Parsia "CryptoGangsta" Hakimian

EvE-3D-Printing.

spec-kit. 💫 Toolkit to help you get started with Spec-Driven Development

visa-vulnerability-agentic-harness. Visa Vulnerability Agentic Harness

liteparse. A fast, helpful, and open-source document parser

redai. AI-driven vulnerability discovery and live validation

graphify. AI coding assistant skill (Claude Code, Codex, OpenCode, Cursor, Gemini CLI, and more). Turn any folder of code, SQL schemas, R scripts, shell scripts, docs, papers, images, or videos into a queryable knowledge graph. App code + database schema + infrastructure in one graph.

ironcurtain. A secure* runtime for autonomous AI agents. Policy from plain-English constitutions. (*https://ironcurtain.dev)

copilot-second-opinion. OpenCode skill + MCP server that runs an automated GitHub Copilot PR review loop: request review, wait, triage, push fixes, reply, resolve, repeat.

mythos-bench. Jagged Frontier: LLM vulnerability detection benchmark harnesses (API + Claude Code agentic)

skills. Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows

trailmark. Build and query a graph database representation of source code

proofofthought. Proof of thought : LLM-based reasoning using Z3 theorem proving with multiple backend support (SMT2 and JSON DSL)

secure-sw-dev-fundamentals. Secure Software Development Fundamentals courses (from the OpenSSF Best Practices WG)

flawfinder. a static analysis tool for finding vulnerabilities in C/C++ source code

BinCodeQL. Python

OpenAnt. OpenAnt from Knostic is the leading open source LLM-based vulnerability discovery product, helping defenders proactively find verified security flaws while minimizing both false positives and false negatives. Stage 1 detects. Stage 2 attacks. What survives is real.

go-sitter-forest. Where a Gopher meets lots of 🌳 Sitters

ACER. ACER is an AST-based Callgraph Generator Development Framework

Vulnhalla. Python

stack-graphs. Rust implementation of stack graphs

montoya-kotlin-utilities. Kotlin

go-tree-sitter. Go bindings for tree-sitter

aider. aider is AI pair programming in your terminal

code-graph-rag. The ultimate RAG for your monorepo. Query, understand, and edit multi-language codebases with the power of AI and knowledge graphs

hound. Language-agnostic AI auditor that autonomously builds and refines adaptive knowledge graphs for deep, iterative code reasoning.

gateway. A blazing fast AI Gateway with integrated guardrails. Route to 1,600+ LLMs, 50+ AI Guardrails with 1 fast & friendly API.

buttercup. Buttercup finds and patches software vulnerabilities

fraim. A flexible framework for security teams to build and deploy AI-powered workflows that complement their existing security operations.

osv-scalibr. OSV-SCALIBR: A library for Software Composition Analysis

repeat-strike. Java

Pishi. Pishi is a code coverage tool like kcov for macOS.

PPspliT. A PowerPoint add-in that splits slides according to slideshow-time animation effects

golem. Golem automates C/C++ vulnerability discovery with SemGrep+LLVM+LLM

Burp-Montoya-Utilities. A collection of utilities for building extensions using Burp's Montoya API

LoggerPlusPlus. Advanced Burp Suite Logging Extension

LAST. Use AI to Scan Your Code from the Command Line for security and code smells. Bring your own keys. Supports OpenAI and Gemini

playwright-mcp. Playwright MCP server

BFScan. Tool for finding URLs, paths, secrets and generating raw HTTP requests and OpenApi specifications from config files and annotations used in JAR / WAR / APK applications.

verizon_burp_extensions_ai. Verizon Burp Extensions: AI Suite

dusseldorf. Dusseldorf is an out-of-band security tool to help in security research.

DeepSeek-V3. Python

RFID-Tag-Guide. Instructions on how to read out the bambulab nfc tags

UNO-R4-WiFi-freedom. UNO R4 WiFi set free!

