SecureStackCo / actions-sbomLinks
A GitHub Action that creates a SBOM from your application so you can meet compliance and security requirements. Add this to your dev, staging and prod steps and SecureStack will make sure that what you've just deployed is secure and meets your requirements, and has the SBOM to show it!
☆24Updated last year
Alternatives and similar repositories for actions-sbom
Users that are interested in actions-sbom are comparing it to the libraries listed below
Sorting:
- 🖇️ STRIDE vs. ASVS equivalence table☆76Updated 9 months ago
- Tools that checks for misconfigured access to Github OIDC from AWS roles and GCP service accounts☆61Updated 2 years ago
- HashiCorp-relevant rules for the Semgrep code analysis tool☆41Updated last year
- Simple Command Line Tool to Enumerate Slack Workspace Names from Slack Webhook URLs.☆41Updated last year
- Clean accounts over permissions in GCP infra at scale☆71Updated 2 years ago
- A project to visualize the software supply chain☆52Updated last year
- Protect against subdomain takeover☆92Updated last year
- ☆111Updated last year
- Compares and analyzes GCP IAM roles.☆77Updated 2 months ago
- Nextdoor's Cloud Security Posture Management (CSPM) Evaluation Matrix☆58Updated last year
- SecureStack Application Bill of Materials (ABOM/SBOM)☆13Updated 2 years ago
- A security tool designed to help review merged code changes to open source maintained repositories via LLM assisted review to safeguard a…☆30Updated 7 months ago
- ☆49Updated 2 years ago
- A meta-database collecting resources that compile lists of breaches☆20Updated 7 months ago
- TrailAlerts is a AWS-native, serverless cloud-detection tool that lets you define simple rules as code and get rich alerts about events i…☆41Updated last month
- ☆68Updated 3 weeks ago
- Maturity Model Collaborative project☆15Updated 2 years ago
- Threat Modeling Manifesto☆28Updated 10 months ago
- Semgrep rules corresponding to the OWASP ASVS standard☆27Updated 4 years ago
- DustiLock is a tool to find which of your dependencies is susceptible to a Dependency Confusion attack.☆38Updated 3 years ago
- Example repository for GitHub Actions Time of Check to Time of Use (TOCTOU vulnerabilities)☆23Updated last month
- ☆63Updated 2 years ago
- ☆112Updated last week
- A CLI that scans for sensitive data in source code☆14Updated 2 years ago
- A public cloud security knowledgebase - https://www.secwiki.cloud/☆51Updated 6 months ago
- Convert cloudtrail data to MITRE ATT&CK Sightings☆80Updated 2 years ago
- Scans every git push to your Github organisations to find unwanted secrets.☆87Updated last month
- Easy-to-use Threat modeling-as-a-Code (TaaC) solution following DevSecOps principles. Simple CI/CD integration as well as console usage. …☆65Updated 11 months ago
- 🧪 Correlate Semgrep scans with Python test coverage to prioritize SAST findings and get bug fix suggestions via a self-hosted LLM.☆39Updated 5 months ago
- ☆183Updated last month