Top 13 Rust Devsecops Projects

Devsecops

• Add a project

1. dalfox

   1 1 5,123 9.8 Rust

   🌙🦊 Dalfox is a powerful open-source XSS scanner and utility focused on automation.

   

2. SaaSHub

   www.saashub.com featured

   SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

   

3. kingfisher

   2 7 1,174 9.8 Rust

   Detect leaked secrets + live validation. Map blast radius across your stack. Revoke fast. 1,000+ rules. (by mongodb)

   

   Project mention: GitHub Actions issued GitHub_TOKEN disclosure in GitHub Actions logs | news.ycombinator.com | 2026-05-13

   This is also a good reminder to scan CI logs, not just source code.

   Shameless plug: I work on Kingfisher, an Apache 2.0 OSS secret scanner and validator written in Rust, that can also map blast radius and revoke many creds:

   <https://github.com/mongodb/kingfisher>

   It can scan repos, history, and artifacts and validate many findings against provider APIs, as well as revoke many exposed tokens directly from the CLI. Also generates a blast-radius/access-map view so you can see what a leaked credential could reach.

   Install:

     brew install kingfisher

4. casr

   3 2 356 6.6 Rust

   Collect crash (or UndefinedBehaviorSanitizer error) reports, triage, and estimate severity.

   

5. slowql

   4 1 217 9.5 Rust

   Next-generation SQL static analyzer written in Rust. 282+ rules. Zero false positives. Security, performance, reliability, cost, compliance, quality. 14 SQL dialects. Offline. CI/CD ready.

   

   Project mention: SlowQL – stop bad SQL before it reaches production | news.ycombinator.com | 2026-03-09

   - Quality (30 rules): naming, deprecated syntax, style

   171 rules total. 873 tests. Zero telemetry. Your SQL never leaves your machine.

   pip install slowql && slowql

   I spent serious time on the terminal experience — health score gauge, severity heat map, keyboard navigation. It sounds like a detail but it drives actual adoption.

   GitHub: https://github.com/makroumi/slowql

6. lotus

   5 4 93 2.9 Rust

   :zap: Fast Web Security Scanner written in Rust based on Lua Scripts :waning_gibbous_moon: :crab: (by Zeronleft)

   

7. cpplumber

   6 1 91 10.0 Rust

   Static analysis tool based on clang, which detects source-to-binary information leaks in C and C++ projects

   

8. provenant

   7 1 18 - Rust

   Rust-based ScanCode-compatible scanner for licenses, copyrights, package metadata, file metadata, and related provenance data.

   

   Project mention: Rust-based ScanCode-compatible scanner for licenses and copyrights | news.ycombinator.com | 2026-05-10

9. oneseal

   8 2 13 9.5 Rust

   🔐 Secrets, configs, and platform outputs as code — typed, versioned, encrypted.

   

   Project mention: Show HN: Git as Your Secrets-Store | news.ycombinator.com | 2025-10-11

10. hasp

    9 1 6 - Rust

    Paranoid security scanner + sandboxed step runner for GitHub Actions. Verifies pins, audits workflows, runs steps in a kernel sandbox where secrets are capabilities.

    

    Project mention: GitHub Actions is the weakest link | news.ycombinator.com | 2026-04-28

    Great writeup. Though combined with the lack of lockfiles for transitive actions, relying purely on static analysis is tough. Linter like zizmor are great, but they struggle with deep composite actions trees and runtime template injection.

    I got frustrated with the lack of security to started working myself on an open-source runtime sandbox for GHA: https://github.com/electricapp/hasp

    Instead of just statically parsing YAML it hooks into the runner env itself. Some of its runtime checks mirror what zizmor already does including resolving upstream SHAs to canonical branches (no impostor commits) and traversing the transitive dependency tree. I have a PR up with a comparison document here (hasp vs. zizmor): https://github.com/electricapp/hasp/pull/13/changes#diff-aab...

