Top 23 JavaScript Devsecops Projects

Devsecops

• Add a project

1. Mobile-Security-Framework-MobSF

   1 7 21,958 7.9 JavaScript

   Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

   

2. AppSignal

   www.appsignal.com sponsored

   AppSignal knows why the f*#k it crashed. Stop vibe-debugging. Every exception, every backtrace, grouped so you see patterns, not noise.

   

3. reconmap

   2 4 1,000 9.2 JavaScript

   Reconmap is a collaboration-first security operations platform for infosec teams and MSSPs, enabling end‑to‑end engagement management, from reconnaissance through execution and reporting. With built-in command automation, output parsing, and AI‑assisted summaries, it delivers faster, more structured, and high‑quality security assessments.

   

4. github-actions-goat

   3 7 519 5.4 JavaScript

   GitHub Actions Goat: Deliberately Vulnerable GitHub Actions CI/CD Environment

   

5. njsscan

   4 2 436 6.2 JavaScript

   njsscan is a semantic aware SAST tool that can find insecure code patterns in your Node.js applications.

   

6. action-baseline

   5 1 372 6.6 JavaScript

   A GitHub Action for running the ZAP Baseline scan

   

   Project mention: Shift-Left API Security: CI/CD Testing, Contract Tests, and Fuzzing | dev.to | 2026-10-12

   zaproxy/action-baseline (OWASP ZAP) GitHub - GitHub Action for running ZAP baseline scans as part of CI and attaching reports/issues.

7. qodana-action

   6 2 312 8.3 JavaScript

   ⚙️ Scan your Go, Java, Kotlin, PHP, Python, JavaScript, TypeScript, .NET projects at GitHub with Qodana. This repository contains Qodana for Azure, GitHub, CircleCI and Gradle

   

8. tokentimer-core

   7 1 49 9.4 JavaScript

   The self-hosted token, certificate, license, and secret expiration manager with automated Certificate Lifecycle Management (CertOps) for teams.

   

   Project mention: tokentimer-core VS certifytheweb - a user suggested alternative | libhunt.com/r/tokentimer-core | 2026-08-13

9. SaaSHub

   www.saashub.com sponsored

   SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

   

10. pre-production-checklist

    8 1 15 8.9 JavaScript

    Pre-production checklists for solo founders. 4,394 items, 87% portable to any stack, 26 stack supplements — plus AI/agent security and the bugs AI coding assistants actually write.

    

    Project mention: The most useful word my checklist prints is UNKNOWN | dev.to | 2026-09-12

11. secure-sdlc-agents

    9 10 13 7.5 JavaScript

    A team of Claude Code sub-agents that enforce security across the full SDLC, from ASVS requirements and threat modelling to SAST triage, IaC review, compliance attestation and release sign-off. Drop into any project. No security team required.

    

    Project mention: Multiple LLM Providers Explained: One API Key for Node.js Classification | dev.to | 2026-10-04

12. applied-security

    10 3 6 10.0 JavaScript

    A curated collection of publicly available resources on how technology and tech-savvy organizations around the world practice Cybersecurity

    

13. npm-security-score

    11 1 3 6.1 JavaScript

    World-class security standard for npm packages. Automated threat detection, supply chain analysis, and 0-100 security scores. Because in 2025, we can do better than the Wild West

    

    Project mention: NPM = Wild Wild West: It's Time to Stop the Madness | dev.to | 2025-11-29

    → GitHub: github.com/01tek/npm-security-score → Contribute: Help build the security standard npm deserves → Spread the word: Share this with every JavaScript developer you know

14. thr8

    12 2 3 8.2 JavaScript

    Automatically generate PASTA threat models from your repo using Claude AI.

    

    Project mention: Thr8 – GitHub Action that auto-generates PASTA threat models from your codebase | news.ycombinator.com | 2026-03-09

15. rugsnare

    13 1 3 8.9 JavaScript

    Pin MCP tool contracts, catch silent drift. Field audit of the npm MCP top: 218 silent contract changes (Microsoft, Google, Hostinger included) - receipts and weekly CI watch inside

    

    Project mention: We diffed all 66 release pairs of the official MCP servers, 140 silent changes | news.ycombinator.com | 2026-10-03

16. jev-sec-audit

    14 1 3 4.6 JavaScript

    Lightning-fast AI supply chain security auditor using Jev (System 1 models). Catch typosquatting and malicious scripts in milliseconds.

    

    Project mention: Introducing jev-sec-audit | dev.to | 2026-09-23

    Drop a ⭐️ on the GitHub Repository if you find this useful and let me know in the comments what features you'd like to see next!

17. taskbounty-check

    15 1 2 7.0 JavaScript

    Local-only GitHub Actions and CI maintenance check for AI-built apps.

    

    Project mention: How I added a zero-upload GitHub Actions check to a real repository | dev.to | 2026-06-21

    git clone https://github.com/eliottreich/taskbounty-check.git cd taskbounty-check npx -y taskbounty-check@0.1.6 . --dry-run

18. docker-nginx-react-kubernetes-fullstack

    16 1 2 6.5 JavaScript

    A demo production-ready Full Stack E-commerce platform built with React, Node.js, and Microservices. Features a complete DevOps lifecycle including Docker, Kubernetes, CI/CD (Jenkins/GitHub Actions), and ArgoCD for GitOps.

