Repositories list

• publications

  Public
  Publications from Trail of Bits

  conference-presentationsacademic-paperssecurity-reviews

  Python

  •

  Creative Commons Attribution Share Alike 4.0 International

  •199•1.6k•4•4•Updated Aug 7, 2025Aug 7, 2025

• algo

  Public
  Set up a personal VPN in the cloud

  securityansibleencryption+ 8ipsecikev2wireguardvpnvpn-servervpn-clientstrongswan+ 1

  Python

  •

  GNU Affero General Public License v3.0

  •2.3k•30k•85•3•Updated Aug 7, 2025Aug 7, 2025

• pylock-attestations

  Public
  CLI tool to add attestation identities to `pylock.toml` files

  Python

  •

  Apache License 2.0

  •1•5•3•0•Updated Aug 7, 2025Aug 7, 2025

• .github

  Public
  GNU Affero General Public License v3.0

  •9•3•5•0•Updated Aug 7, 2025Aug 7, 2025

• mcp-context-protector

  Public
  MCP security wrapper

  Python

  •

  Apache License 2.0

  •7•124•2•3•Updated Aug 7, 2025Aug 7, 2025

• dylint

  Public
  Run Rust lints from dynamic libraries

  rustlinting

  Rust

  •

  Apache License 2.0

  •45•482•45•8•Updated Aug 7, 2025Aug 7, 2025

• sigstore-rekor-types

  Public
  Python models for Rekor's API types

  Python

  •

  Apache License 2.0

  •3•6•1•11•Updated Aug 7, 2025Aug 7, 2025

• anchor-coverage

  Public
  A wrapper around `anchor test` for computing test coverage

  testingcoverageanchor+ 1solana

  Rust

  •

  GNU Affero General Public License v3.0

  •2•4•2•6•Updated Aug 7, 2025Aug 7, 2025

• exploits

  Public
  Python

  •

  Apache License 2.0

  •0•7•0•1•Updated Aug 6, 2025Aug 6, 2025

• sleepy-pickle-public

  Public
  AI model compromise through malicious pickle files

  Python

  •

  MIT License

  •1•0•0•3•Updated Aug 6, 2025Aug 6, 2025

• vscode-sarif-explorer

  Public
  SARIF Explorer: A VSCode extension that helps you visualize and triage static analysis results

  static-analysisvscode-extensionsarif

  TypeScript

  •

  GNU General Public License v3.0

  •7•29•5•1•Updated Aug 6, 2025Aug 6, 2025

• fickling

  Public
  A Python pickling decompiler and static analyzer

  machine-learningpythonsecurity

  Python

  •

  GNU Lesser General Public License v3.0

  •58•534•15•6•Updated Aug 6, 2025Aug 6, 2025

• pip-plugin-pep740

  Public
  An implementation of a pip plugin that verifies PEP-740 attestations before installing a package, and aborts the installation if verification fails.

  Python

  •

  Apache License 2.0

  •0•2•1•1•Updated Aug 6, 2025Aug 6, 2025

• deptective

  Public
  Deptective automatically determines the native dependencies required to run any arbitrary program or command.

  dependency-analysissbomsbom-tool

  Python

  •

  GNU Lesser General Public License v3.0

  •0•113•1•1•Updated Aug 6, 2025Aug 6, 2025

• vendetect

  Public
  A tool to automatically detect copy+pasted and vendored code between repositories

  program-analysisplagiarism-detectionsbom+ 1sbom-tool

  Python

  •

  GNU Affero General Public License v3.0

  •5•54•1•2•Updated Aug 6, 2025Aug 6, 2025

• rfc3161-client

  Public
  An Opinionated Python RFC3161 Client

  rfc3161timestamp-protocol

  Rust

  •

  Apache License 2.0

  •4•2•2•1•Updated Aug 6, 2025Aug 6, 2025

• pypi-attestations

  Public
  A library to convert between Sigstore Bundles and PEP 740 Attestation objects

  Python

  •

  Apache License 2.0

  •6•9•7•3•Updated Aug 6, 2025Aug 6, 2025

• copilot-prompt-injection-demo

  Public archive
  Repository for demonstrating a GitHub Copilot Agent prompt injection exploit. See the associated blog post for details.

  HTML

  •1•0•1•1•Updated Aug 5, 2025Aug 5, 2025

• cookiecutter-python

  Public
  A cookiecutter template for a best-practices Python project

  Python

  •

  Apache License 2.0

  •6•17•0•3•Updated Aug 5, 2025Aug 5, 2025

• nyc-infosec

  Public
  Mapping the NYC Infosec Community

  meetupuniversitycalendar+ 2nycconference

  CSS

  •20•55•0•0•Updated Aug 5, 2025Aug 5, 2025

• empirehacking.nyc

  Public
  Empire Hacking NYC Meetup

  security-meetupnyc

  CSS

  •8•6•0•0•Updated Aug 5, 2025Aug 5, 2025

• necessist

  Public
  A mutation-based tool for finding bugs in tests

  testingmutation

  Rust

  •

  GNU Affero General Public License v3.0

  •17•123•17•2•Updated Aug 5, 2025Aug 5, 2025

• build-wrap

  Public
  Help protect against malicious build scripts

  rustsandboxingbuild-scripts

  Rust

  •

  GNU Affero General Public License v3.0

  •3•13•0•4•Updated Aug 5, 2025Aug 5, 2025

• cargo-line-test

  Public
  Run tests by the lines they exercise

  testingrust

  Rust

  •3•7•2•1•Updated Aug 4, 2025Aug 4, 2025

• datasig

  Public
  Dataset fingerprinting for AIBOM

  Python

  •

  GNU Affero General Public License v3.0

  •0•15•0•2•Updated Aug 4, 2025Aug 4, 2025

• testing-handbook

  Public
  Trail of Bits Testing Handbook

  Rust

  •

  Creative Commons Attribution 4.0 International

  •13•78•16•3•Updated Aug 1, 2025Aug 1, 2025

• are-we-pep740-yet

  Public
  Are we PEP 740 yet?

  HTML

  •

  BSD 2-Clause "Simplified" License

  •6•9•0•0•Updated Aug 1, 2025Aug 1, 2025

• pajaMAS

  Public
  Multi-agent system (MAS) hijacking demos

  multi-agent-systemsai-agentsai-security

  Python

  •

  Apache License 2.0

  •3•20•2•0•Updated Jul 30, 2025Jul 30, 2025

• instafix-llvm

  Public
  LLVM fork for INSTAFIX

  LLVM

  •

  Other

  •15k•2•0•4•Updated Jul 30, 2025Jul 30, 2025

• siderophile

  Public
  Find the ideal fuzz targets in a Rust codebase

  fuzzingprogram-analysissecurity-testing+ 1rust

  Rust

  •

  MIT License

  •12•217•12•11•Updated Jul 29, 2025Jul 29, 2025