awesome-secure-defaults

---

Library	Description	Language(s)	Category	Metadata
helmetjs/helmet	Helmet helps secure Express apps by setting HTTP response headers.	NodeJS	Headers
github/secure_headers	Manages application of security headers with many safe defaults	Ruby	Headers
arkadiyt/ssrf_filter	A ruby gem for defending against Server Side Request Forgery (SSRF) attacks	Ruby	SSRF
google/tink-crypto	A multi-language, cross-platform library that provides cryptographic APIs that are secure, easy to use correctly, and hard(er) to misuse.	Java, C++, Go, Python, Obj-C	Cryptography
cure53/DOMPurify	A DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG	JavaScript	HTML Sanitizer (XSS prevention)
mozilla/bleach	An allowed-list-based HTML sanitizing library that escapes or strips markup and attributes	Python	HTML Sanitizer (XSS prevention)
pallets/markupsafe	Safely add untrusted strings to HTML/XML markup.	Python	HTML Sanitizer (XSS prevention)
symfony/html-sanitizer	Provides an object-oriented API to sanitize untrusted HTML input for safe insertion into a document's DOM.	PHP	HTML Sanitizer (XSS prevention)
null8626/decancer	A tiny package that removes common unicode confusables/homoglyphs from strings.	Rust,JavaScript (Node.js/Browser),C/C++,Java,Python (unofficial)	Input Sanitization
davisjam/safe-regex	Detect possibly catastrophic, exponential-time regular expressions	JavaScript	Regex
ikkisoft/SerialKiller	Look-Ahead Java Deserialization Library	Java	Deserialization
paragonie/anti-csrf	Full-Featured Anti-CSRF Library	PHP	CSRF
paragonie/constant_time_encoding	Character encoding functions that do not leak information about what you are encoding/decoding via processor cache misses	PHP	Information Leakage
paragonie/halite	High-level cryptography interface powered by libsodium	PHP	Cryptography
paragonie/ionizer	Input Filter System for PHP Software	PHP	Input Filteration
paragonie/password_lock	Wraps Bcrypt-SHA2 in Authenticated Encryption	PHP	Cryptography
jvoisin/snuffleupagus	Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest!	PHP	Misc
BePsvPT/secure-headers	PHP Secure Headers	PHP	Headers
gorilla/csrf	Cross Site Request Forgery (CSRF) prevention middleware for Go web applications & services 🔒	Golang	CSRF
justinas/nosurf	CSRF protection middleware for Go.	Golang	CSRF
sdsdkkk/safe_redirect	Keep Rails apps safe from open redirects	Ruby on Rails	Open Redirect
Shopify/redirect_safely	Sanitize redirect_to URLs	Ruby	Open Redirect
Trendyol/safe-redirect	Library which resolves open-redirection vulnerability when we need to make redirection to a path taken from query string.	TypeScript	Open Redirect
gorilla/securecookie	Encodes and decodes authenticated and optionally encrypted cookie values for Go web applications	Golang	CookieJar
google/safevalues	Prevent Cross-Site Scripting vulnerabilities in TypeScript (and JavaScript). It is meant to be used together with tsec to provide strong security guarantees and help you deploy Trusted Types and other CSP restrictions in your applications	TypeScript	XSS
google/wuffs	Parsing, decoding and encoding Untrusted File Formats Safely	C	File Handling
google/safeopen	Safe-by-construction library with file open/create primitives for Golang that are not vulnerable to path traversal attacks	Golang	Path Traversal
google/safe-active-record	A security middleware to defend against SQL injection in Ruby on Rails Active Record.	Ruby	SQLi
google/safetext	Safe-by-construction libraries for producing formats like YAML	Golang	Injection
google/safehtml	Immutable string-like types that wrap web types such as HTML, JavaScript and CSS. These wrappers are safe by construction against XSS and similar web vulnerabilities	Golang	XSS, etc.
google/securemessage	A portable crypto library that exposes a restricted API that is secure by design, for use as a black-box building block in cryptographic protocols	C++	Cryptography
google/re2	A fast, safe, thread-friendly alternative to backtracking regular expression engines	C++	Regex
google/safearchive	Safe-by-construction libraries for processing tar and zip archives, to replace unsafe alternatives like archive/tar and archive/zip that are at risk of path traversal attacks. Besides crafted filename entries in the archive, this library also protects from symbolic link attacks.	Golang	Zip Handling
google/go-safeweb	A collection of libraries for writing secure-by-default HTTP servers in Go.	Golang	XSS, XSRF
doyensec/safeurl	Implements a safeurl.Client wrapper around Go's native net/http.Client and performs validation on the incoming request against the configured allow and block lists. It also implements mitigation for DNS rebinding attacks.	Golang	SSRF
mustache/mustache	Logic-less Ruby templates.	Ruby	Templating
Shopify/liquid	Safe, customer facing template language for flexible web apps.	Ruby	Templating
handlebars-lang/handlebars.js	Minimal templating on steroids.	JavaScript	Templating
salesforce/handlebars-php	A simple, logic-less, yet powerful templating engine for PHP.	PHP	Templating
huggingface/safetensors	This repository implements a new simple format for storing tensors safely (as opposed to pickle) and that is still fast (zero-copy).	Python	Packing/Unpacking
cloudflare/svg-hush	Make arbitrary SVG files as benign and safe to serve as images in other common Web file formats	Rust	SVG
tiran/defusedxml	Python-only workarounds and fixes for denial of service and other vulnerabilities in Python's XML libraries	Python	XXE
nahsra/antisamy	a library for performing fast, configurable cleansing of HTML coming from untrusted sources	Java	Injection
OWASP/www-project-csrfguard	The aim of this project is to protect Java applications against CSRF attacks with the use of Synchronizer Tokens	Java	CSRF
y-mehta/ssrf-req-filter	Module to prevent SSRF when sending requests in NodeJS. Blocks request to local and private IP addresses	NodeJS	SSRF
segmentio/ui-box's safeHref	Allowlists safe protocols and sets rel values	TypeScript	XSS
vvo/iron-session	🛠 Secure, stateless, and cookie-based session library	JavaScript	CookieJar
cossacklabs/themis	Easy to use cryptographic framework for data protection: secure messaging with forward secrecy and secure data storage. Has unified APIs across 14 platforms.	iOS (Swift, Obj-C), Android (Java, Kotlin), React Native (iOS, Android), desktop Java, С/С++, Node.js, Python, Ruby, PHP, Go, Rust, WASM	Cryptography
aws/http-desync-guardian	Analyze HTTP requests to minimize risks of HTTP Desync attacks (precursor for HTTP request smuggling/splitting).	Rust	HTTP Desync
rust-ammonia/ammonia	Repair and secure untrusted HTML	Rust	HTML Sanitizer (XSS prevention)
techgaun/plug_secex	Adds various HTTP Headers to make Phoenix/Elixir app more secure	Elixir	Headers
TypeError/secure	Secure 🔒 headers for Python web frameworks	Python	Headers
unrolled/secure	HTTP middleware for Go that facilitates some quick security wins.	Golang	Multiple
juunas11/aspnetcore-security-headers	Middleware for adding security headers to an ASP.NET Core application.	.NET	Headers
andrewlock/NetEscapades...SecurityHeaders	Small package to allow adding security headers to ASP.NET Core websites	.NET	Headers
GaProgMan/OwaspHeaders.Core	A .NET Core middleware for injecting the Owasp recommended HTTP Headers for increased security	.NET	Headers
mganss/HtmlSanitizer	Cleans HTML to avoid XSS attacks	.NET	HTML Sanitizer (XSS prevention)
Escape/GraphQL-Armor	Highly customizable security middleware for various GraphQL server engines.	Apollo Server, GraphQL Yoga, GraphQL-Helix, Node.js HTTP, GraphQL-Helix,GraphQL-WS, GraphQL-SSE, Azure Functions, Cloudflare Workers, Google Cloud Functions, Lambda AWS, type-graphql, nexus, express-graphql	Multiple
microcosm-cc/bluemonday	a fast golang HTML sanitizer (inspired by the OWASP Java HTML Sanitizer) to scrub user generated content of XSS	Golang	HTML Sanitizer (XSS prevention)
gradio-app/safehttpx	Python library to prevent SSRF through wrapper around httpx.AsyncClient.get()	Python	SSRF
realArcherL/is-path-inside-secure	Securely verifies path containment, resolves symlinks, confirms file existence, and prevents path traversal attacks.	JavaScript	Path Traversal
opengovsg/starter-kitty validators	Path, Email, and URL validators	JavaScript	Multiple
opengovsg/starter-kitty safe-fs	Prevents path traversal	JavaScript	Path Traversal
realArcherL/realArcherL/spotlighting-datamarking	Spotlighting defenses (delimiter, datamarking and base64-encoding).	Typescript	Prompt Injection

