Appsec Python Packages

devicecheck

Reduce fraudulent use of your services by managing device state and asserting app integrity via Apple DeviceCheck API with this Python wrapper.

libsast

Generic SAST Library

njsscan

njsscan is a semantic aware SAST tool that can find insecure code patterns in your Node.js applications.

mobsfscan

mobsfscan is a static analysis tool that can find insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Swift, and Objective C Code. mobsfscan uses MobSF static analysis rules and is powered by semgrep and libsast pattern matcher.

sqlmap

Automatic SQL injection and database takeover tool

ca9

CA9 is a local evidence engine for Python AppSec triage. It sits after scanners and before engineers waste time, proving which findings matter.

badsecrets

A library for detecting known secrets across many web frameworks

dirsearch

Web path scanner

pyaim

@CyberArk Application Access Manager Client Library for Python 3

nuguard

opensource repo for NuGuard

openziti

Ziti SDK for Python

oss-policy-kit

Policy-as-code starter kit for OSS repository governance and CI/CD hygiene across GitHub, Azure, and AWS.

deadwood-sec

A self-hosted, leveled web-security range (tutorial → impossible) — the practice town for wraith & hickok. Intentionally vulnerable; localhost only.

apisec-ai-surface

Find and govern AI attack surfaces in application code at PR time. Free, OSS, runs offline.

faradaysec

Open Source Vulnerability Management Platform

safeurl-python

Python implementation of SafeURL (Anti-SSRF Lib)

bluerock-oss

Runtime visibility for Python MCP servers. Captures tool calls, session lifecycle, module imports (SHA-256), and subprocess execution as structured NDJSON. No code changes.

codeaudit

Codeaudit - Modern Python source code security analyzer based on distrust.

gitgalaxy

An AST-free, LLM-free heuristic knowledge graph engine for deep repository intelligence. Map, secure, and modernize enterprise codebases across 50+ languages at extreme velocity

deglyph

A terminal tool for reading native binaries, also scans for secrets and CVEs in CI.

sentinel-scanner

Sentinel is a developer-first CLI tool that finds security vulnerabilities in Python projects and provides AI-powered fixes - all in an interactive terminal dashboard.

secure-sdlc-evidence-collector

CLI-first tool to collect, normalize, evaluate and bundle Secure SDLC evidence per release.

argus-agent

Agentic threat modeling workflow using Google ADK to turn PRDs, design docs, and RFCs into STRIDE-categorized, OWASP-rated threat model reports.

cryptonice

Perform TLS scan of a domain