Top 23 Python Devsecops Projects

Devsecops

• Add a project

1. prowler

   1 31 15,000 9.9 Python

   Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

   

   Project mention: I audited Prowler's 48 IAM checks against a linter I built, and found a real gap | dev.to | 2026-08-27

   The proposal went in as issue #12559, a new check called iam_policy_sensitive_actions_require_mfa_condition, severity medium (matching how I'd rated the equivalent rule in iam-lint, since it's a defense-in-depth gap rather than something independently exploitable the way a full-admin policy is). I linked back to iam-lint's has_mfa_condition() function as a working reference implementation, since I'd already built and tested the exact logic the check would need.

2. AppSignal

   www.appsignal.com sponsored

   AppSignal knows why the f*#k it crashed. Stop vibe-debugging. Every exception, every backtrace, grouped so you see patterns, not noise.

   

3. BunkerWeb

   2 26 11,054 9.9 Python

   🛡️ Open-source and cloud-native Web Application Firewall (WAF)

   

   Project mention: Show HN: BunkerWeb – Open-Source Web Application Firewall (WAF / WAAP) | news.ycombinator.com | 2026-08-24

4. xonsh

   3 134 9,659 9.8 Python

   🐚 Python-powered shell. Full-featured, cross-platform and AI-friendly.

   

   Project mention: Don't Put Tilde In Your Path | news.ycombinator.com | 2026-10-11

   > so you might as well use one of those.

   Did someone say... Xonsh?! It's tough to give up the niceties of zsh and it's various plug-in ecosystems, but I would love to be able to use Xonsh [1] as a daily driver for exactly the reasons stated. It is already the language I lean on over bash for most utility scripts with its kitchen sink built-ins.

   [1] https://xon.sh/

5. DeepAudit

   4 1 7,125 8.9 Python

   DeepAudit：人人拥有的 AI 黑客战队，让漏洞挖掘触手可及。国内首个开源的代码漏洞挖掘多智能体系统。小白一键部署运行，自主协作审计 + 自动化沙箱 PoC 验证。支持 Ollama 私有部署 ，一键生成报告。支持中转站。​让安全不再昂贵，让审计不再复杂。

   

   Project mention: Show HN: DeepAudit – open-source auditing agent (LLMs and Static Analysis) | news.ycombinator.com | 2025-12-15

6. faraday

   5 8 6,777 7.4 Python

   Open-source and AI-powered cybersecurity tools for offensive security, vulnerability management, and autonomous pentesting. Built by hackers in Latin America, used worldwide. (by infobyte)

   

7. django-DefectDojo

   6 7 4,984 10.0 Python

   Open-Source Unified Vulnerability Management, DevSecOps & ASPM

   

8. mantis

   7 2 2,437 8.9 Python

   A modular, stack-agnostic toolkit for AI coding agents to autonomously find, reproduce, and patch vulnerabilities.

   

   Project mention: Bloated Clouds, Anyone? | dev.to | 2026-09-18

   Provision managed resources (Postgres, MongoDB, Kafka, RabbitMQ, etc.) from DigitalOcean, Supabase, Scaleway, AWS, or Google Cloud. It doesn't really matter which; they all offer good SLAs.

9. SaaSHub

   www.saashub.com sponsored

   SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

   

10. cicd-goat

    8 17 2,314 5.2 Python

    A deliberately vulnerable CI/CD environment. Learn CI/CD security through multiple challenges.

    

11. ggshield

    9 26 2,004 9.7 Python

    Detect and validate 500+ types of hardcoded secrets with advanced checks. Use it as a pre-commit hook, GitHub Action, or CLI for proactive secret detection and security.

    

    Project mention: AI assisted commits leak secrets at roughly twice the rate, and the fix is process rather than policy | dev.to | 2026-10-10

    GitGuardian, company site and 2026 State of Secrets Sprawl report landing material: http://gitguardian.com/

12. safety

    10 7 1,999 7.2 Python

    Safety checks Python dependencies for known security vulnerabilities and suggests the proper remediations for vulnerabilities detected.

    

13. cve-bin-tool

    11 13 1,777 9.5 Python

    The CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 350 common, vulnerable components (openssl, libpng, libxml2, expat and others), or if you know the components used, you can get a list of known vulnerabilities associated with an SBOM or a list of components and versions.

