Compilation of open-source security tools & platforms for your Startup

This compilation of open-source tools aim to provide resources you can use for some of the step of the secure development life cycle of your organization, ie:

Security Training
Security Architecture Review
Security Requirements
Threat Modeling
Static Analysis
OpenSource Analysis
Dynamic Analysis
Penetration Testing

If you think I should add a new tool to the list you can open a github issue or send a PR directly.

Resources

User management

Keycloak

Authorization service

Secret management

HashiCorp Vault (Key Management Service)
Passbolt (Password manager)

IDS, IPS, Firewalls and Host/Network monitoring

Data visualization

Grafana

Web Application Firewall

Object Storage

MinIO

VPN

Security training platforms

Static analysis tools

Snyk
Dockerscan
Clair scanner
Bandit (Code analyzer for python)
Brakeman (Code analyzer for Ruby on rails applications)
Semgrep (Static analysis at ludicrous speed)

Dynamic analysis tools

Hetty (Proxy similar to BurpSuite)
OpenVAS Scanner (Web scanner)
Nikto2 (Web scanner)
OWASP ZAP
Nuclei
testssl.sh (Dynamic analysis for TLS configuration)

Misc

Pi-Hole
Podman
Homer (Build beautiful dashboards)

Alevsk/startup-security-with-opensource-tools