# Tools > Every listed resource, editors’ picks first. The filters below can be combined. - Search: append `?q=` to the URL. Separate several keywords with spaces; all of them must match. Matches name, repository, tags, professions, description and README. - Filter by type: append `?type=` to the URL. - Filter by profession: append `?profession=` to the URL. Separate several ids with commas; a resource matches when it suits any of them. Ids are listed at https://hebbmind.com/api/v1/professions - Filter by tag: append `?tag=` to the URL. Separate several tags with commas; a resource must carry all of them. Tags are listed at https://hebbmind.com/api/v1/tags Type CLI, Resources for Security: 25 items. > Code audits, vulnerability triage, penetration testing and compliance. - [Trivy](https://hebbmind.com/es/cli/trivy.md): [CLI] All-in-one security scanner for container images, filesystems, Git repos and Kubernetes clusters: finds known vulnerabilities, IaC misconfigurations, leaked secrets and software licenses, and generates SBOMs. Open source, maintained by Aqua Security. - [Vault](https://hebbmind.com/es/cli/vault.md): [CLI] HashiCorp's secrets management system: the vault CLI reads and writes secrets, issues dynamic database and cloud credentials on demand, encrypts and decrypts data, and manages leases and revocation. Needs a reachable Vault server. - [Nuclei](https://hebbmind.com/es/cli/nuclei.md): [CLI] Fast vulnerability scanner driven by YAML templates: uses a community template library to detect known vulnerabilities over HTTP, DNS, TCP, SSL and more, supports custom templates and plugs into CI/CD. Use only on targets you're authorized to test. - [Gitleaks](https://hebbmind.com/es/cli/gitleaks.md): [CLI] Detects hardcoded passwords, API keys and tokens in Git repos, files and stdin, and can run as a pre-commit hook or GitHub Action to block leaks. Now feature-frozen with security fixes only, as the author has moved on to Betterleaks. - [TruffleHog](https://hebbmind.com/es/cli/trufflehog.md): [CLI] Finds leaked credentials in Git, GitHub, S3, filesystems and more, recognizing 800+ secret types and checking with each service whether a key is still live to cut false positives. - [promptfoo](https://hebbmind.com/es/cli/promptfoo.md): [CLI] CLI and library for evaluating and red-teaming LLM apps: compare prompts and model outputs in bulk, scan for security vulnerabilities and plug into CI/CD, with evals running locally. Now part of OpenAI and still open source under MIT. - [radare2](https://hebbmind.com/es/cli/radare2.md): [CLI] Open-source reverse engineering framework and CLI: disassemble, debug, emulate and patch binaries across many architectures and file formats, scriptable through r2pipe or built-in JavaScript. - [SOPS](https://hebbmind.com/es/cli/sops.md): [CLI] Encrypts secret values in YAML, JSON, ENV and INI config files using AWS, GCP or Azure KMS, age or PGP, so secrets can be safely committed to Git alongside code. A CNCF sandbox project. - [Semgrep](https://hebbmind.com/es/cli/semgrep.md): [CLI] Semantic multi-language static analysis: find vulnerabilities and bugs with rules that look like source code, across 30+ languages with custom rules. Scans locally by default without uploading code; cross-file analysis and Pro rules require sign-in. - [Prowler](https://hebbmind.com/es/cli/prowler.md): [CLI] Security baseline and compliance checks for AWS, Azure, GCP, Kubernetes, GitHub, M365 and more, with built-in CIS, NIST, PCI-DSS, SOC 2 and other frameworks. Generates reports or opens a local dashboard. Configure credentials for each cloud account first. - [Nmap](https://hebbmind.com/es/cli/nmap.md): [CLI] Classic network discovery and security auditing tool: host discovery, port scanning, service version and OS detection, plus vulnerability checks with NSE scripts. Only scan networks you are authorized to test. - [Grype](https://hebbmind.com/es/cli/grype.md): [CLI] Scans container images, filesystem directories and SBOMs for known vulnerabilities across major Linux distro packages and many language