    

14. dep-scan

    12 4 1,296 8.2 Python

    OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.

    

    Project mention: Slopsquatting: AI Hallucinations as Supply Chain Attacks | dev.to | 2026-03-04

    Add a CI gate. Integrate Software Composition Analysis into your pipeline. Tools like OWASP dep-scan flag unknown or newly published packages before they reach production. Generate and sign Software Bills of Materials (SBOMs) for every build so each dependency is auditable. If a package does not appear in your organization's approved registry, the build should fail.

15. agentic-radar

    13 3 1,056 8.4 Python

    A security scanner for your LLM agentic workflows

    

16. ElectricEye

    14 1 1,049 3.0 Python

    ElectricEye is a multi-cloud, multi-SaaS Python CLI tool for Asset Management, Security Posture Management & Attack Surface Monitoring supporting 100s of services and evaluations to harden your CSP & SaaS environments with controls mapped to over 20 industry, regulatory, and best practice controls frameworks

    

17. HOL Guard

    15 0 850 10.0 Python

    Open-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.

    

18. skylos

    16 7 846 9.8 Python

    Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/

    

    Project mention: GitHub Actions Security and GitLab CI Security: Static Analysis for CI/CD | dev.to | 2026-05-12

    pip install "git+https://github.com/duriantaco/skylos.git" skylos . --danger

19. packj

    17 43 694 3.1 Python

    Packj stops :zap: Solarwinds-, ESLint-, and PyTorch-like attacks by flagging malicious/vulnerable open-source dependencies ("weak links") in your software supply-chain

    

    Project mention: Open Source tool to detect software supply chain attacks | news.ycombinator.com | 2026-08-30

20. privado

    18 21 664 0.9 Python

    Open Source Static Scanning tool to detect data flows in your code, find data security vulnerabilities & generate accurate Play Store Data Safety Report.

    

21. falconpy

    19 30 517 9.7 Python

    The CrowdStrike Falcon SDK for Python

    

22. tfquery

    20 3 332 0.0 Python

    tfquery: Run SQL queries on your Terraform infrastructure. Query resources and analyze its configuration using a SQL-powered framework.

    

23. ThreatPlaybook

    21 2 282 0.0 Python

    A unified DevSecOps Framework that allows you to go from iterative, collaborative Threat Modeling to Application Security Test Orchestration

    

24. apicheck

    22 2 279 0.0 Python

    The DevSecOps toolset for REST APIs

    

25. GitGoat

    23 9 173 3.4 Python

    GitGoat is an open source tool that was built to enable DevOps and Engineering teams to design and implement a sustainable misconfiguration prevention strategy. It can be used to test products with access to GitHub repositories without a risk to your production environment.

    

26. SaaSHub

    www.saashub.com sponsored

    SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

    

Python Devsecops related posts

• I Built an Open-Source Tool to Break AI Agents Before Attackers Do

  1 project | dev.to | 10 Oct 2026

• AI assisted commits leak secrets at roughly twice the rate, and the fix is process rather than policy

  1 project | dev.to | 10 Oct 2026

• I Added Terraform Drift Detection to Every GitHub Repo in One Line

  1 project | dev.to | 8 Oct 2026

• Show HN: Plexavo – simplest way to find AWS misconfigurations and attack paths

  1 project | news.ycombinator.com | 6 Oct 2026

• CISA active Linux kernel CVEs (CVE-2025-39964, CVE-2026-53266, CVE-2025-39682)

  1 project | news.ycombinator.com | 24 Sep 2026

• The #1 Security Bug AI Puts in Your Python Code

  1 project | dev.to | 4 Sep 2026

• I Built an AI That Fixes Terraform Drift Automatically

  1 project | dev.to | 23 Aug 2026
• A note from our sponsor - SaaSHub
  www.saashub.com | 14 Oct 2026

  SaaSHub helps you find the best software and product alternatives Learn more →

Index

Sponsored

AppSignal knows why the f*#k it crashed.

Stop vibe-debugging. Every exception, every backtrace, grouped so you see patterns, not noise.

www.appsignal.com

Do not miss the trending Python projects with our weekly report!