Prowler is an Open Source security tool to perform AWS, GCP and Azure security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness.

https://github.com/prowler-cloud/prowler

https://testssl.sh/

is a free command line tool which checks a server’s service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and more.

https://github.com/GoogleContainerTools/distroless

Less is more.

„Distroless“ images contain only your application and its runtime dependencies. They do not contain package managers, shells or any other programs you would expect to find in a standard Linux distribution.

https://semgrep.dev/

Semgrep helps security engineers and developers find and fix the issues that matter before production.

https://github.com/FloeDesignTechnologies/phpcs-security-audit

phpcs-security-audit is a set of PHP_CodeSniffer rules that finds vulnerabilities and weaknesses related to security in PHP code.

https://github.com/ajinabraham/nodejsscan

https://pypi.org/project/bandit/

https://owasp.org/www-project-docker-top-10/

The OWASP Docker Top 10 project is giving you ten bullet points to plan and implement a secure docker-based container environment.

https://owasp.org/www-project-api-security/

API Security focuses on strategies and solutions to understand and mitigate the unique vulnerabilities and security risks of Application Programming Interfaces (APIs).

https://owasp.org/www-project-top-ten/

The OWASP Top 10 is a standard awareness document for developers and web application security. It represents a broad consensus about the most critical security risks to web applications.