Top 4 Java Devsecops Projects

dependency-track

18 2,329 9.8 Java

Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.

Project mention: Show HN: Pre-alpha tool for analyzing spdx SBOMs generated by GitHub | news.ycombinator.com | 2024-04-21

I've become interested in SBOM recently, and found there were great tools like https://dependencytrack.org/ for CycloneDX SBOMs, but all I have is SPDX SBOMs generated by GitHub.
I decided to have a go at writing my own dependency track esque tool aiming to integrate with the APIs GitHub provides.
It's pretty limited in functionality so far, but can give a high level summary of the types of licenses your repository dependencies use, and let you drill down into potentially problematic ones.
Written in NextJS + mui + sqlite, and using another project of mine to generate most of the API boilerplate/glue (https://github.com/mnahkies/openapi-code-generator)

wrongsecrets

3 1,117 9.8 Java

Vulnerable app with examples showing how to not use secrets

Project mention: How to Not Use Secrets | news.ycombinator.com | 2023-12-03

WorkOS

workos.com sponsored

The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.
akto

2 823 9.9 Java

Proactive, Open source API security → API discovery, Testing in CI/CD, Test Library with 150+ Tests, Add custom tests, Sensitive data exposure

Project mention: Open source vulnerability scanner | /r/cybersecurity | 2023-12-05

Qualys is good. For open source vulnerability scanner for APIs - you can also try https://github.com/akto-api-security/akto

aegis4j

8 14 4.5 Java

A Java agent that disables platform features you don't use, before an attacker uses them against you.

NOTE: The open source projects on this list are ordered by number of github stars. The number of mentions indicates repo mentiontions in the last 12 Months or since we started tracking (Dec 2020).