Repositories list

• publications

  Public
  Publications from Trail of Bits

  conference-presentationsacademic-paperssecurity-reviews

  Python

  •

  Creative Commons Attribution Share Alike 4.0 International

  •183•1.5k•4•1•Updated Feb 5, 2025Feb 5, 2025

• algo-ng

  Public
  Experimental version of Algo built on Terraform

  ipsecterraformvpn

  HCL

  •

  GNU Affero General Public License v3.0

  •18•73•0•1•Updated Feb 5, 2025Feb 5, 2025

• dylint

  Public
  Run Rust lints from dynamic libraries

  Rust

  •

  Apache License 2.0

  •25•422•22•2•Updated Feb 4, 2025Feb 4, 2025

• instafix-llvm

  Public
  LLVM fork for INSTAFIX

  LLVM

  •

  Other

  •13k•0•0•9•Updated Feb 4, 2025Feb 4, 2025

• build-wrap

  Public
  Help protect against malicious build scripts

  Rust

  •

  GNU Affero General Public License v3.0

  •3•9•1•0•Updated Feb 4, 2025Feb 4, 2025

• cookiecutter-python

  Public
  A cookiecutter template for a best-practices Python project

  Python

  •

  Apache License 2.0

  •5•14•0•0•Updated Feb 3, 2025Feb 3, 2025

• cargo-unmaintained

  Public
  Find unmaintained packages in Rust projects

  Rust

  •

  GNU Affero General Public License v3.0

  •2•68•6•0•Updated Feb 3, 2025Feb 3, 2025

• are-we-pep740-yet

  Public
  Are we PEP 740 yet?

  HTML

  •

  BSD 2-Clause "Simplified" License

  •3•7•0•0•Updated Feb 3, 2025Feb 3, 2025

• sigstore-rekor-types

  Public
  Python models for Rekor's API types

  Python

  •

  Apache License 2.0

  •1•5•0•2•Updated Feb 3, 2025Feb 3, 2025

• sigstore-apis

  Public
  Rust clients for the Fulcio and Rekor APIs

  sigstore

  Rust

  •

  Apache License 2.0

  •1•5•0•0•Updated Feb 3, 2025Feb 3, 2025

• ruzzy

  Public
  A coverage-guided fuzzer for pure Ruby code and Ruby C extensions

  rubyruby-gemruby-extension+ 3fuzzingfuzzerlibfuzzer

  Ruby

  •

  GNU Affero General Public License v3.0

  •6•94•10•0•Updated Feb 3, 2025Feb 3, 2025

• pypi-attestations

  Public
  A library to convert between Sigstore Bundles and PEP 740 Attestation objects

  Python

  •

  Apache License 2.0

  •2•4•5•1•Updated Feb 3, 2025Feb 3, 2025

• necessist

  Public
  A mutation-based tool for finding bugs in tests

  testingrust

  Rust

  •

  GNU Affero General Public License v3.0

  •12•111•16•3•Updated Feb 3, 2025Feb 3, 2025

• rfc3161-client

  Public
  An Opinionated Python RFC3161 Client

  rfc3161timestamp-protocol

  Rust

  •

  Apache License 2.0

  •0•1•2•0•Updated Feb 3, 2025Feb 3, 2025

• test-fuzz

  Public
  To make fuzzing Rust easy

  Rust

  •

  GNU Affero General Public License v3.0

  •16•167•11•2•Updated Jan 31, 2025Jan 31, 2025

• vast

  Public
  VAST is an experimental compiler pipeline designed for program analysis of C and C++. It provides a tower of IRs as MLIR dialects to choose the best fit representations for a program analysis or further program abstraction.

  ccppclang+ 5compilersprogram-analysisintermediate-representationcompiler-frontendmlir

  C++

  •

  Apache License 2.0

  •25•408•167•4•Updated Jan 31, 2025Jan 31, 2025

• cargo-line-test

  Public
  Run tests by the lines they exercise

  Rust

  •3•3•1•0•Updated Jan 27, 2025Jan 27, 2025

• testing-handbook

  Public
  Trail of Bits Testing Handbook

  C++

  •

  Creative Commons Attribution 4.0 International

  •10•60•12•5•Updated Jan 24, 2025Jan 24, 2025

• deepstate

  Public
  A unit test-like interface for fuzzing and symbolic execution

  unit-testingsymbolic-executionproperty-based-testing+ 3fuzzingtesting-toolstesting-framework

  Python

  •

  Apache License 2.0

  •99•825•82•8•Updated Jan 23, 2025Jan 23, 2025

• twa

  Public
  A tiny web auditor with strong opinions.

  auditingweb-securityhacktoberfest+ 1security

  Shell

  •

  MIT License

  •52•584•4•0•Updated Jan 22, 2025Jan 22, 2025

• vscode-sarif-explorer

  Public
  SARIF Explorer: A VSCode extension that helps you visualize and triage static analysis results

  static-analysisvscode-extensionsarif

  TypeScript

  •

  GNU General Public License v3.0

  •3•21•5•1•Updated Jan 22, 2025Jan 22, 2025

• multiplier

  Public
  Code auditing productivity multiplier.

  analysisauditclang+ 1mlir

  C++

  •

  Apache License 2.0

  •27•443•115•3•Updated Jan 21, 2025Jan 21, 2025

• zkdocs

  Public
  Interactive documentation on zero-knowledge proof systems and related primitives.

  cryptographyzero-knowledge

  HTML

  •

  Creative Commons Attribution 4.0 International

  •37•152•6•4•Updated Jan 21, 2025Jan 21, 2025

• challenge-tasks

  Public
  Python

  •0•0•0•0•Updated Jan 15, 2025Jan 15, 2025

• gh-action-adapt-sigstore-pypi

  Public
  Python

  •

  Apache License 2.0

  •0•0•0•1•Updated Jan 14, 2025Jan 14, 2025

• winchecksec

  Public
  Checksec, but for Windows: static detection of security mitigations in executables

  windowssecurityhacktoberfest+ 1mitigations

  C++

  •

  Apache License 2.0

  •78•573•16•2•Updated Jan 13, 2025Jan 13, 2025

• pip-plugin-pep740

  Public
  An implementation of a pip plugin that verifies PEP-740 attestations before installing a package, and aborts the installation if verification fails.

  Python

  •

  Apache License 2.0

  •0•0•1•0•Updated Jan 10, 2025Jan 10, 2025

• rfc8785.py

  Public
  A pure-Python implementation of RFC8785 (JSON Canonicalization Scheme)

  pythonserializationjson+ 2cryptographycanonicalization

  Python

  •

  Apache License 2.0

  •2•1•0•0•Updated Jan 10, 2025Jan 10, 2025

• windows-ctl

  Public
  Rust libraries and utilities for parsing Windows Certificate Trust Lists

  cryptographyauthenticoderust

  Rust

  •

  Apache License 2.0

  •2•8•0•0•Updated Jan 6, 2025Jan 6, 2025

• semgrep-rules

  Public
  Semgrep queries developed by Trail of Bits.

  Go

  •

  GNU Affero General Public License v3.0

  •39•381•7•2•Updated Jan 6, 2025Jan 6, 2025