Security & privacy

Canarytokens ↗

Free service for planting tripwire tokens that alert you when they are accessed.

Cloudflare WAF ↗

Cloudflare's managed web application firewall.

Convergence ↗

Moxie Marlinspike's 2011 proposal for client-chosen notary-based TLS certificate verification.

Ente Photos

An end-to-end encrypted photo storage service.

Lockdown Mode ↗

An optional iOS hardening mode that restricts attachments, web features and connections.

Paranoid Crypto ↗

Google's open-source library for detecting weaknesses in cryptographic keys and signatures.

SELinux ↗

A Linux kernel security module for mandatory access control.

Tor

An anonymity network that routes traffic through volunteer relays.

YubiKey

A hardware security key supporting FIDO2, PIV and OpenPGP.

1Password ↗

A commercial password manager with a built-in SSH agent that can be unlocked with Touch ID.

ACME Renewal Information

An ACME extension that lets CAs tell clients when to renew certificates early.

AWS WAF

Amazon's managed web application firewall service.

AWS-LC

AWS's general-purpose cryptographic library derived from BoringSSL.

Accrescent

A security-focused Android app store.

AdGuard

AdGuard is an ad-blocking and privacy protection tool for devices and networks.

AppArmor

A Linux kernel security module that confines programs with per-application profiles.

Bitchat ↗

A decentralized messaging app designed to work without central servers.

BoringSSL

Google's fork of OpenSSL used in Chrome and Android.

CRACI CVE Publication Trends ↗

A web page charting CVE publication trends with severity filters.

CRLite ↗

Firefox's compressed, privacy-preserving system for checking whether leaf certificates have been revoked.

Certificate Transparency ↗

A public logging framework that records issued TLS certificates so misissuance can be detected.

Cowrie ↗

An SSH/Telnet honeypot that logs attacker interaction and supports an LLM backend.

CrowdSec

Collaborative open-source intrusion detection and IP blocklist system.

DANE

A protocol for binding TLS certificates to domains via DNSSEC-signed DNS records.

Data diode

Hardware that physically allows data to flow in only one direction between networks.

EDRi ↗

A European network of digital rights organisations.

Frida

A dynamic instrumentation toolkit for injecting scripts into running apps.

Ghidra

An open-source software reverse engineering suite from the NSA.

Google Inactive Account Manager ↗

Google feature that notifies chosen contacts or shares data after an account has been inactive for a set period.

Include Security ↗

A security consultancy offering penetration testing and application security reviews.

Infisical

An open source secrets management platform.

Let's Encrypt

A free, nonprofit certificate authority.

LibreSSL ↗

OpenBSD's fork of OpenSSL focused on code cleanup and security.

Little Snitch

A macOS application firewall that shows and controls outgoing network connections.

MoaV

A modular stack that runs 10+ censorship circumvention tools on a small VPS or Raspberry Pi.

OneCRL ↗

Mozilla's centrally pushed list of revoked intermediate certificates for Firefox.

Open Policy Agent

A general-purpose policy engine for evaluating rules as code.

OpenAI Trusted Access for Cyber ↗

OpenAI program granting verified users access for defensive cybersecurity work.

OutGuess ↗

A steganography tool that hides data in the redundant bits of JPEG images.

Privacy Guides ↗

A community website recommending privacy tools, including VPN providers.

Privatemode ↗

A European AI inference service that runs models inside secure enclaves.

Secretive ↗

A macOS app that stores SSH keys in the Secure Enclave and acts as an SSH agent.

Signal

An end-to-end encrypted messaging app.

Socket.dev

Service that scans dependencies for supply chain risks.

StageX ↗

A minimal Linux distribution focused on supply-chain security with signed, reviewed builds.

The Network Pump

A Naval Research Laboratory device that relays data one way, sends back only acknowledgements, and suppresses timing channels.

Token2

A vendor of FIDO2 hardware security keys.

Tornado ↗

A web visualization of CVE publication activity by Rogo Labs.

WebPKI Observatory ↗

A website tracking data about the Web PKI and certificate authorities.

YubiKey-Guide ↗

drduh's guide to using YubiKeys for GPG and SSH.

ctlogs.dev ↗

A search service for certificates recorded in Certificate Transparency logs.

exitmap

A scanner for checking the behavior of Tor exit relays.

iron proxy

A proxy for restricting agent network access by domain with credential swapping and re-signing.

keys-on-the-wire ↗

Proxy that injects real API keys into outbound requests so apps only ever see placeholder tokens.

matchlock ↗

A Firecracker-based VM sandbox for agents that injects secrets into network requests via placeholders.

nono

A sandboxing tool for running AI coding agents with restricted access.

quiet-tizen ↗

A project for debloating Samsung Tizen TVs.

sandbox-runtime ↗

Anthropic's lightweight sandbox for restricting filesystem and network access of processes.

supplychain.fail ↗

A website showing a CVE severity timeline for supply-chain vulnerabilities.

trezor-agent ↗

Agents that use Trezor hardware wallets for SSH, GPG, age and FIDO keys.

upki ↗

A Rust project from the rustls team that brings browser-style certificate revocation, such as CRLite, to non-browser clients.

wolfSSL

A lightweight TLS/DTLS library aimed at embedded and resource-constrained systems.

Respects Your Freedom ↗

An FSF certification program for hardware that respects user freedom and privacy.