Alternatives
Products that do what SENTRAX – Cybersécurité open source does
10 scanners, API REST, JWT + 2FA, dashboard
- 1
- 2DA
Hey HN! I’ve written a bunch of WebSocket servers over the years to do simple things like state synchronization, WebRTC signaling, and notifying a client when a backend job was run. I realized that if I had a simple way to create a private, temporary, mini-redis that the client could talk to directly, it would save a lot of time. So we created DriftDB. In addition to the open source server that you can run yourself, we also provide https://jamsocket.live where you can use an instance we host on Cloudflare’s edge (~13ms round trip latency from my home in NY). You may have seen my…
2023 · driftdb.com
- 3
- 4CO
2015 · sourcelair.com
- 5
- 6AO
This is a small PoC Python project for web server access logs analyzing to classify and dynamically block bad bots, such as L7 (application-level) DDoS bots, web scrappers and so on. We'll be happy to gather initial feedback on usability and features, especialy from people having good or bad experience wit bots. *Requirements* The analyzer relies on 3 Tempesta FW specific features which you still can get with other HTTP servers or accelerators: 1. JA5 client fingerprinting (https://tempesta-tech.com/knowledge-base/Traffic-Filtering-b...). This is a HTTP and TLS layers…
Oct 2025 · github.com
- 7IB
BoringSSL and nghttp2. Matches JA3N, JA4, and JA4_R fingerprints. Supports HTTP/2, async/await, and works with Cloudflare-protected sites. Not trying to compete with curl_cffi - just a learning project that turned into something functional.
Nov 2025 · github.com
- 8OA
2019 · github.com
- 9MN
This is an educational reference implementation showing how to build reasonably secure, standards-compliant authentication from first principles on Cloudflare Workers. Stack: Hono, Turso (libSQL), PBKDF2-SHA384 + normalization + common-password checks, JWT access + refresh tokens with revocation support, HTTP-only SameSite cookies, device tracking. It's deliberately minimal — no OAuth, no passkeys, no magic links, no rate limiting — because the goal is clarity and auditability. I wrote it mainly to deeply understand edge-runtime auth constraints and to have a clean Apache-2.0 example that…
Feb 2026 · github.com
- 10JA
2019 · github.com
- 11RA
2021 · github.com
- 12OS
tl;dr we released openapi.security, an online tool that performs a dozen of security tests on any given openapi/swagger-based API, with no signup or email required. You can try it here: https://openapi.security My team at Escape (YC W23) is mainly focused on securing GraphQL APIs. For this, we developed a new approach called Feedback driven API Exploration. Basically, we infer the right security tests cases to run using the specification and a carefully crafted in house graph traversal algorithm. (It's a bit long to describe here but we published a more in depth explanation of…
2023 · openapi.security
- 13IB
I built a GitHub app that detects it in pull requests, notifies or blocks them. Alongside it, I published a Semgrep ruleset for any stage of the CI/CD. I started this after getting frustrated by all the FUD around malicious code - lots of noise, little effort to solve it. Having said that, it's still a major attack vector - a stored RCE, with the codebase itself as the sink. Feedback is appreciated. The app, PRevent - https://github.com/apiiro/PRevent The ruleset: https://github.com/apiiro/malicious-code-ruleset The research:…
2025 · github.com
- 14TS
Hi HN, I’m Guillaume, the cofounder of Bearer, an Open Source SAST solution. After launching a few weeks ago here on Hacker News with support for Ruby and JavaScript stacks, I’m happy to report we’ve just released a new version (v1.2) with TypeScript support! In terms of code coverage, we use the same rules already implemented for vanilla JavaScript, but as usual, you can build your own. The rules list is here: https://docs.bearer.com/reference/rules/ It’s a first version for TS, but we believe that thanks to the pre-existing JavaScript support it should already…
2023
- 15
- 16SS
Nov 2025 · smart.mcpshark.sh
- 17JI
2016 · jwtinspector.io
- 18SW
Hey HN, I'm Arjun, an 18-year-old intern at Socket. I've been working on a project that I'm really excited to share with you all - a browser extension that makes it easier to check the security of NPM packages before you use them. You can try the extension on any Chromium-based browser or on Firefox. Chrome extension: https://chrome.google.com/webstore/detail/socket-security/jb... Firefox add-on: https://addons.mozilla.org/en-US/firefox/addon/socket-securi... Socket scans NPM packages for malware, vulnerabilities, code smell, and…
2023 · chrome.google.com
- 19
- 20
- 21OS
2021 · github.com
- 22JR
2020 · github.com
- 23OP
I, like Andrej Karpathy, became super frustrated by how annoying it was to deploy projects that were previously an absolute joy to make with Claude Code. That is why I made open-passkey, an MIT licensed passkey repo with support for 33 languages and frameworks (examples included) that makes adding simple secure auth to a project easy. We are also releasing gateway (https://gateway.locke.id) a "backendless" hosted auth server that frontend apps can consume for free so that you can ship a React or Angular app using a CDN like Netlify without needing to configure a server at all. We…
Apr 2026 · github.com
- 24IM
Hello I'm Jack, I was previously a Site Reliability Engineer and i've been working on monitro.dev which makes log monitoring simple for individuals or small teams. It allows you to easily forward any logs to multiple channels such as Slack, Discord & Telegram. The events are also viewable though the admin dashboard and are easily filterable. Currently there is only an NPM package with javascript / typescript support but i have plans to expand this to other languages such as Python, Rust etc. The package has many options, one of them is forwarding any uncaught exception and as an event…
2024 · monitro.dev
Ranked by how close each launch is in meaning, then by votes. Refine with a description →