Repositories list

• openshield

  Public
  Open source CSPM for Azure - scan for misconfigurations and quantum-unsafe cryptography, map findings to CIS/NIST/ISO27001/SOC2, and fix them with one command

  pythonopen-sourceowasp+ 10

  pythonopen-sourceowaspcompliancepost-quantum-cryptographysecurity-scannersecurity-toolscloud-securityazure-securitymisconfiguration+ 3

  Python

  •

  MIT License

  •6969 forks in OWASP/openshield•5959 stars in OWASP/openshield•3232 issues in OWASP/openshield•1818 pull requests in OWASP/openshield•Updated Oct 20, 2026Oct 20, 2026

• www-project-juice-shop

  Public

  OWASP/www-project-juice-shop’s past year of commit activity
  OWASP Foundation Web Respository

  hacktoberfest

  hacktoberfest

  HTML

  •185185 forks in OWASP/www-project-juice-shop•113113 stars in OWASP/www-project-juice-shop•00 issues in OWASP/www-project-juice-shop•44 pull requests in OWASP/www-project-juice-shop•Updated Oct 20, 2026Oct 20, 2026

• cornucopia

  Public

  OWASP/cornucopia’s past year of commit activity
  The source files and tools needed to build the OWASP Cornucopia decks in various languages

  cardgamegamescard-games+ 6

  cardgamegamescard-gamesowaspgamificationgameserverthreat-modelingappsecrequirements-analysis

  Python

  •

  Creative Commons Attribution Share Alike 4.0 International

  •105105 forks in OWASP/cornucopia•152152 stars in OWASP/cornucopia•3030 issues in OWASP/cornucopia•1515 pull requests in OWASP/cornucopia•Updated Oct 20, 2026Oct 20, 2026

• owasp-ctf-in-a-box

  Public
  Self-hosted OWASP CTF kit: one box, one free GitHub org, no cloud dependencies

  docker-composeself-hostedctf+ 4

  docker-composeself-hostedctfcapture-the-flagsecure-codingsecurity-educationowasp-ctf

  TypeScript

  •

  MIT License

  •1515 forks in OWASP/owasp-ctf-in-a-box•1919 stars in OWASP/owasp-ctf-in-a-box•1212 issues in OWASP/owasp-ctf-in-a-box•55 pull requests in OWASP/owasp-ctf-in-a-box•Updated Oct 20, 2026Oct 20, 2026

• BLT

  Public

  OWASP/BLT’s past year of commit activity
  Read-only mirror of https://git.owaspblt.org/BLT. Issues and pull requests go there.

  HTML

  •11 fork in OWASP/BLT•00 stars in OWASP/BLT•00 issues in OWASP/BLT•00 pull requests in OWASP/BLT•Updated Oct 20, 2026Oct 20, 2026

• www-project-application-security-verification-standard

  Public

  OWASP/www-project-application-security-verification-standard’s past year of commit activity
  OWASP Foundation Web Respository

  SCSS

  •

  Apache License 2.0

  •3232 forks in OWASP/www-project-application-security-verification-standard•9494 stars in OWASP/www-project-application-security-verification-standard•00 issues in OWASP/www-project-application-security-verification-standard•00 pull requests in OWASP/www-project-application-security-verification-standard•Updated Oct 20, 2026Oct 20, 2026

• wrongsecrets-binaries

  Public
  Source code for the Binaries of OWASP WrongSecrets

  hacktoberfest

  hacktoberfest

  Shell

  •

  GNU Affero General Public License v3.0

  •77 forks in OWASP/wrongsecrets-binaries•1212 stars in OWASP/wrongsecrets-binaries•22 issues in OWASP/wrongsecrets-binaries•22 pull requests in OWASP/wrongsecrets-binaries•Updated Oct 20, 2026Oct 20, 2026

• AI-Threat-Modeler

  Public
  TypeScript

  •

  MIT License

  •00 forks in OWASP/AI-Threat-Modeler•00 stars in OWASP/AI-Threat-Modeler•00 issues in OWASP/AI-Threat-Modeler•00 pull requests in OWASP/AI-Threat-Modeler•Updated Oct 20, 2026Oct 20, 2026

• OpenCRE

  Public
  securitysecurity-auditstandards

  securitysecurity-auditstandards

  Python

  •

  Creative Commons Zero v1.0 Universal

  •151151 forks in OWASP/OpenCRE•200200 stars in OWASP/OpenCRE•114114 issues in OWASP/OpenCRE•5757 pull requests in OWASP/OpenCRE•Updated Oct 20, 2026Oct 20, 2026

• OFFAT

  Public
  The OWASP OFFAT tool autonomously assesses your API for prevalent vulnerabilities, though full compatibility with OAS v3 is pending. The project remains a work …

  owaspapi-restapi-security+ 3

  owaspapi-restapi-securityapi-hackingapi-security-testingoffat

  Python

  •

  MIT License

  •9292 forks in OWASP/OFFAT•675675 stars in OWASP/OFFAT•66 issues in OWASP/OFFAT•00 pull requests in OWASP/OFFAT•Updated Oct 20, 2026Oct 20, 2026