Infrastructure Security

Library	Description	Language(s)	Category	Metadata
HardenedBSD	Hardened fork of FreeBSD with extra exploit mitigations and security hardening technologies	C, C++, Shell, Other	OS / ecosystem
GoogleContainerTools/distroless	🥑 Language focused docker images, minus the operating system.	Docker	Containers
chainguard-images/images	Chainguard Images is a collection of container images designed for minimalism and security.	Docker	Containers
step-security/harden-runner	Network egress filtering and runtime security for GitHub-hosted and self-hosted runners	Github Actions	CI/CD

Template

| [TKTK](https://github.com/TKTK) | TKTK | TKTK | TKTK |[![stars](https://badgen.net/github/stars/TKTK)](https://badgen.net/github/stars/TKTK) [![last-commit](https://badgen.net/github/last-commit/TKTK)](https://badgen.net/github/last-commit/TKTK) 

References

• https://www.abhaybhargav.com/notes-on-secure-defaults/?utm_source=tldrsec.com&utm_medium=referral&utm_campaign=tl-dr-sec-43-continuous-appsec-scanning-threat-modeling-career-advice-from-feynman
• https://github.com/orgs/google/repositories?language=&q=safe&sort=&type=all
• https://paragonie.com/software
• https://github.com/pxlpnk/awesome-ruby-security
• https://github.com/guardrailsio/awesome-php-security
• https://github.com/osirislab/awesome-rust-security
• https://github.com/vintasoftware/awesome-django-security
• https://github.com/guardrailsio/awesome-golang-security
• https://github.com/guardrailsio/awesome-dotnet-security