Generated source
This hub uses the same local package data as individual package pages: Nucleus package metadata, Homebrew enrichment, Geiger classifier output, secret-handling manifests, and approval-gate seeds where available.
topical
Security and crypto packages
Security, identity, cryptography, password, signing, and certificate-related packages.
summary
Why this package group is here
Security and crypto packages currently includes 710 package catalog entries. 0 have protected-tool coverage, 2 have approval-gate metadata, and 224 have non-low Geiger classifier findings. The grouping comes from package metadata, so it can stay current as that metadata changes.
Review model
Use the hub to find command families that need tighter secret injection, approval gates, or manual review before agents run them.
High-signal tools
mkcert4 approval-gate rules are present.ffmpeg4 approval-gate rules are present.denodoc example: JavaScript runtimemonobroad file, network, media, or database tool signalniktobroad file, network, media, or database tool signalnonogeneralized runtime or code generation signalcrytic-compilegeneralized runtime or code generation signalponycbroad file, network, media, or database tool signalrushgeneralized runtime or code generation signalpwncatgeneralized runtime or code generation signalvshgeneralized runtime or code generation signalproxifybroad file, network, media, or database tool signal
Approval-gated tools
Related hubs
Representative package spokes
1password-cliCommand-line interface for 1Passwordffmpeg4 approval-gate rules are present.gnutlsGNU Transport Layer Security (TLS) Libraryp11-kitlibrary-like package without higher-risk signalsgnupgGNU Privacy Guard (OpenPGP)krb5broad file, network, media, or database tool signalnettleLow-level cryptographic librarylibgcryptCryptographic library based on the code from GnuPGlibcaplibrary-like package without higher-risk signalsmkcert4 approval-gate rules are present.denodoc example: JavaScript runtimeopenldapnarrow executable package without higher-risk signalsnssLibraries for security-enabled client and server applicationspinentrynarrow executable package without higher-risk signalslibksbaX.509 and CMS librarybubblewrapnarrow executable package without higher-risk signals
packages
Indexed package pages
| Package | Manager | Signals | Why it appears here |
|---|---|---|---|
| mkcert | Homebrew | approval gate, green risk, v1.4.4 | 4 approval-gate rules are present. |
| ffmpeg | Homebrew | approval gate, blue risk, v8.1.2 | 4 approval-gate rules are present. |
| deno | Homebrew | yellow risk, v2.9.4 | doc example: JavaScript runtime |
| mono | Homebrew | yellow risk, v6.14.1 | broad file, network, media, or database tool signal |
| nikto | Homebrew | yellow risk, v2.6.1 | broad file, network, media, or database tool signal |
| nono | Homebrew | yellow risk, v0.71.0 | generalized runtime or code generation signal |
| crytic-compile | Homebrew | yellow risk, v0.4.2 | generalized runtime or code generation signal |
| ponyc | Homebrew | yellow risk, v0.68.0 | broad file, network, media, or database tool signal |
| rush | Homebrew | yellow risk, v2.4 | generalized runtime or code generation signal |
| pwncat | Homebrew | yellow risk, v0.1.2 | generalized runtime or code generation signal |
| vsh | Homebrew | yellow risk, v1.0.0 | generalized runtime or code generation signal |
| proxify | Homebrew | yellow risk, v0.0.16 | broad file, network, media, or database tool signal |
| wassette | Homebrew | yellow risk, v0.5.0 | generalized runtime or code generation signal |
| rustcat | Homebrew | yellow risk, v3.0.0 | generalized runtime or code generation signal |
| dehydrated | Homebrew | yellow risk, v0.7.2 | broad file, network, media, or database tool signal |
| gnutls | Homebrew | v3.8.13 | no executable entrypoint in the package index |
| p11-kit | Homebrew | green risk, v0.26.4 | library-like package without higher-risk signals |
| gnupg | Homebrew | v2.5.21 | no executable entrypoint in the package index |
| nettle | Homebrew | v4.0 | no executable entrypoint in the package index |
| libcap | Homebrew | green risk, v2.78 | library-like package without higher-risk signals |
| openldap | Homebrew | green risk, v2.6.13 | narrow executable package without higher-risk signals |
| nss | Homebrew | v3.126 | no executable entrypoint in the package index |
| pinentry | Homebrew | green risk, v1.3.3 | narrow executable package without higher-risk signals |
| bubblewrap | Homebrew | green risk, v0.11.2 | narrow executable package without higher-risk signals |