• wrongsecrets

  Public
  Vulnerable app with examples showing how to not use secrets

  javadockerkubernetes+ 17

  javadockerkubernetesawssecurityaiazureterraformgcpsecrets+ 10

  HTML

  •

  GNU Affero General Public License v3.0

  •647647 forks in OWASP/wrongsecrets•1.5k1.5k stars in OWASP/wrongsecrets•1919 issues in OWASP/wrongsecrets•66 pull requests in OWASP/wrongsecrets•Updated Oct 20, 2026Oct 20, 2026

• www-project-agent-memory-guard

  Public
  Runtime defense against memory poisoning in AI agents (OWASP ASI06). Drop-in for LangChain, OpenAI Agents, AutoGen, CrewAI and mem0.

  pythonsecuritymcp+ 17

  pythonsecuritymcpowaspai-safetyai-agentsautogenai-securitylangchainprompt-injection+ 10

  Python

  •

  Apache License 2.0

  •5656 forks in OWASP/www-project-agent-memory-guard•189189 stars in OWASP/www-project-agent-memory-guard•1010 issues in OWASP/www-project-agent-memory-guard•77 pull requests in OWASP/www-project-agent-memory-guard•Updated Oct 20, 2026Oct 20, 2026

• CheatSheetSeries

  Public

  OWASP/CheatSheetSeries’s past year of commit activity
  The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.

  securitycodebest-practices+ 4

  securitycodebest-practicesowaspapplication-securityappseccheatsheets

  JavaScript

  •

  Creative Commons Attribution Share Alike 4.0 International

  •4.7k4.7k forks in OWASP/CheatSheetSeries•34k34k stars in OWASP/CheatSheetSeries•1515 issues in OWASP/CheatSheetSeries•1111 pull requests in OWASP/CheatSheetSeries•Updated Oct 20, 2026Oct 20, 2026

• threat-dragon

  Public
  An open source threat modeling tool from OWASP

  owaspthreat-modelingsdlc+ 2

  owaspthreat-modelingsdlcthreat-dragonowasp-threat-dragon

  JavaScript

  •

  Apache License 2.0

  •411411 forks in OWASP/threat-dragon•1.7k1.7k stars in OWASP/threat-dragon•9393 issues in OWASP/threat-dragon•55 pull requests in OWASP/threat-dragon•Updated Oct 20, 2026Oct 20, 2026

• AISVS

  Public
  The AI Security Verification Standard (AISVS) focuses on providing developers, architects, and security professionals with a structured checklist to verify the …

  aisecurity

  aisecurity

  Creative Commons Attribution Share Alike 4.0 International

  •152152 forks in OWASP/AISVS•558558 stars in OWASP/AISVS•88 issues in OWASP/AISVS•00 pull requests in OWASP/AISVS•Updated Oct 20, 2026Oct 20, 2026

• owasp-java-encoder

  Public
  Contextual output encoding for Java 8+: HTML, JavaScript, CSS, XML and URI components. Zero-dependency core with optional JSP and Jakarta adapters.

  javascriptcssjava+ 7

  javascriptcssjavahtmljspxmlxssowaspjakartaoutput-encoding

  Java

  •

  BSD 3-Clause "New" or "Revised" License

  •130130 forks in OWASP/owasp-java-encoder•547547 stars in OWASP/owasp-java-encoder•11 issue in OWASP/owasp-java-encoder•00 pull requests in OWASP/owasp-java-encoder•Updated Oct 20, 2026Oct 20, 2026

• cve-lite-cli

  Public
  Fast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix, JSON output,…

  nodejsjavascriptfast+ 16

  nodejsjavascriptfastnpmsecurityowaspcybersecurityvulnerabilitycveappsec+ 9

  TypeScript

  •

  MIT License

  •175175 forks in OWASP/cve-lite-cli•771771 stars in OWASP/cve-lite-cli•4747 issues in OWASP/cve-lite-cli•1515 pull requests in OWASP/cve-lite-cli•Updated Oct 20, 2026Oct 20, 2026

• www-project-operational-technology-top-10

  Public
  OWASP Foundation web repository

  Python

  •

  Creative Commons Attribution Share Alike 4.0 International

  •1515 forks in OWASP/www-project-operational-technology-top-10•3030 stars in OWASP/www-project-operational-technology-top-10•55 issues in OWASP/www-project-operational-technology-top-10•22 pull requests in OWASP/www-project-operational-technology-top-10•Updated Oct 20, 2026Oct 20, 2026

• www-project-dungeons-and-daemons

  Public
  This repository contains OWASP Dungeons & Daemons a collection of security games. It's purpose is to promote security awareness and practices.

