SaaSHub helps you find the best software and product alternatives Learn more →
Top 23 Python Security Projects
-
PayloadsAllTheThings
A list of useful payloads and bypass for Web Application Security and Pentest/CTF
if you've never worked on SQL injection that's fine there is a PWNSOME REPOSITORY(get it? pwn + awesome) called[ Payload All The Things (https://github.com/swisskyrepo/PayloadsAllTheThings) it has different payloads for different web vulnerabilities.
-
InfluxDB
InfluxDB – Database Purpose-Built for High-Resolution Data. Turn time series data into real-time intelligence. Manage high-volume, high-velocity data without sacrificing performance.
-
mitmproxy
An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.
Project mention: Overcoming Geo-Blocked Feature Testing with Zero-Budget DevOps Strategies | dev.to | 2026-02-03Leverage open-source proxy tools like mitmproxy or tinyproxy, which allow you to intercept and modify HTTP requests and responses in real-time. By configuring these, you can simulate different geo conditions:
-
quivr
Opiniated RAG for integrating GenAI in your apps 🧠 Focus on your product rather than the RAG. Easy integration in existing products with customisation! Any LLM: GPT4, Groq, Llama. Any Vectorstore: PGVector, Faiss. Any Files. Anyway you want.
-
SQLMap Project
-
CheatSheetSeries
The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.
Project mention: CSRF Protection Without Tokens or Hidden Form Fields | news.ycombinator.com | 2025-12-22Again, the maintainer eventually came around.
Our confusion might be due to the fact that an erroneous PR (by seemingly an AI-wielding student...) was somehow recently accepted that completely reverted the changes we collectively worked on, which effectively made Fetch Metadata a full solution. So, it is back to showing as defense in depth. I've raised an issue about it, which wouldn't have happened if I didn't see your article!
Here's the previous language:
> If your software targets only modern browsers, you may rely on [Fetch Metadata headers](#fetch-metadata-headers) together with the fallback options described below to block cross-site state-changing requests
We then detailed some fallbacks (eg Origin header). Full text can be viewed in the original PR
https://github.com/OWASP/CheatSheetSeries/pull/1875
or
https://github.com/OWASP/CheatSheetSeries/blob/7fc3e6b8fde65...
-
-
hosts
🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories.
Project mention: When internal hostnames are leaked to the clown | news.ycombinator.com | 2026-02-04 -
SaaSHub
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
-
-
DB-GPT
AI Native Data App Development framework with AWEL(Agentic Workflow Expression Language) and Agents
Project mention: Launch HN: Gecko Security (YC F24) – AI That Finds Vulnerabilities in Code | news.ycombinator.com | 2025-08-01Yes, that's exactly what we do. Some examples: https://github.com/eosphoros-ai/DB-GPT/pull/2650, https://github.com/dagster-io/dagster/pull/30002
We just need to follow responsible disclosure first by notifying the maintainers, working with them on a fix, and making it public once it is resolved.
-
Relevant discussion: https://github.com/fail2ban/fail2ban/issues/4110
Looks like a slop report that somehow made its way into the CVE database.
-
-
-
prowler
Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.
Fortunately compliance evidence gathering has been automated with countless tools and services. Opensource tools such as Prowler, CISO Assistant or vendors such as Scrut Automation, Sprinto or Vanta have made evidence collection highly accesible.
-
-
Project mention: Gnome calculator pings the International Monetary Fund website | news.ycombinator.com | 2026-01-05
-
Plug in the SDR into your Laptop and install Universal Radio Hacker (URH) software. Get your ceiling fan light remote control ready and record the RF signal with URH. Usually, the RF frequency is 433.92M.
-
mvt
MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
Project mention: Conducting forensics of mobile devices to find signs of a potential compromise | news.ycombinator.com | 2025-03-16 -
Network security and reconnaissance are essential skills for cybersecurity professionals. In this blog post, we will build a Python-based network scanner that performs ARP scanning, port scanning, and DNS resolution using the scapy, socket, dns.resolver, and threading libraries. We will also use rich for better console output.
-
Project mention: Building a Sigma Rule Engine in TypeScript: Detection-as-Code for Log Analysis | dev.to | 2025-12-03
Sigma is like "Snort rules for logs." It's a generic signature format that describes suspicious activity in a platform-agnostic way.
-
Project mention: Show HN: BunkerWeb – open-source and cloud-native WAF/WAAP | news.ycombinator.com | 2026-01-12
-
-
Project mention: Wanted to spy on my dog, ended up spying on TP-Link | news.ycombinator.com | 2025-09-15
-
-
SaaSHub
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
NOTE:
The open source projects on this list are ordered by number of github stars.
The number of mentions indicates repo mentiontions in the last 12 Months or
since we started tracking (Dec 2020).
Python Security discussion
Python Security related posts
-
GitGuardian MCP: Secret Scanning as a Hard Merge Gate for AI-Generated Code
-
Secret-time-machine: scan your Git history for secrets you deleted years ago
-
39 CVEs in WebGoat. Only 36 Were Reachable.
-
Security Scanner for Agent Skills
-
AI Writes Code. Where Is the Proof?
-
Ask HN: Maintainers, do LLM-only users often clutter your issues/PRs?
-
Show HN: WP-Hunter, WP recon and SAST tool (building Agentic AI pipeline)
-
A note from our sponsor - SaaSHub
www.saashub.com | 11 Mar 2026
Index
What are some of the best open-source Security projects in Python? This list will help you:
| # | Project | Stars |
|---|---|---|
| 1 | PayloadsAllTheThings | 75,841 |
| 2 | mitmproxy | 42,531 |
| 3 | quivr | 38,984 |
| 4 | SQLMap | 36,767 |
| 5 | CheatSheetSeries | 31,507 |
| 6 | algo | 30,327 |
| 7 | hosts | 29,949 |
| 8 | macOS-Security-and-Privacy-Guide | 22,474 |
| 9 | DB-GPT | 18,223 |
| 10 | Fail2Ban | 17,116 |
| 11 | wifiphisher | 14,388 |
| 12 | dirsearch | 14,052 |
| 13 | prowler | 13,182 |
| 14 | routersploit | 13,012 |
| 15 | opensnitch | 12,950 |
| 16 | urh | 12,264 |
| 17 | mvt | 12,206 |
| 18 | scapy | 12,095 |
| 19 | sigma | 10,174 |
| 20 | BunkerWeb | 10,110 |
| 21 | frappe | 9,770 |
| 22 | objection | 8,925 |
| 23 | Mailpile | 8,849 |
Sponsored
InfluxDB – Database Purpose-Built for High-Resolution Data
Turn time series data into real-time intelligence. Manage high-volume, high-velocity data without sacrificing performance.
www.influxdata.com