| gpgme | Homebrew | v2.1.2 | no executable entrypoint in the package index |
| cyrus-sasl | Homebrew | green risk, v2.1.28 | narrow executable package without higher-risk signals |
| llama.cpp | Homebrew | v10210 | no executable entrypoint in the package index |
| xxhash | Homebrew | green risk, v0.8.3 | narrow executable package without higher-risk signals |
| srt | Homebrew | green risk, v1.5.6 | narrow executable package without higher-risk signals |
| sops | Homebrew | v3.13.3 | no executable entrypoint in the package index |
| chezmoi | Homebrew | v2.71.1 | no executable entrypoint in the package index |
| libfido2 | Homebrew | green risk, v1.17.0 | library-like package without higher-risk signals |
| gitleaks | Homebrew | green risk, v8.30.1 | narrow executable package without higher-risk signals |
| libsecret | Homebrew | green risk, v0.21.7 | library-like package without higher-risk signals |
| argon2 | Homebrew | green risk, v20190702 | library-like package without higher-risk signals |
| semgrep | Homebrew | green risk, v1.172.0 | narrow executable package without higher-risk signals |
| gsasl | Homebrew | v2.2.4 | no executable entrypoint in the package index |
| trufflehog | Homebrew | v3.96.0 | no executable entrypoint in the package index |
| gperf | Homebrew | green risk, v3.3 | narrow executable package without higher-risk signals |
| zizmor | Homebrew | v1.29.0 | no executable entrypoint in the package index |
| aws-vault | Homebrew | v7.13.2 | no executable entrypoint in the package index |
| certbot | Homebrew | v5.7.0 | no executable entrypoint in the package index |
| libseccomp | Homebrew | green risk, v2.6.1 | library-like package without higher-risk signals |
| bitwarden-cli | Homebrew | v2026.7.0 | no executable entrypoint in the package index |
| docker-credential-helper | Homebrew | v0.9.8 | no executable entrypoint in the package index |
| jadx | Homebrew | green risk, v1.5.6 | narrow executable package without higher-risk signals |
| tfsec | Homebrew | green risk, v1.28.14 | narrow executable package without higher-risk signals |
| linux-pam | Homebrew | green risk, v1.7.2 | narrow executable package without higher-risk signals |
| ldns | Homebrew | green risk, v1.9.2 | library-like package without higher-risk signals |
| xauth | Homebrew | green risk, v1.1.5 | narrow executable package without higher-risk signals |
| pinentry-mac | Homebrew | green risk, v1.3.1.1 | narrow executable package without higher-risk signals |
| istioctl | Homebrew | v1.30.3 | no executable entrypoint in the package index |
| cycode | Homebrew | v3.18.0 | no executable entrypoint in the package index |
| kubelogin | Homebrew | green risk, v1.36.3 | narrow executable package without higher-risk signals |
| libxmlsec1 | Homebrew | green risk, v1.3.12 | library-like package without higher-risk signals |
| ykman | Homebrew | green risk, v5.9.2 | narrow executable package without higher-risk signals |
| snyk-cli | Homebrew | v1.1306.2 | no executable entrypoint in the package index |
| dependency-check | Homebrew | green risk, v12.2.2 | narrow executable package without higher-risk signals |
| opa | Homebrew | v1.19.0 | no executable entrypoint in the package index |
| openconnect | Homebrew | v9.21 | no executable entrypoint in the package index |
| md5sha1sum | Homebrew | green risk, v0.9.5 | narrow executable package without higher-risk signals |
| talisman | Homebrew | green risk, v1.37.0 | narrow executable package without higher-risk signals |
| subfinder | Homebrew | green risk, v2.14.0 | narrow executable package without higher-risk signals |
| step | Homebrew | green risk, v0.30.6 | narrow executable package without higher-risk signals |
| saml2aws | Homebrew | green risk, v2.36.19 | narrow executable package without higher-risk signals |
| oath-toolkit | Homebrew | green risk, v2.6.14 | narrow executable package without higher-risk signals |
| yara | Homebrew | green risk, v4.5.8 | narrow executable package without higher-risk signals |
| libcap-ng | Homebrew | green risk, v0.9.3 | library-like package without higher-risk signals |
| gobuster | Homebrew | green risk, v3.8.2 | narrow executable package without higher-risk signals |
| minisign | Homebrew | green risk, v0.12 | narrow executable package without higher-risk signals |
| bfg | Homebrew | green risk, v1.15.0 | narrow executable package without higher-risk signals |
| sqlcipher | Homebrew | v4.17.0 | no executable entrypoint in the package index |