WuppieFuzz. A coverage-guided REST API fuzzer developed on top of LibAFL

PowerGlove. A project to convert your Powerglove into a USB Joystick

bbrf-client. The Bug Bounty Reconnaissance Framework (BBRF) can help you coordinate your reconnaissance workflows across multiple devices

jwt-reauth. Java

CodeGeeX. CodeGeeX: An Open Multilingual Code Generation Model (KDD 2023)

whisper.cpp. Port of OpenAI's Whisper model in C/C++

foundry-toolkit.

llm.c. LLM training in simple, raw C/CUDA

z3. The Z3 Theorem Prover

tree-sitter-graph. Construct graphs from parsed source code

snapshot. WinDbg extension written in Rust to dump the CPU / memory state of a running VM

Crassus. C#

rust-code-analysis. Library to analyze and collect metrics on source code

type-sitter. generate typed wrappers for tree-sitter grammars from node-types.json and queries

chumsky. [Chumsky has moved to Codeberg!] Write expressive, high-performance parsers with ease.

rust-sitter. Use Tree Sitter to parse your own languages in Rust

twinny. The most no-nonsense, locally or API-hosted AI code completion plugin for Visual Studio Code - like GitHub Copilot but 100% free.

datadog-static-analyzer. Datadog Static Analyzer

tavor. A generic fuzzing and delta-debugging framework

numbat. Library to manipulate and create Sourcetrail databases

fuzzomatic. Automatically fuzz Rust projects from scratch

clap. A full featured, fast Command Line Argument Parser for Rust

magika. Fast and accurate AI powered file content types detection

localllm. Python

symbolic-execution-tutorial. Tutorial on Symbolic Execution. Hands-on session is based on the angr framework.

codeql-zero-to-hero. CodeQL zero to hero blog post series challenges

oss-fuzz-gen. LLM powered fuzzing via OSS-Fuzz.

pyt. A Static Analysis Tool for Detecting Security Vulnerabilities in Python Web Applications

LLMs-from-scratch. Implement a ChatGPT-like LLM in PyTorch from scratch, step by step

Proton. Compatibility tool for Steam Play based on Wine and additional components

frown. frown (frida-own) – an instrumentation challenge

testo. Test framework for OCaml

weggli-patterns. A collection of my weggli patterns to facilitate vulnerability research.

llm-course. Course to get into Large Language Models (LLMs) with roadmaps and Colab notebooks.

frinet. Frida-based tracer for easier reverse-engineering on Android, iOS, Linux, Windows and most related architectures.

ollama. Get up and running with Kimi-K2.6, GLM-5.1, MiniMax, DeepSeek, gpt-oss, Qwen, Gemma and other models.

llama-cookbook. Welcome to the Llama Cookbook! This is your go to guide for Building with Llama: Getting started with Inference, Fine-Tuning, RAG. We also show you how to solve end to end problems using Llama model family and using them on various provider services

textgen. Open-source desktop app for local LLMs. Text, vision, tool-calling, OpenAI/Anthropic-compatible API. 100% private.

crawlee. Crawlee—A web scraping and browser automation library for Node.js to build reliable crawlers. In JavaScript and TypeScript. Extract data for AI, LLMs, RAG, or GPTs. Download HTML, PDF, JPG, PNG, and other files from websites. Works with Puppeteer, Playwright, Cheerio, JSDOM, and raw HTTP. Both headful and headless mode. With proxy rotation.

llamafile. Distribute and run LLMs with a single file.

generative-ai-for-beginners. 21 Lessons, Get Started Building with Generative AI

legba. The fastest and more comprehensive multiprotocol credentials bruteforcer / password sprayer and enumerator. 🥷

openapi-changes. The world's most powerful OpenAPI breaking changes detector. Discover what changed between two OpenAPI specs, or a single spec over time. Supports OpenAPI 3.2, 3.1 and 3.0

saleae-importer. A library for reading and writing Saleae Logic 2 binary capture data

rust_tips_and_tricks. Rust For Windows Cheatsheet

centipede. C++

starhook. Manage & Analyze repositories at scale

openapi-devtools. Browser extension that generates API specs for any app or website

Startup-CTO-Handbook. The Startup CTO's Handbook, a book covering leadership, management and technical topics for leaders of software engineering teams

wzg-icarus-balance-overhaul.

attacking-llms. Repo of common LLM attacks

logrus. Structured, pluggable logging for Go.

PIPE. Prompt Injection Primer for Engineers

humanify. Deobfuscate Javascript code using ChatGPT

lo. 💥 A Lodash-style Go library based on Go 1.18+ Generics (map, filter, contains, find...)

noir. Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.

llama-gpt. A self-hosted, offline, ChatGPT-like chatbot. Powered by Llama 2. 100% private, with no data leaving your device. New: Code Llama support!