  Svelte

  •

  Creative Commons Attribution Share Alike 4.0 International

  •44 forks in OWASP/www-project-dungeons-and-daemons•99 stars in OWASP/www-project-dungeons-and-daemons•00 issues in OWASP/www-project-dungeons-and-daemons•11 pull request in OWASP/www-project-dungeons-and-daemons•Updated Oct 20, 2026Oct 20, 2026

• owasp.github.io

  Public
  OWASP Foundation main site repository

  HTML

  •

  Creative Commons Attribution Share Alike 4.0 International

  •323323 forks in OWASP/owasp.github.io•667667 stars in OWASP/owasp.github.io•1212 issues in OWASP/owasp.github.io•99 pull requests in OWASP/owasp.github.io•Updated Oct 20, 2026Oct 20, 2026

• owasp-swag

  Public
  Swag for the OWASP projects and chapters

  Apache License 2.0

  •4444 forks in OWASP/owasp-swag•4444 stars in OWASP/owasp-swag•00 issues in OWASP/owasp-swag•00 pull requests in OWASP/owasp-swag•Updated Oct 20, 2026Oct 20, 2026

• nest-schema

  Public
  OWASP Schema

  pythonschemajson-schema+ 4

  pythonschemajson-schemaowaspmkdocsyaml-schemaowasp-nest

  Python

  •

  MIT License

  •1111 forks in OWASP/nest-schema•77 stars in OWASP/nest-schema•358358 issues in OWASP/nest-schema•22 pull requests in OWASP/nest-schema•Updated Oct 20, 2026Oct 20, 2026

• www-project-api-security-testing-framework

  Public
  OWASP Foundation web repository

  Java

  •

  Apache License 2.0

  •4444 forks in OWASP/www-project-api-security-testing-framework•155155 stars in OWASP/www-project-api-security-testing-framework•2323 issues in OWASP/www-project-api-security-testing-framework•1515 pull requests in OWASP/www-project-api-security-testing-framework•Updated Oct 20, 2026Oct 20, 2026

• www-project-vulnerability-management-guide

  Public
  OWASP Foundation Web Respository

  owaspcybersecurityvulnerability-management

  owaspcybersecurityvulnerability-management

  HTML

  •1010 forks in OWASP/www-project-vulnerability-management-guide•3434 stars in OWASP/www-project-vulnerability-management-guide•00 issues in OWASP/www-project-vulnerability-management-guide•00 pull requests in OWASP/www-project-vulnerability-management-guide•Updated Oct 19, 2026Oct 19, 2026

• FIASSE

  Public
  A Framework for Integrating Application Security into Software Engineering (FIASSE) using the Securable Software Engineering Model (SSEM)

  Python

  •

  Other

  •77 forks in OWASP/FIASSE•1414 stars in OWASP/FIASSE•44 issues in OWASP/FIASSE•11 pull request in OWASP/FIASSE•Updated Oct 19, 2026Oct 19, 2026

• Robotics-Security-Testing-Guide

  Public
  Other

  •00 forks in OWASP/Robotics-Security-Testing-Guide•00 stars in OWASP/Robotics-Security-Testing-Guide•00 issues in OWASP/Robotics-Security-Testing-Guide•00 pull requests in OWASP/Robotics-Security-Testing-Guide•Updated Oct 19, 2026Oct 19, 2026

• www-event-appsecil

  Public
  SCSS

  •1313 forks in OWASP/www-event-appsecil•11 star in OWASP/www-event-appsecil•11 issue in OWASP/www-event-appsecil•11 pull request in OWASP/www-event-appsecil•Updated Oct 19, 2026Oct 19, 2026

• www-chapter-suffolk

  Public
  OWASP Foundation Web Respository

  HTML

  •55 forks in OWASP/www-chapter-suffolk•00 stars in OWASP/www-chapter-suffolk•00 issues in OWASP/www-chapter-suffolk•11 pull request in OWASP/www-chapter-suffolk•Updated Oct 19, 2026Oct 19, 2026

• wrongsecrets-ctf-party

  Public
  Run Capture the Flags and Security Trainings with OWASP WrongSecrets

  gitdockerkubernetes+ 6

  gitdockerkubernetesawssecurityctftraining-materialsctfdhacktoberfest

  JavaScript

  •

  Apache License 2.0

  •180180 forks in OWASP/wrongsecrets-ctf-party•5959 stars in OWASP/wrongsecrets-ctf-party•22 issues in OWASP/wrongsecrets-ctf-party•33 pull requests in OWASP/wrongsecrets-ctf-party•Updated Oct 19, 2026Oct 19, 2026

• secure-headers-project

  Public
  The OWASP Secure Headers Project

  httpsecurityweb+ 4

  httpsecuritywebowaspsecureheadersappsec

  Python

  •

  Apache License 2.0

  •4747 forks in OWASP/secure-headers-project•220220 stars in OWASP/secure-headers-project•11 issue in OWASP/secure-headers-project•00 pull requests in OWASP/secure-headers-project•Updated Oct 19, 2026Oct 19, 2026