Open source security reports
See what the Plexicus security scan flagged in popular open source projects, from leaked secrets to risky code, and what still needs a closer look. Free, no sign-up.
We show what a scan found and what it did not check. No scan can promise that a project is safe.
How it works
Search by project name or owner.
Alerts by type and severity from the latest Plexicus scan.
Practical next steps, plus what the scan did not cover.
Security reports
Projects with scan results are listed first.
public-apis
A collective list of free APIs
What the scan found
No alerts in the checks that ran. That is a good sign, not proof of safety.
Results are more than 48 hours old.
freeCodeCamp
freeCodeCamp.org's open-source codebase and curriculum. Learn math, programming, and computer science for free.
What the scan found
21 automated alerts, all Secrets.
Results are more than 48 hours old.
EbookFoundation
:books: Freely available programming books
What the scan found
No alerts in the checks that ran. That is a good sign, not proof of safety.
Results are more than 48 hours old.
openclaw
The AI that really does things. Any OS. Any Platform. The lobster way. 🦞
What the scan found
602 automated alerts, all Secrets.
Results are more than 48 hours old.
nilbuild
Interactive roadmaps, guides and other educational content to help developers grow in their careers.
What the scan found
No alerts in the checks that ran. That is a good sign, not proof of safety.
Results are more than 48 hours old.
vinta
The definitive list that answers "I want to do X in Python, which tool should I use?"
What the scan found
No alerts in the checks that ran. That is a good sign, not proof of safety.
Results are more than 48 hours old.
awesome-selfhosted
A list of Free Software network services and web applications which can be hosted on your own servers
What the scan found
No alerts in the checks that ran. That is a good sign, not proof of safety.
Results are more than 48 hours old.
obra
An agentic skills framework & software development methodology that works.
What the scan found
No alerts in the checks that ran. That is a good sign, not proof of safety.
Results are more than 48 hours old.
mattpocock
Skills for Real Engineers. Straight from my .agents directory.
What the scan found
No alerts in the checks that ran. That is a good sign, not proof of safety.
Results are more than 48 hours old.
practical-tutorials
Curated list of project-based tutorials
What the scan found
No alerts in the checks that ran. That is a good sign, not proof of safety.
Results are more than 48 hours old.
affaan-m
The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.
What the scan found
32 automated alerts, all Secrets.
Results are more than 48 hours old.
deepseek-ai
DeepSeek Harness: Everything is a Plugin.
What the scan found
45 automated alerts, all Secrets.
Results are more than 48 hours old.
NousResearch
The agent that grows with you
What the scan found
609 automated alerts, all Secrets.
Results are more than 48 hours old.
torvalds
Linux kernel source tree
What the scan found
233 automated alerts, all Secrets.
Results are more than 48 hours old.
react
The library for web and native user interfaces.
What the scan found
3 automated alerts, all Secrets.
Results are more than 48 hours old.
morluto
Reverse engineer anything with agents, from app behavior down to native binaries.
What the scan found
5 automated alerts, all Secrets.
Results are more than 48 hours old.
TheAlgorithms
All Algorithms implemented in Python
What the scan found
No alerts in the checks that ran. That is a good sign, not proof of safety.
Results are more than 48 hours old.
anomalyco
The open source coding agent.
What the scan found
No alerts in the checks that ran. That is a good sign, not proof of safety.
Results are more than 48 hours old.
n8n-io
Fair-code workflow automation platform with native AI capabilities. Combine visual building with custom code, self-host or cloud, 400+ integrations.
What the scan found
110 automated alerts, all Secrets.
Results are more than 48 hours old.
tensorflow
An Open Source Machine Learning Framework for Everyone
What the scan found
15 automated alerts, all Secrets.
Results are more than 48 hours old.
yt-dlp
A feature-rich command-line audio/video downloader
What the scan found
101 automated alerts, all Secrets.
Results are more than 48 hours old.
massgravel
Open-source Windows and Office activator featuring HWID, Ohook, TSforge, and Online KMS activation methods, along with advanced troubleshooting.
What the scan found
2 automated alerts, all Secrets.
Results are more than 48 hours old.
ultraworkers
An agent-managed museum exhibit, built in Rust with Gajae-Code / LazyCodex — developed and maintained with no human intervention.
What the scan found
No alerts in the checks that ran. That is a good sign, not proof of safety.
Results are more than 48 hours old.
microsoft
Visual Studio Code
What the scan found
38 automated alerts, all Secrets.
Results are more than 48 hours old.
microsoft
Python tool for converting files and office documents to Markdown.
What the scan found
No alerts in the checks that ran. That is a good sign, not proof of safety.
Results are more than 48 hours old.
firecrawl
Supercharge your AI agents with data from the web and beyond. Building the library for superintelligence. 🔥
What the scan found
10 automated alerts, all Secrets.
