Top SEC GitHub Repositories & Tools (2026)

A collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools and more.

Hunt down social media accounts by username across social networks

π RuView turns commodity WiFi signals into real-time spatial intelligence, vital sign monitoring, and presence detection — all without a single pixel of video.

An AI second brain that maintains itself. Full guide, starter vault, agent skills and scripts for a self-organizing knowledge base in Claude Code and Obsidian.

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

JSON.parse with hard limits on nesting depth, key count, string length and input size. Refuses parser bombs before they are allocated.

Comfortably monitor your network traffic 🕵️‍♂️

Get Android app updates straight from the source.

A WiFi security auditing software

Node fetch with hard size, compression-ratio and time limits. Stops gzip bombs mid-stream.

Fast web fuzzer written in Go

OpenHuman is the fastest, cheapest, most efficient open-source agent harness. Written in Rust

Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.

Linux sandboxing that doesn't get in your way

Free Windows, Mac and Linux cleaner, scanner, and more.

A high performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar

Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS

The best IP Toolbox. Check your IP address & geolocation, test IP for WebRTC and DNS IP leaks, run an IP quality check, browser fingerprint check, website availability check, network speed test, global latency test, MTR test, Whois search, and more.

The most comprehensive Claude Code guide: agentic workflows, hooks, skills, MCP servers, quizzes, and production-ready templates. 430K+ lines.

Customer-run client for Secure MCP Tunnel: connect private or localhost MCP servers to ChatGPT, Codex, the Responses API, and AgentKit without exposing them to the public internet.