ecosystems, ranks risk by EPSS and KEV, and filters results with OpenVEX. Good for vulnerability gates in CI. Maintained by Anchore. - [Presidio CLI](https://hebbmind.com/es/cli/presidio.md): [CLI] Scans files and directories for personal data such as names, emails and credit card numbers using Presidio Analyzer, with configurable entity types, confidence thresholds and ignore rules. Needs Python 3.10+ and a spaCy language model. - [OSV-Scanner](https://hebbmind.com/es/cli/osv-scanner.md): [CLI] Google's official dependency vulnerability scanner: parses project lockfiles and container images, checks them against the OSV.dev database to find affected dependencies, and can suggest upgrade fixes (experimental). - [Codex Security](https://hebbmind.com/es/cli/codex-security.md): [CLI] OpenAI's official security CLI and TypeScript SDK: scans codebases to find, validate and fix security vulnerabilities, and can draft a SECURITY.md policy. Needs Node.js 22.13+, Python 3.10+, and a ChatGPT sign-in or API key. - [garak](https://hebbmind.com/es/cli/garak.md): [CLI] NVIDIA's open-source LLM vulnerability scanner that probes for prompt injection, jailbreaks, data leakage, hallucination and harmful content, supporting OpenAI, Hugging Face, Bedrock and most REST-accessible models. Scanning cloud models needs their API keys. - [Checkov](https://hebbmind.com/es/cli/checkov.md): [CLI] Static scanner for security and compliance issues in Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles and CI pipeline configs, with over a thousand built-in policies and hard-coded secret detection. Outputs SARIF, JSON and more. Maintained by Prisma Cloud. - [Steampipe](https://hebbmind.com/es/cli/steampipe.md): [CLI] Query cloud resources and SaaS APIs live with SQL: plugins map AWS, Azure, GCP, GitHub, Kubernetes and other services to tables you can select from directly, no ETL needed. A single binary with Postgres built in. - [zizmor](https://hebbmind.com/es/cli/zizmor.md): [CLI] Static security analysis for CI/CD config: finds template injection, credential leaks, excessive permissions and more in GitHub Actions workflows, also covers Dependabot and pre-commit configs, and auto-fixes some findings. - [Anthropic Sandbox Runtime (srt)](https://hebbmind.com/es/cli/sandbox-runtime.md): [CLI] Anthropic's official OS-level sandbox CLI: restricts file and network access for agents, MCP servers and any command without containers, using sandbox-exec on macOS and bubblewrap on Linux. Currently a research preview. - [ExifTool](https://hebbmind.com/es/cli/exiftool.md): [CLI] Classic CLI for reading and writing metadata in hundreds of file types including images, video, audio and PDF, covering EXIF, GPS, IPTC, XMP and camera makers' proprietary tags, with batch editing, stripping and conversion. Requires Perl. - [Nali](https://hebbmind.com/es/cli/nali.md): [CLI] Terminal tool for offline IP geolocation and CDN provider lookup, supporting QQwry, GeoIP2, ip2region and other databases. Pipe output from dig, nslookup and similar commands through it to annotate IPs automatically. - [ScanCode Toolkit](https://hebbmind.com/es/cli/scancode-toolkit.md): [CLI] Scans codebases and dependencies for open-source licenses, copyright notices and package manifests, detecting licenses by full-text matching, with output in JSON, SPDX, CycloneDX and more, for open-source compliance reviews. - [OSS Review Toolkit (ORT)](https://hebbmind.com/es/cli/ort.md): [CLI] The Linux Foundation's open-source compliance toolchain: analyzes project dependencies, scans licenses and copyrights, checks known vulnerabilities, flags policy violations and generates SBOMs and notice files. Needs Java 25 or Docker and ideally 8 GB RAM; have legal review license findings. - [REUSE Tool](https://hebbmind.com/es/cli/reuse-tool.md): [CLI] Official FSFE command-line tool that checks every file in a project for copyright and license information per the REUSE spec, adds headers in bulk, downloads license texts and generates an SPDX bill of materials. Needs Python; have legal review the results.