Results are more than 48 hours old.
avelino
A curated list of awesome Go frameworks, libraries and software
What the scan found
No alerts in the checks that ran. That is a good sign, not proof of safety.
Results are more than 48 hours old.
ohmyzsh
🙃 A delightful community-driven (with 2,500+ contributors) framework for managing your zsh configuration. Includes 300+ optional plugins (rails, git, macOS, hub, docker, homebrew, node, php, python, etc), 140+ themes to spice up your morning, and an auto-update tool that makes it easy to keep up with the latest updates from the community.
What the scan found
9 automated alerts, all Secrets.
Results are more than 48 hours old.
Significant-Gravitas
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.
What the scan found
85 automated alerts, all Secrets.
Results are more than 48 hours old.
CyC2018
:books: 技术面试必备基础知识、Leetcode、计算机操作系统、计算机网络、系统设计
What the scan found
1 automated alerts, all Secrets.
Results are more than 48 hours old.
521xueweihan
:octocat: 分享 GitHub 上有趣、入门级的开源项目。Share interesting, entry-level open source projects on GitHub.
What the scan found
No alerts in the checks that ran. That is a good sign, not proof of safety.
Results are more than 48 hours old.
ollama
Get up and running with Kimi, GLM, MiniMax, DeepSeek, gpt-oss, Qwen, Gemma and other models.
What the scan found
4 automated alerts, all Secrets.
Results are more than 48 hours old.
flutter
Flutter makes it easy and fast to build beautiful apps for mobile and beyond
What the scan found
47 automated alerts, all Secrets.
Results are more than 48 hours old.
DietrichGebert
Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote.
What the scan found
No alerts in the checks that ran. That is a good sign, not proof of safety.
Results are more than 48 hours old.
github
A collection of useful .gitignore templates
What the scan found
No alerts in the checks that ran. That is a good sign, not proof of safety.
Results are more than 48 hours old.
twbs
The most popular HTML, CSS, and JavaScript framework for developing responsive, mobile first projects on the web.
What the scan found
No alerts in the checks that ran. That is a good sign, not proof of safety.
Results are more than 48 hours old.
f
f.k.a. Awesome ChatGPT Prompts. Share, discover, and collect prompts from the community. Free and open source — self-host for your organization with complete privacy.
What the scan found
12 automated alerts, all Secrets.
Results are more than 48 hours old.
huggingface
🤗 Transformers: the model-definition framework for state-of-the-art machine learning models in text, vision, audio, and multimodal models, for both inference and training.
What the scan found
4 automated alerts, all Secrets.
Results are more than 48 hours old.
langgenius
Build Agentic workflows, RAG pipelines, with rich AI model and tool support on one collaborative workspace. Deploy on cloud, VPC, or self-hosted, so teams move from prototype to production without rebuilding the stack.
What the scan found
34 automated alerts, all Secrets.
Results are more than 48 hours old.
open-webui
User-friendly AI Interface (Supports Ollama, OpenAI API, ...)
What the scan found
3 automated alerts, all Secrets.
Results are more than 48 hours old.
anthropics
Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows - all through natural language commands.
What the scan found
2 automated alerts, all Secrets.
Results are more than 48 hours old.
langchain-ai
The agent engineering platform.
What the scan found
1 automated alerts, all Secrets.
Results are more than 48 hours old.
openai
Lightweight coding agent that runs in your terminal
What the scan found
58 automated alerts, all Secrets.
Results are more than 48 hours old.
browser-use
Open-source Python library for AI browser agents, plus Browser Use Cloud: stealth browsers and a hosted agent API.
What the scan found
4 automated alerts, all Secrets.
Results are more than 48 hours old.
google-gemini
An open-source AI agent that brings the power of Gemini directly into your terminal.
What the scan found
25 automated alerts, all Secrets.
Results are more than 48 hours old.
infiniflow
RAGFlow is a leading open-source Retrieval-Augmented Generation (RAG) engine that fuses cutting-edge RAG with Agent capabilities to create a superior context layer for LLMs
What the scan found
11 automated alerts, all Secrets.
Results are more than 48 hours old.
modelcontextprotocol
Model Context Protocol Servers
What the scan found
No alerts in the checks that ran. That is a good sign, not proof of safety.
Results are more than 48 hours old.
OpenHands
🙌 OpenHands: AI-Driven Development
What the scan found
6 automated alerts, all Secrets.
Results are more than 48 hours old.
unclecode
Open-source web crawler and scraper for LLMs and AI agents: any website into clean, LLM-ready Markdown. Run it yourself, or use Crawl4AI Cloud with one key.
What the scan found
8 automated alerts, all Secrets.
Results are more than 48 hours old.
lobehub
🤯 LobeHub is your Chief Agent Operator, organizing your agents into 7×24 operations by hiring, scheduling, and reporting on your entire AI team.
What the scan found
119 automated alerts, all Secrets.
Results are more than 48 hours old.
cline
Autonomous coding agent as an SDK, IDE extension, or CLI assistant.
