Open source
The parts we think everyone should have.
Some of what we build is infrastructure rather than product — the models, parsers and primitives a defender needs before any of this is possible. Those we release.
Repositories
Supply chain defense
Tools that inspect what your build actually pulls in, written in response to attacks we had to answer for ourselves.
OreNPMGuard (opens in new tab)
MIT · Python
Detects the Shai-Hulud npm supply-chain attack and the compromised package versions it propagated through.
ore-mal-pkg-inspector (opens in new tab)
MIT · Python
Multi-ecosystem malicious package detection, scanning dependencies across package managers for known-bad and suspicious publishers.
homebrew-tap (opens in new tab)
Open source · Ruby
Homebrew tap for installing the Rapticore command-line tools.
Vulnerability intelligence
Prioritization and detection research — the same reachability thinking that drives how our products rank findings.
ssvc_ore_miner (opens in new tab)
Apache-2.0 · Python
Applies the SSVC decision model to vulnerability data so triage follows a documented decision tree instead of a raw severity score.
llm-security-benchmark (opens in new tab)
MIT · Python
A multi-model benchmark suite measuring how well OpenAI, Anthropic, and Google models actually perform at security analysis and vulnerability detection.
ore_react2shell_scanner (opens in new tab)
Open source · Python
Scanner for CVE-2025-55182, the React2Shell remote code execution flaw.
Research and training
Deliberately breakable targets and practical utilities we use to teach, test detections, and validate tooling.
chalanee (opens in new tab)
MIT · JavaScript
A deliberately vulnerable web application for practicing application security testing. Never run it in production.
can_I_clickit (opens in new tab)
MIT · Python
A phishing link checker for deciding whether a URL is safe to open.
AppSec-Pipeline-Simulator (opens in new tab)
Open source · Shell
A simulated application security pipeline for exercising scanner integrations and gate behavior without touching a real repository.
Why we release it
Defenders shouldn’t have to rebuild the same primitives.
Threat models, attack-path representations and cloud resource parsers are shared infrastructure. Keeping them proprietary slows everyone down, including us — and code that is read by strangers gets better.
Contributing
Every project is developed in the open on GitHub. Issues and pull requests go to the repository they concern.
Security policy
Report a vulnerability in any repository to security@rapticore.com. We acknowledge within one business day and follow coordinated disclosure.
Licensing
The license each repository carries is shown beside its name above. MIT and Apache-2.0 both permit commercial use.