Skip to content

@trailofbits Trail of Bits

All

    Repositories list

    297 repositories

    • trailmark

      Public
      Build and query a graph database representation of source code
      Python
      •
      Apache License 2.0
      •31•496•1•1•Updated Oct 23, 2026Oct 23, 2026

    • skills

      Public
      Trail of Bits skills for security research, vulnerability detection, and audit workflows
      agent-skills
      agent-skills
      Python
      •
      Creative Commons Attribution Share Alike 4.0 International
      •668•7.7k•30•100•Updated Oct 22, 2026Oct 22, 2026

    • coop

      Public
      Isolated VM environment for running Claude Code and Codex
      rustclivm
      rustclivmsandboxkvmlimacodexfirecrackermicrovmclaude-code
      Rust
      •
      Apache License 2.0
      •44•795•43•12•Updated Oct 22, 2026Oct 22, 2026

    • pylock-attestations

      Public
      CLI tool to add attestation identities to `pylock.toml` files
      Python
      •
      Apache License 2.0
      •1•7•3•2•Updated Oct 22, 2026Oct 22, 2026

    • gh-action-adapt-sigstore-pypi

      Public
      Python
      •
      Apache License 2.0
      •0•2•0•3•Updated Oct 22, 2026Oct 22, 2026

    • fickling

      Public
      A Python pickling decompiler and static analyzer
      pythonsecuritymachine-learning
      pythonsecuritymachine-learning
      Python
      •
      GNU Lesser General Public License v3.0
      •84•675•8•12•Updated Oct 22, 2026Oct 22, 2026

    • tlslib.py

      Public
      MVP for updated PEP 543 proposal
      Python
      •
      Apache License 2.0
      •1•14•2•2•Updated Oct 22, 2026Oct 22, 2026

    • testing-handbook

      Public
      Trail of Bits Testing Handbook - appsec.guide
      HTML
      •
      Creative Commons Attribution 4.0 International
      •22•138•19•1•Updated Oct 22, 2026Oct 22, 2026

    • mquire

      Public
      Zero-dependency Linux memory forensics, leveraging kernel-embedded BTF and kallsyms for type-aware memory analysis without external debug info.
      linuxrustsql
      linuxrustsqlkernelmemoryforensics
      Rust
      •
      Apache License 2.0
      •8•190•3•4•Updated Oct 22, 2026Oct 22, 2026

    • rfc8785.py

      Public
      A pure-Python implementation of RFC8785 (JSON Canonicalization Scheme)
      pythonserializationjson
      pythonserializationjsoncryptographycanonicalization
      Python
      •
      Apache License 2.0
      •5•14•0•1•Updated Oct 22, 2026Oct 22, 2026

    • pip-plugin-pep740

      Public
      An implementation of a pip plugin that verifies PEP-740 attestations before installing a package, and aborts the installation if verification fails.
      Python
      •
      Apache License 2.0
      •1•5•1•0•Updated Oct 22, 2026Oct 22, 2026

    • mishegos

      Public
      A differential fuzzer for x86 decoders
      x86fuzzinghacktoberfest
      x86fuzzinghacktoberfest
      C++
      •
      Apache License 2.0
      •31•278•7•1•Updated Oct 22, 2026Oct 22, 2026

    • tamarin-prover

      Public
      Main source code repository of the Tamarin prover for security protocol verification.
      Haskell
      •
      GNU General Public License v3.0
      •169•2•0•0•Updated Oct 22, 2026Oct 22, 2026

    • deptective

      Public
      Deptective automatically determines the native dependencies required to run any arbitrary program or command.
      dependency-analysissbomsbom-tool
      dependency-analysissbomsbom-tool
      Python
      •
      GNU Lesser General Public License v3.0
      •0•133•1•2•Updated Oct 22, 2026Oct 22, 2026

    • polyfile

      Public
      A pure Python cleanroom implementation of libmagic, with instrumented parsing from Kaitai struct and an interactive hex viewer
      pythonfile-format-detectionlibmagic
      pythonfile-format-detectionlibmagicfile-formatspolyglots
      Python
      •
      Apache License 2.0
      •32•391•15•6•Updated Oct 22, 2026Oct 22, 2026

