Stop vibe-debugging. Every exception, every backtrace, grouped so you see patterns, not noise. Learn more →
Top 23 JavaScript Security Projects
-
-
Kargo
Stop Scripting Promotions. Start Shipping with Kargo. Kargo automates promotion across dev, staging, and prod with approval gates and verification. Open source, built by the team behind Argo CD. Download now.
-
DOMPurify
DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:
Project mention: How svgin-react renders SVGs as real, styleable elements without the XSS risk | dev.to | 2026-09-04Sanitize before anything touches the DOM. Strip script, strip event handler attributes, strip javascript:/data: URIs, keep the drawing instructions. DOMPurify already does this well and ships an SVG profile:
-
nuclei-templates
Community curated list of templates for the nuclei engine to find security vulnerabilities.
- [nuclei](https://github.com/projectdiscovery/nuclei): A fast and customizable vulnerability scanner based on simple YAML based DSL. - [nuclei-templates](https://github.com/projectdiscovery/nuclei-templates): Community curated list of templates for the nuclei engine to find security vulnerabilities. - [subfinder](https://github.com/projectdiscovery/subfinder): A fast passive subdomain enumeration tool leveraging dozens of APIs. - [httpx](https://github.com/projectdiscovery/httpx): A fast and multi-purpose HTTP toolkit that allows running multiple probes using the retryablehttp library. - [cvemap](https://github.com/projectdiscovery/cvemap): A CLI to Navigate the CVE jungle with ease. - [katana](https://github.com/projectdiscovery/katana): A next-generation crawling and spidering framework. - [naabu](https://github.com/projectdiscovery/naabu): A fast port scanner written in go with a focus on reliability and simplicity.
-
user.js
Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening
unfortunately, it's close to useless in 2026. i'll take an excerpt from arkenfox's repo as to why:
> Replacing some version specific scripts on CDNs with local versions is not a comprehensive solution and is a form of enumerating badness. While it may work with some scripts that are included it doesn’t help with most other third party connections.
> CDN extensions don't really improve privacy as far as sharing your IP address is concerned and their usage is fingerprintable as this Tor Project developer points out. They are the wrong tool for the job and are not a substitute for a good VPN or Tor Browser. Its worth noting the resources for Decentraleyes are over six years out of date and would not likely be used anyway
https://github.com/arkenfox/user.js/wiki/4.1-Extensions
-
MyIP
The best IP Toolbox. Check your IP address & geolocation, test IP for WebRTC and DNS IP leaks, run an IP quality check, browser fingerprint check, website availability check, network speed test, global latency test, MTR test, Whois search, and more. (by jason5ng32)
-
-
Project mention: phantomcollect VS BeEF - a user suggested alternative | libhunt.com/r/phantomcollect | 2025-11-08
BeEF is a well-known browser exploitation framework used for penetration testing. PhantomCollect focuses more on stealth web data collection, while BeEF provides interactive browser-based exploitation. Both tools can complement each other in red team environments.
-
AppSignal
AppSignal knows why the f*#k it crashed. Stop vibe-debugging. Every exception, every backtrace, grouped so you see patterns, not noise.
-
I love Firefox but I don't understand why anybody would use it without a custom config like BetterFox[1].
[1] https://github.com/yokoffing/Betterfox
-
howtheysre
A curated collection of publicly available resources on how technology and tech-savvy organizations around the world practice Site Reliability Engineering (SRE)
-
-
ClearURLs-Addon
ClearURLs is an add-on based on the new WebExtensions technology and will automatically remove tracking elements from URLs to help protect your privacy.
-
Retire.js
scanner detecting the use of JavaScript libraries with known vulnerabilities. Can also generate an SBOM of the libraries it finds.
-
reverse-shell-generator
Hosted Reverse Shell generator with a ton of functionality. -- (Great for CTFs)
-
shhgit
Ah shhgit! Find secrets in your code. Secrets detection for your GitHub, GitLab and Bitbucket repositories.
-
-
-
rate-limiter-flexible
Atomic and non-atomic counters and rate limiting tools. Limit resource access at any scale.
-
twofactorauth
List of sites with two factor auth support which includes SMS, email, phone calls, hardware, and software.
-
-
-
-
-
Pi.Alert
WIFI / LAN intruder detector. Check the devices connected and alert you with unknown devices. It also warns of the disconnection of "always connected" devices
-
SaaSHub
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
NOTE:
The open source projects on this list are ordered by number of github stars.
The number of mentions indicates repo mentiontions in the last 12 Months or
since we started tracking (Dec 2020).
JavaScript Security discussion
JavaScript Security related posts
-
How svgin-react renders SVGs as real, styleable elements without the XSS risk
-
Firefox's AI Switch Is Off. Telemetry Isn't
-
WebMask: 43+ OWASP-aligned website checks with a React UI
-
Gmail Thinks I'm Stupid, So I Left
-
7 Hidden Security Vulnerabilities in Modern Node.js Applications
-
Introducing hapi-aegis: Helmet-style security headers for hapi.js
-
Show HN: 1time – Zero-knowledge secret sharing with E2E encryption
-
A note from our sponsor - AppSignal
www.appsignal.com | 8 Sep 2026
Index
What are some of the best open-source Security projects in JavaScript? This list will help you:
| # | Project | Stars |
|---|---|---|
| 1 | nginxconfig.io | 28,288 |
| 2 | DOMPurify | 17,358 |
| 3 | nuclei-templates | 12,911 |
| 4 | user.js | 12,835 |
| 5 | MyIP | 11,803 |
| 6 | awesome-ctf | 11,687 |
| 7 | BeEF | 11,001 |
| 8 | Betterfox | 10,830 |
| 9 | howtheysre | 9,802 |
| 10 | cloudmapper | 6,293 |
| 11 | ClearURLs-Addon | 4,972 |
| 12 | Retire.js | 4,165 |
| 13 | reverse-shell-generator | 4,053 |
| 14 | shhgit | 3,977 |
| 15 | StegCloak | 3,836 |
| 16 | cloudsploit | 3,774 |
| 17 | rate-limiter-flexible | 3,582 |
| 18 | twofactorauth | 3,456 |
| 19 | awesome-nodejs-security | 3,036 |
| 20 | express-gateway | 3,034 |
| 21 | user.js | 2,893 |
| 22 | pwndoc | 2,886 |
| 23 | Pi.Alert | 2,730 |
Sponsored
Stop Scripting Promotions. Start Shipping with Kargo
Kargo automates promotion across dev, staging, and prod with approval gates and verification. Open source, built by the team behind Argo CD. Download now.
akuity.io