Parses npm, yarn, pip, Poetry, Maven, Go, Ruby, Composer and Cargo lockfiles
OSV.dev lookup with CVSS severity and fixed versions, CSV/Markdown export
GitHub Actions generator: CodeQL, Dependabot, dependency review, gitleaks, Semgrep, Trivy, Scorecard

More free security tools

Threat Modeling: Model components, data flows and trust boundaries, generate STRIDE threats with mitigations, rate risk and export a Markdown report with a Mermaid diagram.
Dev Toolbox: Decode and lint JWTs, evaluate Content-Security-Policy, grade HTTP security headers and cookies, encode/hash data and scan code for leaked secrets, all locally.
Review Checklists: Run secure code reviews with OWASP Top 10:2025, API Security Top 10 and ASVS 5.0 checklists, record pass/fail with notes and paste the summary into your PR.
Data Lab: Chain 100+ operations into recipes: Base64, hex, URL, AES-GCM, HMAC, PBKDF2, MD5/SHA, gzip, XOR brute force, IOC extraction and defanging, with Magic auto-detect.
PKI Tools: Decode and lint X.509 certificates, chains, CSRs and CRLs, generate CSRs and keys, match keys to certificates, convert PEM/DER/P7B/JWK. Nothing is uploaded.
AI Skill Scanner: Scan SKILL.md files, agent instructions, MCP server configs and Claude Code hooks for prompt injection, data exfiltration, hidden Unicode and dangerous commands.
Website Recon: Passive recon for a domain: DNS records, SPF, DMARC, DKIM, CAA, DNSSEC, certificate transparency subdomains, RDAP registration, HSTS preload and archive history.