    • it-depends

      Public
      A tool to automatically build a dependency graph and Software Bill of Materials (SBOM) for packages and arbitrary source code repositories.
      dependency-analysisdependency-graphhacktoberfest
      dependency-analysisdependency-graphhacktoberfestvulnerability-scannersbomhacktoberfest2021sbom-generatorsbom-tool
      Python
      •
      GNU Lesser General Public License v3.0
      •27•420•6•9•Updated Oct 22, 2026Oct 22, 2026

    • necessist

      Public
      A mutation-based tool for finding bugs in tests
      testingmutation
      testingmutation
      Rust
      •
      GNU Affero General Public License v3.0
      •21•161•19•4•Updated Oct 22, 2026Oct 22, 2026

    • graphtage

      Public
      A semantic diff utility and library for tree-like files such as JSON, JSON5, XML, HTML, YAML, and CSV.
      pythondiffutility
      pythondiffutilitylibrarygraph-algorithmscommand-line-toolhacktoberfesthacktoberfest2021
      Python
      •
      GNU Lesser General Public License v3.0
      •60•2.5k•12•9•Updated Oct 21, 2026Oct 21, 2026

    • vscode-weaudit

      Public
      Create code bookmarks and code highlights with a click.
      TypeScript
      •
      GNU General Public License v3.0
      •37•248•12•10•Updated Oct 21, 2026Oct 21, 2026

    • signal-auditor

      Public
      Key Transparency Auditor for Signal
      Rust
      •
      GNU Affero General Public License v3.0
      •1•18•0•5•Updated Oct 21, 2026Oct 21, 2026

    • vscode-sarif-explorer

      Public
      SARIF Explorer: A VSCode extension that helps you visualize and triage static analysis results
      static-analysisvscode-extensionsarif
      static-analysisvscode-extensionsarif
      TypeScript
      •
      GNU General Public License v3.0
      •11•55•6•9•Updated Oct 21, 2026Oct 21, 2026

    • calcifier

      Public
      Compile agent skills into reviewable, executable Python workflows.
      Python
      •
      MIT License
      •0•16•13•1•Updated Oct 21, 2026Oct 21, 2026

    • dylint

      Public
      Run Rust lints from dynamic libraries
      rustlinting
      rustlinting
      Rust
      •
      Apache License 2.0
      •66•698•54•15•Updated Oct 21, 2026Oct 21, 2026

    • osquery

      Public
      SQL powered operating system instrumentation, monitoring, and analytics.
      C++
      •
      Other
      •2.6k•40•0•2•Updated Oct 21, 2026Oct 21, 2026

    • cookiecutter-python

      Public
      A cookiecutter template for a best-practices Python project
      Python
      •
      Apache License 2.0
      •5•41•0•0•Updated Oct 21, 2026Oct 21, 2026

    • bt-log

      Public
      Binary transparency log to make tampered artifact distribution auditable
      Go
      •1•0•0•0•Updated Oct 21, 2026Oct 21, 2026

    • anchor-coverage

      Public
      A wrapper around `anchor test` for computing test coverage
      testingcoverageanchor
      testingcoverageanchorsolana
      Rust
      •
      GNU Affero General Public License v3.0
      •7•15•3•3•Updated Oct 20, 2026Oct 20, 2026

    • dropkit

      Public
      A CLI tool for managing DigitalOcean droplets with automated setup, SSH configuration, and lifecycle management.
      Python
      •
      Apache License 2.0
      •14•127•3•4•Updated Oct 20, 2026Oct 20, 2026

    • cargo-unmaintained

      Public
      Find unmaintained packages in Rust projects
      rustunmaintainedpackage-management
      rustunmaintainedpackage-management
      Rust
      •
      GNU Affero General Public License v3.0
      •15•102•9•1•Updated Oct 20, 2026Oct 20, 2026

    • checksec-anywhere

      Public
      Analyze binary security features instantly in your browser.
      Rust
      •
      Apache License 2.0
      •2•30•6•2•Updated Oct 20, 2026Oct 20, 2026
    ProTip! When viewing an organization's repositories, you can use the props. filter to filter by custom property.