random_compat - PHP 5.x support for random_bytes() and random_int()

•    PHP

---

PHP 5.x polyfill for random_bytes() and random_int() created and maintained by Paragon Initiative Enterprises. Although this library should function in earlier versions of PHP, we will only consider issues relevant to supported PHP versions. If you are using an unsupported version of PHP, please upgrade as soon as possible.

php5 secure secure-by-default random random-bytes csprng randomness random-int polyfill random-generation randomization

rage - Simple, modern, and secure file encryption tool, using the age format

•    Rust

---

rage is a simple, modern, and secure file encryption tool, using the age format. It features small explicit keys, no config options, and UNIX-style composability.

cli encryption scrypt yubikey curve25519 secure-by-default rust-library zero-configuration unix-philosophy age-encryption encryption-tools command-line ssh pgp

airship - Secure Content Management for the Modern Web - "The sky is only the beginning"

•    PHP

---

The sky is only the beginning. CMS Airship is a secure-by-default content management system, blog engine, and application development framework written for PHP 7.2 and above.

cms-airship libsodium content-management secure security postgresql application-security cms free-software secure-by-default

csp-builder - Build Content-Security-Policy headers from a JSON file (or build them programmatically)

•    PHP

---

Easily integrate Content-Security-Policy headers into your web application, either from a JSON configuration file, or programatically. CSP Builder was created by Paragon Initiative Enterprises as part of our effort to encourage better application security practices.

csp csp-header json-configuration csp-builder content-security-policy http http-header easy-to-use secure-by-default security xss cross-site-scripting

easydb - Easy-to-use PDO wrapper for PHP projects.

•    PHP

---

PDO lacks brevity and simplicity; EasyDB makes separating data from instructions easy (and aesthetically pleasing). EasyDB was created by Paragon Initiative Enterprises as part of our effort to encourage better application security practices.

pdo database databases postgresql mysql sqlite prepared-statements secure-by-default

Alpine - An opinionated scaffolding framework that jumpstarts Java projects with an API-first design, secure defaults, and minimal dependencies

•    Java

---

An opinionated scaffolding library that jump-starts Java projects with an API-first design, secure defaults, and minimal dependencies. Alpine provides the basis for quickly developing a 'Thin Server Architecture'. This type of architecture shifts the role of webapps to being API providers with little or no responsibility for server-side HTML rendering. This type of architecture is perfect for client-side rendered webapps that rely heavily on JSON, for Single Page Applications (SPA), and to power back-ends that drive mobile applications.

lightweight ldap rest rest-api swagger jdo secure-by-default scaffolding api-first thin-server-architecture framework java-framework

nginx-globals - Consolidating common, repeatable, secure nginx configs in a globals directory to standardize and simplify the locking down of nginx based webservers

•    Shell

---

Consolidating common, repeatable, secure nginx configs in a globals directory to standardize and simplify the locking down of nginx based webservers.

nginx nginx-configs ssl nginx-globals webserver tweaking secure-by-default letsencrypt certbot

System.Ben - Who says you can't be super fast and super secure

•    Shell

---

The fastest code is the code that doesn't execute; so there is no code.

secure-by-default fast-by-default

kes - KES is a simple, stateless and distributed key-management system

•    Go

---

KES is a stateless and distributed key-management system for high-performance applications. We built KES as the bridge between modern applications - running as containers on Kubernetes - and centralized KMS solutions. Therefore, KES has been designed to be simple, scalable and secure by default. It has just a few knobs to tweak instead of a complex configuration and does not require a deep understanding of secure key-management or cryptography. We run a public KES server instance at https://play.min.io:7373 for you to experiment with. Just follow the steps below to get a first impression of how easy it is to use KES as a client. All you need is cURL.

security cryptography encryption modern scale kms secure-by-default

git-simpleserver - Manage your own Git server from the command line

•    Shell

---

Git Simple Server (abbreviated "git ss") makes it easy to manage your Git repos on your own server from the command line. It's super lightweight, secure and only requires a shell, git and ssh. It has an integrated user management, making it simple to manage read and write permissions on a per-user, per-repo basis. Normally when logging in into a remote server via ssh, you'll get an interactive shell (most likely a bash). That's where you type in your fancy commands. Linux lets you define a custom shell to use (see man chsh). Instead of bash, you can for example define any script (bash, sh, python, ..) as your shell. Upon successful login, this script is executed and can control which commands you are allowed to run and which not. If git-simpleserver is set up on your server and you successfully authenticated as user git using your ssh key, a special shell is launched. This shell only allows you to run a small number of commands, dedicated to managing your Git repos and Git users. Now you're logged in as user git, but how does git-simpleserver's user management work then? Well, that's another cool feature of OpenSSH: For each public key in authorized_keys you can define custom env vars which get set when this public key is used to log in. git-simpleserver connects a GIT_USER environment variable to each public key. Think of GIT_USER as a virtual user name, similar, but still different to the ssh user (git). Using GIT_USER we know who has logged in and can restrict read and write permissions. No one can access your repos, unless you explicitly granted permissions to that person via git ss user add or the .ssh/authorized_keys file.

lightweight ssh simple self-hosted secure-by-default git-server