GitHub 安全专题榜

Name: GitHub 安全榜：星数最高的开源项目
Creator: GitHub

GITHUB专题榜

这个专题下星数最高的开源项目，按总星数排序。专题是按项目自己标的 topic 归类的，一个项目可能同时属于几个专题；星数说明「这个领域里谁最有分量」，想找「最近在涨」的看趋势榜或增长榜。

本榜项目数 78 个项目 数据日期 2026-10-28 23:48:41

本榜项目数 78 安全领域里星数最高的 78 个开源项目，按总星数排序

排名依据 与 GitHub 趋势页顺序一致 名次不按新增星数重排，星数与简介按 GitHub 原样列出

数据日期 2026-10-28 23:48:41 这批榜单数据是哪一天的

安全热门项目完整榜

78 个项目

安全领域里星数最高的 78 个开源项目，按总星数排序

排名	项目	语言	Stars	Fork	7 日增长	创建	操作
1	trimstray/the-book-of-secret-knowledge A collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools and more. awesomeawesome-listbsd	未标注	253,937	14,653	—	2018-06-23	查看详情 ›
2	Hack-with-Github/Awesome-Hacking A collection of various awesome lists for hackers, pentesters and security researchers androidawesomebug-bounty	未标注	123,868	10,889	—	2016-03-30	查看详情 ›
3	Developer-Y/cs-video-courses List of Computer Science courses with video lectures. algorithmsbioinformaticscomputational-biology	未标注	84,092	11,538	—	2016-10-22	查看详情 ›
4	swisskyrepo/PayloadsAllTheThings A list of useful payloads and bypass for Web Application Security and Pentest/CTF bountybugbountybypass	Python	82,164	17,520	—	2016-10-18	查看详情 ›
5	caddyserver/caddy Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS acmeautomatic-httpscaddy	Go	78,517	5,200	—	2015-01-14	查看详情 ›
6	usestrix/strix Open-source AI penetration testing tool to find and fix your app’s vulnerabilities. agentsai-hackingai-penetration-testing	Python	72,487	8,120	—	2025-08-06	查看详情 ›
7	x64dbg/x64dbg An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis. binary-analysisctfcybersecurity	C++	50,063	2,894	—	2015-04-12	查看详情 ›
8	KeygraphHQ/shannon Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production. ai-penetration-testingai-securityapi-security	TypeScript	50,000	5,732	—	2025-09-27	查看详情 ›
9	mitmproxy/mitmproxy An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers. debugginghttphttp2	Python	46,446	4,897	—	2010-02-16	查看详情 ›
10	GyulyVGC/sniffnet Comfortably monitor your network traffic 🕵️‍♂️ appapplicationcybersecurity	Rust	41,719	1,938	—	2022-08-01	查看详情 ›
11	The-Vibe-Company/quivr An open-source engine that turns continuous content streams into search and monitoring. Durable ingestion, hybrid search, alerts, and plugins for formats, models and business rules. aiapichatbot	Go	39,611	3,732	—	2023-05-13	查看详情 ›
12	aquasecurity/trivy Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more containersdevsecopsdocker	Go	38,811	806	—	2019-04-11	查看详情 ›
13	lissy93/web-check 🕵️‍♂️ All-in-one OSINT tool for analysing any website osintprivacysecurity	TypeScript	35,280	2,914	—	2023-06-25	查看详情 ›
14	mukul975/Anthropic-Cybersecurity-Skills 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0 ai-agentsclaude-codecloud-security	Python	35,177	4,288	—	2026-02-25	查看详情 ›
15	OWASP/CheatSheetSeries The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics. application-securityappsecbest-practices	JavaScript	33,772	4,699	—	2018-12-21	查看详情 ›
16	projectdiscovery/nuclei Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations. attack-surfacecve-scannerdast	Go	32,398	3,954	—	2020-04-04	查看详情 ›
17	nginx/nginx The official NGINX Open Source repository. content-cachehttphttp2	C	31,993	8,334	—	2015-06-23	查看详情 ›
18	imthenachoman/How-To-Secure-A-Linux-Server An evolving how-to guide for securing a Linux server. cc-by-sahardeninghardening-steps	未标注	31,959	2,163	—	2019-02-09	查看详情 ›