TypeChat. TypeChat is a library that makes it easy to build natural language interfaces using types.

x8. Hidden parameters discovery suite

BChecks. BChecks collection for Burp Suite Professional and Burp Suite DAST

private-gpt. Complete API layer for private AI applications on local models: RAG, skills, tools, MCP, text-to-sql, and more. Works with any OpenAI-compatible inference server.

ast-grep. ⚡A CLI tool for code structural search, lint and rewriting. Written in Rust

bearer. Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.

FlipperNested. Recover Mifare Classic keys on Flipper Zero

flipperzero-mayhem. Perfect companion for your Flipper Zero. ESP32 with WiFi, BT/BLE, micro-SD, camera+PSRAM, flashlight and extras: NRF24/CC1101, 3V/5V sensors

ghastoolkit. GitHub Advanced Security Python Toolkit

thoughtloom. ThoughtLoom is a powerful tool designed to foster creativity and enhance productivity through the use of LLMs directly from the command line. It facilitates rapid development and integration of LLM-based tools into various workflows, empowering individuals and teams to experiment, collaborate, and ultimately streamline their daily tasks.

supercharger. Supercharge Open-Source AI Models

turbopilot. Turbopilot is an open source large-language-model based code completion engine that runs locally on CPU

dolly. Databricks’ Dolly, a large language model trained on the Databricks Machine Learning Platform

AutoGPT. AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.

securitree.nvim. SecuriTree - Security Research Tool

dxsonnet. Just another Jsonnet library: a collection of generic jsonnet functions

NSwag. The Swagger/OpenAPI toolchain for .NET, ASP.NET Core and TypeScript.

llama.cpp. LLM inference in C/C++

openplayground. An LLM playground you can run on your laptop

fuzzing. Tutorials, examples, discussions, research proposals, and other resources related to fuzzing

gpt4all. GPT4All: Run Local LLMs on Any Device. Open-source and available for commercial use.

opcua_network_fuzzer. Python

langchain. The agent engineering platform.

secure-code-game. Learn to code securely while having fun through our popular open source in-editor experience, designed for developers, students, and anyone curious about security. Get started for free in under 2 minutes, playing right from your browser.

bindgen-tutorial-bzip2-sys. A tutorial/example crate for generating C/C++ bindings on-the-fly with libbindgen

typst. A markup-based typesetting system that is powerful and easy to learn.

discourse. A platform for community discussion. Free, open, simple.

llama. Inference code for Llama models

dalai. The simplest way to run LLaMA on your local machine

API-Security. OWASP API Security Project

rust-course.

rails-rest-api. A simple RoR 6 REST API demo with JWT authentication.

box-openapi. OpenAPI 3.0 Specification for the Box APIs

dynamic-analysis. ⚙️ A curated list of dynamic analysis tools and linters for all programming languages, binaries, and more.

akto. Proactive, Open source API security → API discovery, API Security Posture, Testing in CI/CD, Test Library with 1000+ Tests, Add custom tests, Sensitive data exposure

libopenapi. libopenapi is a fully featured, high performance OpenAPI 3.2, 3.1, 3.0, Overlays and Arazzo parser, library, validator and toolkit for go applications.

pocs. Proof of Concepts (PE, PDF...)

restish. Restish is a CLI for interacting with REST-ish HTTP APIs with some nice features built-in

go-backend-clean-architecture. A Go (Golang) Backend Clean Architecture project with Gin, MongoDB, JWT Authentication Middleware, Test, and Docker.

hackvertor. Java

grepmarx. A source code static analysis platform for AppSec enthusiasts.