What the scan found
37 automated alerts, all Secrets.
Results are more than 48 hours old.
mem0ai
The Memory Layer for AI Agents - Drop-in memory infrastructure for AI agents and apps. Context that persists. Built for production.
What the scan found
24 automated alerts, all Secrets.
Results are more than 48 hours old.
Mintplex-Labs
Stop renting your intelligence. Own it with AnythingLLM. Everything you need for a powerful local-first agent experience
What the scan found
2 automated alerts, all Secrets.
Results are more than 48 hours old.
upstash
Context7 Platform -- Up-to-date code documentation for LLMs and AI code editors
What the scan found
6 automated alerts, all Secrets.
Results are more than 48 hours old.
microsoft
A programming framework for agentic AI
What the scan found
2 automated alerts, all Secrets.
Results are more than 48 hours old.
crewAIInc
Framework for orchestrating role-playing, autonomous AI agents. By fostering collaborative intelligence, CrewAI empowers agents to work together seamlessly, tackling complex tasks.
What the scan found
37 automated alerts, all Secrets.
Results are more than 48 hours old.
FlowiseAI
Build AI Agents, Visually
What the scan found
2 automated alerts, all Secrets.
Results are more than 48 hours old.
aaif-goose
an open source, extensible AI agent that goes beyond code suggestions - install, execute, edit, and test with any LLM
What the scan found
13 automated alerts, all Secrets.
Results are more than 48 hours old.
run-llama
LlamaIndex is the document processing platform for AI
What the scan found
No alerts in the checks that ran. That is a good sign, not proof of safety.
Results are more than 48 hours old.
Aider-AI
aider is AI pair programming in your terminal
What the scan found
7 automated alerts, all Secrets.
Results are more than 48 hours old.
langchain-ai
Build resilient agents.
What the scan found
No alerts in the checks that ran. That is a good sign, not proof of safety.
Results are more than 48 hours old.
microsoft
Playwright MCP server
What the scan found
No alerts in the checks that ran. That is a good sign, not proof of safety.
Results are more than 48 hours old.
continuedev
open-source coding agent
What the scan found
5 automated alerts, all Secrets.
Results are more than 48 hours old.
github
GitHub's official MCP Server
What the scan found
8 automated alerts, all Secrets.
Results are more than 48 hours old.
ComposioHQ
Composio powers 1000+ toolkits, tool search, context management, authentication, and a sandboxed workbench to help you build AI agents that turn intent into action.
What the scan found
10 automated alerts, all Secrets.
Results are more than 48 hours old.
stackblitz-labs
Prompt, run, edit, and deploy full-stack web applications using any LLM you want!
What the scan found
1 automated alerts, all Secrets.
Results are more than 48 hours old.
awslabs
Open source MCP Servers for AWS
What the scan found
158 automated alerts, all Secrets.
Results are more than 48 hours old.
firecrawl
🔥 Official Firecrawl MCP Server - Adds powerful web scraping and search to Cursor, Claude and any other LLM clients.
What the scan found
No alerts in the checks that ran. That is a good sign, not proof of safety.
Results are more than 48 hours old.
Try another name or clear the filters.
These projects are queued. Their reports fill in after the first scan.
Scan any GitHub repository yourself with the free Plexicus SAST tool.
Checklist
Stars tell you a project is popular, not that it is safe. Run through these checks before you install anything from GitHub.
Look for active maintainers, recent commits, and quick replies to issues. An abandoned project will not get security fixes.
The Issues and Security tabs show reported vulnerabilities and how fast they were fixed.
API keys or passwords committed to the code are a red flag for how the whole project handles security.
Covered in Plexicus reportsStatic analysis finds injection, unsafe file access, weak cryptography, and similar issues before you run anything.
Covered in Plexicus reportsLook for known-vulnerable packages and look-alike names (typosquats) in the dependency list.
AI agents and MCP servers often ask for your files, shell, email, or tokens. Grant only what the task needs.
Run new tools in a container or virtual machine with throwaway credentials, and pin a specific release.
FAQ
No single check proves it. Look at who maintains it, read its issues and advisories, scan the code for secrets and risky patterns, and try it in isolation first. Plexicus reports cover the scanning part for popular projects.
No. Stars measure popularity. Popular projects can still contain leaked secrets, vulnerable code, or risky default settings.
Each report shows the automated alerts from Plexicus scans, grouped by type, such as secrets or code security, and by severity, plus which checks ran. Alerts are leads to review, not confirmed vulnerabilities.
No. It means the checks that ran found nothing to flag. Areas the scan did not cover, and code added later, can change the picture.
Open your project's report and use the correction link to send the relevant commit or evidence of a fix. Plexicus reviews the request and can arrange a new scan.
Yes. Use the free Plexicus SAST tool to scan any GitHub repository you have access to.
Your own code
Connect GitHub and see what Plexicus flags in your own code.