/llms.txt · search: https://gitnova.dev/api/v1/search?q=… · MCP: https://gitnova.dev/mcp · any page as Markdown — append .md to its URL