Burp-Suite-Certified-Practitioner-Exam-Study. Burp Suite Certified Practitioner Exam Study

panwriter. Markdown editor with pandoc integration and paginated preview.

capital. A built-to-be-vulnerable API application based on the OWASP top 10 API vulnerabilities. Use c{api}tal to learn, train and exploit API Security vulnerabilities within your own API Security CTF.

nickdesaulniers.github.com. My personal blog

RpcInvestigator. Exploring RPC interfaces on Windows

nevod. Nevod is a language and technology for pattern-based text search.

antlr4. ANTLR (ANother Tool for Language Recognition) is a powerful parser generator for reading, processing, executing, or translating structured text or binary files.

grammars-v4. Grammars written for ANTLR v4; expectation that the grammars are free of actions.

exploitation-course. Offensive Software Exploitation Course

dev-random. short experiments

comprehensive-rust. This is the Rust course used by the Android team at Google. It provides you the material to quickly teach Rust.

guarddog. :snake: :mag: GuardDog is a CLI tool to Identify malicious PyPI and npm packages

awesome-fuzzing. A curated list of awesome Fuzzing(or Fuzz Testing) for software security

agollo. 🚀Go client for ctrip/apollo (https://github.com/apolloconfig/apollo)

security-study-plan. Complete Practical Study Plan to become a successful cybersecurity engineer based on roles like Pentest, AppSec, Cloud Security, DevSecOps and so on...

silverbullet. An open source personal productivity platform built on Markdown, turbo charged with the scripting power of Lua

jaeles. The Swiss Army knife for automated Web Application Testing

SandboxSecurityTools. Security testing tools for Windows sandboxing technologies

fq. jq for binary formats - tool, language and decoders for working with binary and text formats

go-restful. package for building REST-style Web Services using Go

public-apis. A collective list of free APIs

defi-threat. a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations on decentralized finance

go-tree-sitter. Golang bindings for tree-sitter https://github.com/tree-sitter/tree-sitter

go-tools. Staticcheck - The advanced Go linter

gokart. A static analysis tool for securing Go code

FridaScripts. JavaScript

cherrybomb. Stop half-done APIs! Cherrybomb is a CLI tool that helps you avoid undefined user behaviour by auditing your API specifications, validating them and running API security tests.

megalinter. 🦙 MegaLinter analyzes 50 languages, 22 formats, 21 tooling formats, excessive copy-pastes, spelling mistakes and security issues in your repository sources with a GitHub Action, other CI tools or locally.

kin-openapi. OpenAPI 3.0 and 3.1 (and Swagger v2) implementation for Go (parsing, converting, validation, and more)

semgrep-interfaces. Store the ATD/openapi/protobuf/... interfaces between semgrep components

LaPreprint. 📝 A nicely formatted LaTeX preprint template

atd. Static types for JSON APIs

weggli-examples. Examples of weggli queries

API-Security-Checklist. Checklist of the most important security countermeasures when designing, testing, and releasing your API

semgrep-rules. Custom rules for semgrep.dev

codevigilant_semgrep_rules. We use semgrep rules to hunt for bugs in source code. This repository will keep list of rules we have in public

semgrep-hotspots. Repository for my Semgrep hot spot rules

my-semgrep-rules. my-semgrep-rules

semgrep-rules. Custom semgrep rules registry

sarif-rs. A group of Rust projects for interacting with the SARIF format

openapi-diff. Utility for comparing two OpenAPI specifications.

express-openapi-validator. 🦋 Auto-validates api requests, responses, and securities using ExpressJS and an OpenAPI 3.1.x or 3.0.x specification

oasdiff. OpenAPI Diff and Breaking Changes

laravel-openapi. Generate OpenAPI specification for Laravel Applications

response2schema. A quick and easy tool for generating OpenAPI schemas.

chrome-har. Create HAR files from Chrome Debugging Protocol data

openapi-to-postman. Plugin for converting OpenAPI 3.0 specs to the Postman Collection (v2) format

cats. CATS is a REST API Fuzzer and negative testing tool for OpenAPI endpoints. CATS automatically generates, runs and reports tests with minimum configuration and no coding effort. Tests are self-healing and do not require maintenance.

avantation. Build OpenAPI3.0 specification from HAR.

har2openapi. Generate openapi spec api documentation from captured har files

har2requests. Generate Python Requests code from your browser activity 🤖

mitmproxy2swagger. Automagically reverse-engineer REST APIs via capturing traffic

semgrep-rules. A collection of my Semgrep rules

fuzzable. Framework for Automating Fuzzable Target Discovery with Static Analysis.

typify. compiler from JSON Schema into idiomatic Rust types

jsonnet. Jsonnet - The data templating language

semgrep-server-rules. Go

feroxbuster. A fast, simple, recursive content discovery tool written in Rust.

archerysec. ASOC, ASPM, DevSecOps, Vulnerability Management Using ArcherySec.