19	StevenBlack/hosts 🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories. ad-blockeranti-viruscurated-sources	Python	31,333	2,444	—	2012-04-13	查看详情 ›
20	trailofbits/algo Set up a personal VPN in the cloud ansibleencryptionikev2	Python	30,444	2,369	—	2016-05-15	查看详情 ›
21	gitleaks/gitleaks Find secrets with Gitleaks 🔑 ai-poweredci-cdcicd	Go	30,440	2,320	—	2018-01-28	查看详情 ›
22	Infisical/infisical Infisical is the open-source platform for securing secrets, certificates, access, and AI Agents. acmeagentsai-agents	TypeScript	30,087	2,389	—	2022-08-05	查看详情 ›
23	community-scripts/ProxmoxVE Proxmox VE Helper-Scripts (Community Edition) alpineauthentificationcontainer	Shell	29,954	2,937	—	2024-11-01	查看详情 ›
24	keepassxreboot/keepassxc KeePassXC is a cross-platform community-driven port of the Windows application “KeePass Password Safe”. cross-platformhacktoberfestkeepass	C++	29,567	1,985	—	2016-02-28	查看详情 ›
25	authelia/authelia The Single Sign-On Multi-Factor portal for web apps. OpenID Certified™ and Post-Quantum Cryptography Ready. 2faauthenticationdocker	Go	29,431	1,531	—	2016-12-07	查看详情 ›
26	hwdsl2/setup-ipsec-vpn Set up your own IPsec VPN server in just a few minutes, with IPsec/L2TP, Cisco IPsec and IKEv2. Supports Ubuntu, Debian, CentOS/RHEL, Alpine Linux and Raspberry Pi OS. Includes client config and management scripts. alpine-linuxbashcisco-ipsec	Shell	28,881	6,525	—	2016-01-08	查看详情 ›
27	trufflesecurity/trufflehog Find, verify, and analyze leaked credentials credentialsdevsecopsdynamic-analysis	Go	28,752	2,673	—	2016-12-31	查看详情 ›
28	digitalocean/nginxconfig.io ⚙️ NGINX config generator on steroids 💉 cdndigitaloceandigitalocean-community-tools	JavaScript	28,256	2,029	—	2018-01-05	查看详情 ›
29	OpenZeppelin/openzeppelin-contracts OpenZeppelin Contracts is a library for secure smart contract development. ethereumevmsecurity	Solidity	27,335	12,426	—	2016-08-02	查看详情 ›
30	goauthentik/authentik The authentication glue you need. authenticationauthentikauthorization	Python	26,155	2,095	—	2019-12-30	查看详情 ›
31	cilium/cilium eBPF-based Networking, Security, and Observability bpfcncfcni	Go	25,727	4,195	—	2015-12-16	查看详情 ›
32	radareorg/radare2 UNIX-like reverse engineering framework and command-line toolset binary-analysisccommandline	C	25,195	3,386	—	2012-07-03	查看详情 ›
33	TecharoHQ/anubis Weighs the soul of incoming HTTP requests to stop AI crawlers defensesecurity	Go	23,770	796	—	2025-03-18	查看详情 ›
34	osquery/osquery SQL powered operating system instrumentation, monitoring, and analytics. hacktoberfestintrusion-detectionmonitoring	C++	23,697	2,628	—	2014-07-30	查看详情 ›
35	getsops/sops Simple and flexible tool for managing secrets awsazuredevops	Go	23,544	1,109	—	2015-08-14	查看详情 ›
36	slimtoolkit/slim Slim(toolkit): Don't change anything in your container image and minify it by up to 30x (and for compiled languages even more) making it secure too! (free and open source) apparmorcontainersdocker	Go	23,485	851	—	2015-09-10	查看详情 ›
37	shieldfy/API-Security-Checklist Checklist of the most important security countermeasures when designing, testing, and releasing your API apijwtoauth2	未标注	23,337	2,646	—	2017-07-09	查看详情 ›
38	chaitin/SafeLine SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits. api-gatewayapplication-securityappsec	Go	23,065	1,581	—	2023-04-12	查看详情 ›