    

    Project mention: 🚀 My DevOps Journey: From Learning to Building on AWS with Containers | dev.to | 2026-01-07

    GitHub repo : https://github.com/devopsexpertlearning/docker-nginx-react-kubernetes-fullstack

19. muraqib

    17 1 2 7.8 JavaScript

    Nightly Playwright QA that tells you when it stops watching. npx muraqib doctor finds the silent-cancel bug in any existing setup. Claude opens the fix PR. MIT, no hosted service.

    

    Project mention: Muraqib, free nightly QA that lets Claude open a fix PR when tests fail | news.ycombinator.com | 2026-08-29

20. nhost-security-skill

    18 1 1 - JavaScript

    Open-source Hasura/Nhost security auditor: detects anonymous role with open SELECT, user role missing row filter, public introspection. Active anonymous GraphQL probe confirms each leak.

    

    Project mention: I shipped 5 BaaS security auditors in one day — keyless `npx --discover` mode for Supabase, PocketBase, Appwrite, Firebase, and Nhost | dev.to | 2026-05-11

    nhost-security: github · npm

21. firebase-security-skill

    19 1 1 - JavaScript

    Open-source Firebase Firestore Rules auditor: detects 'match /{document=**} if true', expired test-mode rules, auth-without-ownership. Active probe sends anonymous GET to confirm leaks.

    

    Project mention: I shipped 5 BaaS security auditors in one day — keyless `npx --discover` mode for Supabase, PocketBase, Appwrite, Firebase, and Nhost | dev.to | 2026-05-11

    firebase-security: github · npm

22. nono-gate

    20 1 1 6.7 JavaScript

    Deterministic CI/CD security governance architecture for provable and replay-verifiable release decisions

    

    Project mention: Nono-Gate: Deterministic Offline-Verifiable Security Decisions for CI | news.ycombinator.com | 2026-03-16

23. agent-control

    21 10 1 8.2 JavaScript

    Runtime authorization infrastructure for AI agents. Every tool call, API action, and credential request is evaluated against identity, policy, and context before execution — and recorded in a hash-chained audit trail. Apache 2.0, zero runtime deps, Node + Python. (by CIRVIX)

    

    Project mention: Audit Logs for AI Coding Agents: What to Record, Where to Collect It, and What It Proves | dev.to | 2026-10-11

    Cirvix AgentControl is an open-source authorization layer that evaluates governed tool calls (via its MCP gateway, Claude Code hook, or SDK wrappers) and, when an audit sink is configured, writes each decision to a local hash-chained JSONL file. Be clear on scope: it records authorisation, not successful execution; the Node SDK persists nothing unless you supply an audit sink (Python uses an on_decision callback); and calls that bypass the governed path are not in the log. A local chain is not independent compliance evidence on its own.

24. pocketbase-security-skill

    22 1 1 - JavaScript

    Open-source PocketBase security auditor: detects empty rules, the @request.auth.id != trap, true literals. Active probe confirms leaks live.

    

    Project mention: I shipped 5 BaaS security auditors in one day — keyless `npx --discover` mode for Supabase, PocketBase, Appwrite, Firebase, and Nhost | dev.to | 2026-05-11

    pocketbase-security: github · npm

25. agentguard-vscode

    23 1 0 6.8 JavaScript

    AgentGuard VS Code extension — inline agent security diagnostics as you type

    

    Project mention: AgentGuard: Open-Source Security Scanning for AI Agent Code | dev.to | 2026-06-28

    Inline diagnostics, scan-on-save, and a findings tree view. Available as a VSIX on the releases page.

26. SaaSHub

    www.saashub.com sponsored

    SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

    

JavaScript Devsecops related posts

• I scanned 8 popular npm projects for quantum-vulnerable cryptography. Here's what I found.

  2 projects | dev.to | 1 Apr 2026

• Thr8 – GitHub Action that auto-generates PASTA threat models from your codebase

  1 project | news.ycombinator.com | 9 Mar 2026

• Show HN: GitHub Actions Goat – Deliberately Vulnerable CI/CD Environment

  1 project | news.ycombinator.com | 17 Jul 2023

• Attack Simulator for SolarWinds, Codecov, and ua-parser-js breaches

  3 projects | /r/redteamsec | 14 Nov 2022

• applied-security: A collection of publicly available resources on how technology and tech-savvy organizations around the world practice Cybersecurity.

  1 project | /r/CKsTechNews | 7 Nov 2022

• Applied Security

  1 project | news.ycombinator.com | 6 Nov 2022

• ThreatMapper – open-source cloud native security observability platform

  1 project | news.ycombinator.com | 5 Oct 2022
• A note from our sponsor - AppSignal
  www.appsignal.com | 15 Oct 2026

  Stop vibe-debugging. Every exception, every backtrace, grouped so you see patterns, not noise. Learn more →

Index

Sponsored

AppSignal knows why the f*#k it crashed.

Stop vibe-debugging. Every exception, every backtrace, grouped so you see patterns, not noise.

www.appsignal.com

Do not miss the trending JavaScript projects with our weekly report!