cbomkit/sonar-cryptography

A toolset for dealing with Cryptography Bill of Materials (CBOM)

Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server

CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security

A fast universal code security scanner, written in Rust. Batteries included: supports 14 languages, TUI for triage, secrets, post-quantum audits, diff-aware scans and more 𓃥

Post-quantum migration workbench: inventories cryptographic indicators in source/config files, assigns migration priorities, and emits a CryptoBOM. Analysis tooling only - not a cryptographic implementation.

Detect and validate 500+ types of hardcoded secrets with advanced checks. Use it as a pre-commit hook, GitHub Action, or CLI for proactive secret detection and security.

Collection of community-driven CodeQL query, library and extension packs

Open-source, self-hosted AI vulnerability research tool that orchestrates agents to find and validate security issues in code.

sbomqs: The Comprehensive SBOM Quality & Compliance Tool