SaaSHub helps you find the best software and product alternatives Learn more →
Top 10 Java security-tool Projects
-
Project mention: OWASP Faction 1.7 released- Pentest management platform for enterprise teams | news.ycombinator.com | 2025-10-27
Built for enterprise security teams and consulting firms managing dozens or hundreds of assessments simultaneously. We’ve focused on reducing administrative overhead so security teams can spend more time finding vulnerabilities.
GitHub: https://github.com/factionsecurity/faction
-
AppSignal
AppSignal knows why the f*#k it crashed. Stop vibe-debugging. Every exception, every backtrace, grouped so you see patterns, not noise.
-
steady
Analyses your Java applications for open-source dependencies with known vulnerabilities, using both static analysis and testing to determine code context and usage for greater accuracy. https://eclipse.github.io/steady/
-
-
magpie
A Cloud Security Posture Manager or CSPM with a focus on security analysis for the modern cloud stack and a focus on the emerging threat landscape such as cloud ransomware and supply chain attacks. (by openraven)
-
Project mention: Ask HN: Is anyone else preparing for the EU Cyber Resilience Act? | news.ycombinator.com | 2026-09-02
Check ReARM we're building for durable tracking of releases, software updates and fulfilling 10+ years obligations - https://rearmhq.com
-
JWTLens
JWTLens - Burp Suite extension for automated JWT security testing. 62 checks: passive scanning, algorithm confusion, signature bypass, KID injection, weak secret brute force, and a built-in JWT Forge tab. Works automatically as you browse.
Project mention: I Built JWTLens: A Burp Suite Extension to Detect JWT Security Weaknesses | dev.to | 2026-03-18Repo URL
-
-
SaaSHub
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
-
owasp-zap-fileupload-addon
OWASP ZAP add-on for finding vulnerabilities in File Upload functionality.
-
-
spring-config-guard
Security linter for Spring Boot config file, catches misconfigurations before deployment, gates your CI build.
I maintain spring-config-guard, a static-analysis CLI that reads application.yml/.properties files and reports security misconfigurations: exposed Actuator endpoints, hardcoded credentials, unencrypted Kafka, and so on. A linter like this is only as good as its model of how Spring Boot resolves configuration. If the model is wrong, it reports risks that don't exist, or misses ones that do.
NOTE:
The open source projects on this list are ordered by number of github stars.
The number of mentions indicates repo mentiontions in the last 12 Months or
since we started tracking (Dec 2020).
Java security-tools discussion
Java security-tools related posts
-
Do you use dependency analysis and vulnerability detection tools?
-
CSPM opensource suggestions
-
Vulnerabilities and fixes management tool(s) ?
-
Magpie – OSS CSPM and non-native service enumeration
-
Magpie – Open-Source CSPM
-
PLEASE HELP - I have $700k+ worth of doge coin stuck on an android wallet...
-
A note from our sponsor - SaaSHub
www.saashub.com | 15 Oct 2026
Index
What are some of the best open-source security-tool projects in Java? This list will help you:
| # | Project | Stars |
|---|---|---|
| 1 | faction | 605 |
| 2 | steady | 547 |
| 3 | stringcare-android | 257 |
| 4 | magpie | 204 |
| 5 | rearm | 127 |
| 6 | JWTLens | 55 |
| 7 | owasp-zap-jwt-addon | 41 |
| 8 | owasp-zap-fileupload-addon | 24 |
| 9 | action-maven-publish | 1 |
| 10 | spring-config-guard | 0 |
Sponsored
AppSignal knows why the f*#k it crashed.
Stop vibe-debugging. Every exception, every backtrace, grouped so you see patterns, not noise.
www.appsignal.com