From 05878fd32b85f942093b1190f22e1ace040a638e Mon Sep 17 00:00:00 2001 From: sumeet gupta Date: Sun, 30 Aug 2026 12:27:03 +0530 Subject: [PATCH] Add dlp-patterns and osv-scan Two open-source, zero-dependency scanners: - dlp-patterns (Secret Management): scans text/files for 50+ categories of secrets and PII (AWS/GitHub/Stripe/Slack keys, JWTs, SSNs, credit cards, IBANs...). Luhn validation, entropy gating, and context scoring to cut false positives. Apache 2.0, works fully offline. https://github.com/SpiderCob/dlp-patterns - osv-scan (Testing): checks dependency manifests (requirements.txt, package-lock.json, go.mod, Cargo.toml, pom.xml) against the free OSV.dev database for known CVEs. No API key, no rate limits. https://github.com/SpiderCob/osv-scan Both alphabetized into their existing sections. --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index 5467d34..23ecc63 100644 --- a/README.md +++ b/README.md @@ -217,6 +217,7 @@ Testing is an essential element of a DevSecOps program because it helps to prepa * [npm-check](https://www.npmjs.com/package/npm-check) * [npm-outdated](https://docs.npmjs.com/cli/outdated) * [OSS Fuzz](https://github.com/google/oss-fuzz) +* [osv-scan](https://github.com/SpiderCob/osv-scan) * [OWASP OWTF](https://www.owasp.org/index.php/OWASP_OWTF) * [OWASP ZAP](https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project) * [OWASP ZAP Node API](https://github.com/zaproxy/zap-api-nodejs) @@ -265,6 +266,7 @@ To support security as code, sensitive credentials and secrets need to be manage * [BlackBox](https://github.com/StackExchange/blackbox) * [Conjur](https://github.com/cyberark/conjur) * [CredStash](https://github.com/fugue/credstash) +* [dlp-patterns](https://github.com/SpiderCob/dlp-patterns) * [Git Secrets](https://github.com/awslabs/git-secrets) * [Keybase](https://keybase.io) * [Sops](https://github.com/mozilla/sops)