Open Source Tools
How we list tools
What gets in
Established security projects with public source code, an official repository and recent activity. Every description is written by ThreatWire from the project's own documentation; we do not copy README files or other directories' texts. Links point only to official project pages.
Licences
We read each project's licence file instead of trusting automatic detection. Licences approved by the Open Source Initiative are tagged Open source. Public code under licences such as the Business Source License, SSPL, Elastic License or a custom licence is tagged Source-available, with the real licence named. Open-core projects say which part is open. When we cannot determine a licence it stays "Unknown".
Data
Stars, forks, commit dates, releases and languages come from the GitHub API. "Security of the tool itself" lists advisories published for the project on GitHub and, for packaged tools, on OSV.dev; CVEs that ThreatWire covers link to our records. OpenSSF Scorecard scores come from the public Scorecard API. Data is refreshed once a week (last run 2026-10-20 UTC); relative dates are computed from that snapshot.
Images
Logos are the project's GitHub avatar or official icon. Screenshots show the official website (or repository page) as captured by ThreatWire in a headless browser. We never download or run the tools to build this directory.
Dual-use tools
Penetration testing frameworks, password crackers and phishing simulators are listed because defenders use them every day. They carry a dual-use notice, no commands or payloads, and no sponsor box. Use them only with authorisation.
Sponsors
Ads are labelled "Ad" or "Featured" and never change descriptions, licences or statistics. Advertising options.
Corrections
Spotted a wrong licence or an outdated link? Tell us through the contact page.