39	lissy93/personal-security-checklist 🔒 A compiled checklist of 300+ tips for protecting digital security and privacy in 2026 awesomeawesome-listcensorship	TypeScript	22,648	1,471	—	2018-03-03	查看详情 ›
40	drduh/macOS-Security-and-Privacy-Guide Community guide to securing and improving privacy on macOS. applechecklistdisk-encryption	Shell	22,566	1,470	—	2015-08-31	查看详情 ›
41	twpayne/chezmoi Manage your dotfiles across multiple diverse machines, securely. configurationdotfiledotfile-management	Go	22,091	698	—	2018-11-13	查看详情 ›
42	matomo-org/matomo Empowering People Ethically 🚀 — Matomo is hiring! Join us → https://matomo.org/jobs Matomo is the leading open-source alternative to Google Analytics, giving you complete control and built-in privacy. Easily collect, visualise, and analyse data from websites & apps. Star us on GitHub ⭐️ – Pull Requests welcome! analyticsgrowthhacktoberfest	PHP	21,984	2,921	—	2011-03-31	查看详情 ›
43	Atlas-OS/Atlas 🚀 An open and lightweight modification to Windows, designed to optimize performance, privacy and usability. ame-wizardatlasatlasos	Batchfile	21,945	774	—	2021-02-08	查看详情 ›
44	FallibleInc/security-guide-for-developers Security Guide for Developers apibookssecurity	未标注	21,101	1,568	—	2016-06-08	查看详情 ›
45	gravitational/teleport The easiest, and most secure way to access and protect all of your infrastructure. auditbastioncertificate	Go	21,039	2,183	—	2015-03-03	查看详情 ›
46	ImranR98/Obtainium Get Android app updates straight from the source. androidapkapk-update	Dart	20,969	662	—	2022-08-11	查看详情 ›
47	bee-san/RustScan 🤖 The Modern Port Scanner 🤖 dockerhackinghacktoberfest	Rust	20,633	1,395	—	2020-07-12	查看详情 ›
48	eosphoros-ai/DB-GPT open-source agentic AI data assistant for the next generation of AI + Data products. agentsbgidatabase	Python	20,210	2,994	—	2023-04-13	查看详情 ›
49	bettercap/bettercap The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks. bledeauthentication-attackdot11	Go	20,209	1,734	—	2018-01-07	查看详情 ›
50	rizinorg/cutter Free and Open Source Reverse Engineering Platform powered by rizin cutterdebuggergui	C++	20,111	1,527	—	2017-09-25	查看详情 ›
51	simplex-chat/simplex-chat SimpleX - the first messaging network operating without user identifiers of any kind - 100% private by design! iOS, Android and desktop apps 📱! chatdouble-ratchete2ee	Haskell	19,608	1,318	—	2019-12-21	查看详情 ›
52	fail2ban/fail2ban Daemon to ban hosts that cause multiple authentication errors anti-botattack-preventionban-hosts	Python	18,900	1,509	—	2011-09-29	查看详情 ›
53	ory/hydra Internet-scale OpenID Certified™ OpenID Connect and OAuth2.1 provider that integrates with your user management through headless APIs. Solve OIDC/OAuth2 user cases over night. Consume as a service on Ory Network or self-host. Trusted by OpenAI and many others for scale and security. Written in Go. authorizationclouddocker	Go	17,635	1,618	—	2015-05-22	查看详情 ›
54	cure53/DOMPurify DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo: cross-site-scriptingdomdompurify	JavaScript	17,491	882	—	2014-02-18	查看详情 ›
55	wazuh/wazuh Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads. cloud-securitycomplianceconfiguration-assessement	C++	17,475	2,566	—	2015-08-12	查看详情 ›
56	cryptomator/cryptomator Cryptomator for Windows, macOS, and Linux: Secure client-side encryption for your cloud storage, ensuring privacy and control over your data. cloud-storagecryptocryptography	Java	16,375	1,494	—	2014-02-02	查看详情 ›