    Furthermore, it sandboxes itself to prevent sensitive exfiltration by acting as a token broken which injects the secret at runtime -- the GH token can only ever be used to call the GH API. It uses landlock, seccomp, and eBPF via Rust, so no docker. The token broker sandbox can also be used to wrap a generic executable; hasp has generic applications beyond GHA as well (i.e. agentic or other contexts, where token runtime injection seems quite in vogue)

    I'm using this as a stopgap until GH rolls out some of the features on its roadmap. I'm moving torward treating the runner as a zero-trust or actively malicious environment, so this was my small contribution on that front.

11. aegis

    10 2 4 6.9 Rust

    Supply-chain security scanner for npm packages. Detect malicious code, typosquatting, and compromised dependencies before you install them. (by z8run)

    

    Project mention: The Axios Attack Proved npm audit Is Broken. Here's What Would Have Caught It | dev.to | 2026-04-05

    I built aegis-scan to detect exactly these patterns. Here's how each analyzer would have responded to this attack:

12. origin-exposure-check

    11 2 2 2.1 Rust

    Self-audit: is your origin reachable past your CDN/WAF?

    

    Project mention: You hardened your origin and your CDN. Your DNS is still one provider away from going dark. | dev.to | 2026-07-05

    The deeper piece on DNS under DDoS: https://blackneuron.ai/blog/dns-ddos-testing

13. bulwark

    12 1 2 8.7 Rust

    Kernel-level read gate for AI agents — protected file opens are denied or routed through off-band consent before bytes reach the agent. Linux (fanotify) + macOS (Endpoint Security). (by obstalabs)

    

    Project mention: Show HN: Bulwark – a kernel read gate so coding agents can't read .env or .ssh | news.ycombinator.com | 2026-06-30

14. leakferret

    13 1 0 - Rust

    MCP-native secret scanner in one fast Rust binary: engine, CLI, and MCP server. Finds API keys and secrets, skips known-public fixtures, verifies live keys with a real provider call, and applies env-var rewrites. Privacy invariant: the raw secret never leaves disk.

    

    Project mention: Secret scanning for the agent era: verify the leak, then fix it | dev.to | 2026-05-31

    leakferret is a secret scanner written for that situation. It is a single Rust binary that runs as a CLI in CI and as an MCP server that an agent can call on its own work before it commits. It checks findings against the real provider, it keeps the raw secret on your machine, and it can apply the fix by replacing the hardcoded value with an environment variable lookup. This post explains how each of those parts works and how to wire it into both a CI pipeline and an agent loop. It is open source under MIT and free to use.

Rust Devsecops related posts

• You hardened your origin and your CDN. Your DNS is still one provider away from going dark.

  2 projects | dev.to | 5 Jul 2026

• GitHub: Can no longer search code without being logged in

  1 project | news.ycombinator.com | 27 Nov 2023

• Show HN: Nosey Parker, a fast and low-noise secrets detector for textual data

  1 project | /r/hypeurls | 2 Mar 2023

• Nosey Parker, a fast and low-noise secrets detector, now supports enumerating GitHub repositories and writing results in SARIF format

  1 project | /r/blueteamsec | 2 Mar 2023

• Show HN: Nosey Parker, a fast and low-noise secrets detector for textual data

  2 projects | news.ycombinator.com | 2 Mar 2023

• Nosey Parker, a newer secrets detector, can scan 100GB of Linux kernel commit history in 2 minutes on a laptop, and now can write SARIF output

  1 project | /r/SAST | 2 Mar 2023

• Nosey Parker, a fast secrets detector, now enumerates GitHub repos, writes SARIF output, and has 90 default rules

  1 project | /r/netsec | 2 Mar 2023
• A note from our sponsor - SaaSHub
  www.saashub.com | 21 Jul 2026

  SaaSHub helps you find the best software and product alternatives Learn more →

Index

Sponsored

SaaSHub - Software Alternatives and Reviews

SaaSHub helps you find the best software and product alternatives

www.saashub.com

Do not miss the trending Rust projects with our weekly report!