57	winsiderss/systeminformer A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc. @ https://windows-internals.com administratorbenchmarkingdebugger	C	16,356	1,811	—	2016-02-01	查看详情 ›
58	javascript-obfuscator/javascript-obfuscator A powerful obfuscator for JavaScript and Node.js browsercontrol-flowcryptography	TypeScript	16,319	1,743	—	2016-05-09	查看详情 ›
59	zaproxy/zaproxy The ZAP by Checkmarx Core project appsecdasthacktoberfest	Java	16,059	2,684	—	2015-06-04	查看详情 ›
60	mvt-project/mvt MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise. androidforensicsforensics-tools	Python	15,588	1,507	—	2021-07-16	查看详情 ›
61	crowdsecurity/crowdsec Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs. anti-botblocklistbot-detection	Go	15,358	755	—	2020-05-15	查看详情 ›
62	prowler-cloud/prowler This repo hosts Prowler OSS (CLI and Local Server). Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment for Humans and AI Agents. awsazurecis-benchmark	Python	15,115	2,462	—	2016-08-24	查看详情 ›
63	sbilly/awesome-security A collection of awesome software, libraries, documents, books, resources and cools stuffs about security. awesome-listsecurity	未标注	15,045	2,451	—	2014-08-22	查看详情 ›
64	maurosoria/dirsearch Web path scanner appsecbrutebug-bounty	Python	15,019	2,458	—	2013-04-30	查看详情 ›
65	wifiphisher/wifiphisher The Rogue Access Point Framework access-pointattackmalware	Python	14,927	2,747	—	2014-09-26	查看详情 ›
66	OpenVPN/openvpn OpenVPN is an open source VPN daemon securityvpn	C	14,737	3,423	—	2012-04-27	查看详情 ›
67	shadow1ng/fscan 一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning) fscanscannerscanning	Go	14,723	1,954	—	2020-11-14	查看详情 ›
68	bytebase/bytebase Database governance built for humans and agents — controlling changes and access across every major database. cicddata-governancedata-masking	Go	14,651	1,007	—	2021-01-27	查看详情 ›
69	Hacker0x01/hacker101 Source code for Hacker101.com - a free online web and mobile security class. clickjackingcsrfeducation	SCSS	14,594	2,663	—	2017-11-28	查看详情 ›
70	gophish/gophish Open-Source Phishing Toolkit golanggophishphishing	Go	14,351	2,987	—	2013-11-19	查看详情 ›
71	trimstray/nginx-admins-handbook How to improve NGINX performance, security, and other important things. best-practicescheatsheethacks	Shell	14,335	1,138	—	2019-01-28	查看详情 ›
72	juice-shop/juice-shop OWASP Juice Shop: Probably the most modern and sophisticated insecure web application 24pullrequestsapplication-securityappsec	TypeScript	14,269	20,306	—	2014-09-19	查看详情 ›
73	evilsocket/opensnitch OpenSnitch is a GNU/Linux interactive application firewall inspired by Little Snitch. application-firewalldata-breachfirewall	Python	14,222	681	—	2017-04-16	查看详情 ›
74	qazbnm456/awesome-web-security 🐶 A curated list of Web Security materials and resources. awesomeawesome-listlist	Python	13,969	1,841	—	2017-01-30	查看详情 ›
75	digininja/DVWA Damn Vulnerable Web Application (DVWA) dvwahackinginfosec	PHP	13,911	5,232	—	2013-05-01	查看详情 ›
76	nmap/nmap Nmap - the Network Mapper. Github mirror of official SVN repository. asynchronousc-plus-pluslibpcap	C	13,895	2,955	—	2012-03-09	查看详情 ›
77	zoicware/RemoveWindowsAI Force Remove Copilot, Recall and More in Windows 11 aiai-blockeranti-ai	PowerShell	13,518	474	—	2024-06-07	查看详情 ›
78	Tencent/secguide 面向开发人员梳理的代码安全指南 guidesecurity	未标注	13,440	1,940	—	2021-05-18	查看详情 ›