SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
Top signals
- 1 danielmiessler/SecLists 72.8k
- 2 composer/composer 29.5k
- 3 bagisto/bagisto 28k
- 4 livewire/livewire 23.6k
- 5 PHPMailer/PHPMailer 22.3k
Fastest rising
- 1 danielmiessler/SecLists 72.8k
- 2 coollabsio/coolify 60.4k
- 3 nextcloud/server 36.4k
- 4 laravel/framework 34.9k
- 5 filamentphp/filament 31.8k
Open Source eCommerce Platform Built with Laravel for Enterprise-Scale Commerce Supporting 10M+ SKUs
A full-stack framework for Laravel that takes the pain out of building dynamic UIs.
The classic email sending library for PHP
Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS powered by PHP, Markdown, Twig, and Symfony
A free open source IT asset/license management system
Open source Product Information Management (PIM) and Digital Asset Management (DAM) platform built on Laravel — manage, enrich, and scale product data and digital assets beyond 10 million products. Free forever.
🔥 Stay motivated and show off your contribution streak! 🌟 Display your total contributions, current streak, and longest streak on your GitHub profile README
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.
Kimai is the #1 open-source time-tracking application. From freelancers to companies and organisations - everyone can manage timesheets, generate reports, create invoices and so much more... Web-based multi-user application, available as On-Premise or SaaS version: https://www.kimai.org
Community-based GPL-licensed network monitoring system
📅 Easy!Appointments - Self Hosted Appointment Scheduler
29 editorial diagram types for Claude Code. Self-contained HTML + SVG. No shadows, no Mermaid-slop.
Notes of the book System Desgin Interview - An Insider's Guide
Agent skills for Manim to create 3Blue1Brown style animations.
A high-quality PDF to Markdown tool based on large language model visual recognition. 一款基于大模型视觉识别的高质量PDF转Markdown工具
A complete AI agency at your fingertips - From frontend wizards to Reddit community ninjas, from whimsy injectors to reality checkers. Each agent is a specialized expert with personality, processes, and proven deliverables.
Local UI to run and train LLMs and diffusion models, including Kimi K3, MiniMax-H3, Gemma 4, Qwen3.6, DeepSeek-V4, FLUX and more.
Markdown, mapped — the md2hd CLI. Point it at markdown notes and read the map in your browser.
基于 ACP 协议的多 Agent Web 网关,让 CLI Agent 也能在浏览器中使用。
Orca is the ADE for working with a fleet of parallel agents. Run any coding agent with your own subscription. Available on desktop, mobile and VPS.
An open-source, self-hostable PaaS alternative to Vercel, Heroku & Netlify that lets you easily deploy static sites, databases, full-stack applications and 280+ one-click services on your own servers.
Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote.
A minimal chatbot template built with Next.js, AI SDK, shadcn/ui, shadcn/react, shadcn/typeset. It runs on the Vercel AI Gateway.
World's first open-source, agentic video production system. 12 production pipelines, 100+ tools, 700+ agent skill and production-knowledge files. Turn your AI coding assistant into a full video production studio.
Turn YouTube videos into deep learning resources with transcripts, bilingual translation, AI overviews, explanations, and notes. Bring your own keys.
给 AI 编码 agent 用的 skill 集合,Claude Code 和 codex 都能跑。novel-characters:把小说拆成角色设定集——人物画像、卡通形象提示词、音色提示词、三视图。 | Skills for AI coding agents, working in both Claude Code and codex. novel-characters turns a novel into a character bible: profiles, cartoon-design prompts, voice prompts and…
Standalone iOS app to spoof GPS location without jailbreak. Includes Shadowrocket/Surge/Loon/QX/Stash module.
LLM 驱动的多市场股票智能分析系统:多源行情、实时新闻、决策看板与自动推送,支持零成本定时运行。 LLM-powered multi-market stock analysis system with multi-source market data, real-time news, decision dashboard, automated notifications, and cost-free scheduled runs.
Graph-Native Infrastructure for Context and Accountable AI Systems
Anti-AI-slop design skill for Claude Code, Cursor, and Codex.
Convert Word, PowerPoint, Excel, OpenDocument, RTF, EPUB, CSV, and PDF to clean Markdown. Built in Rust, with Node.js and Python bindings.
Your Agent's Integration Layer
Free and open-source webshop solution for hostings
☁️ Nextcloud server, a safe home for all your data
An MCP adapter that bridges the Abilities API to the Model Context Protocol, enabling MCP clients to discover and invoke WordPress plugin, theme, and core abilities programmatically.
Firefly III: a personal finances manager
Empowering People Ethically 🚀 — Matomo is hiring! Join us → https://matomo.org/jobs Matomo is the leading open-source alternative to Google Analytics, giving you complete control and built-in privacy. Easily collect, visualise, and analyse data from websites & apps. Star us on GitHub ⭐️ – Pull Requests welcome!
The elegant testing framework for PHP developers and AI agents.
📦 The official Nextcloud installation method. Provides easy deployment and maintenance with most features included in this one Nextcloud instance.
A powerful open-source UI framework for Laravel • Build and ship apps & admin panels fast with Livewire
Personal CRM. Remember everything about your friends, family and business relationships.
🚦 Cachet, the open source, self-hosted status page system.
High performance, full-stack PHP framework delivered as a C extension.
Mautic: Open Source Marketing Automation Software.
A source-available invoice, quote, project and time-tracking app built with Laravel
Pterodactyl® is a free, open-source game server management panel built with PHP, React, and Go. Designed with security in mind, Pterodactyl runs all game servers in isolated Docker containers while exposing a beautiful and intuitive UI to end users.
Self-hosted database backup manager with a web UI. Schedule, backup, and restore MySQL, PostgreSQL, MariaDB, Microsoft SQL Server, MongoDB, SQLite & Redis to S3, SFTP, Samba or local storage. SSH Tunnel support.
MISP (core software) - Open Source Threat Intelligence and Sharing Platform
📓 eLabFTW is the most popular open source electronic lab notebook for research labs.
The Laravel AI SDK provides a unified, expressive API for interacting with AI providers such as OpenAI, Anthropic, Gemini, and more.
Michael explains why exit() can make parallel test workers crash without useful diagnostics, and why verbose flags do not help when the process dies outside PHPUnit's control. The fix is simple: throw an exception instead, so the failure is reported normally with a stack trace. …
Laravel AI SDK recently released a new v0.10, with new features, some them announced at Laracon US 2026 in Boston. This tutorial shows four practical features from this new version. But it may also be useful if you have not tried the Laravel AI SDK before. Let's dive in.
Agentimus 1.36.0 is on WordPress.org. Every release so far has added instruments; this one answers the question the instruments kept raising. You could open the plugin, read a 99, see the word “Excellent” — and still not know that five separate screens were quietly h…
I've been using Bruno for testing Laravel APIs, but I'm looking at alternatives as more of our API testing moves into CI/CD. The main things I need are: Run API tests from the terminal Support different environments Work with OpenAPI-based APIs Integrate with CI/CD Reuse the sam…
I'm interested in how other teams handle stale Laravel deployment caches on cPanel, Plesk, and FTP-only hosting. A reproducible case is: - the application already has cached configuration; - `.env` or a file under `config/` changes during an FTP deployment; - the host has no SSH…
I don’t like how we got here. Yes, this is—unfortunately—yet another AI thoughtpiece. I’m sure you must be tired of reading AI thoughtpieces. I won’t be offended if you skip this one. Before you jump, though, you should know that the emdashes in this paragraph …
We are counting down to SymfonyCon Warsaw 2026, taking place on November 26-27, 2026, in Warsaw (Poland)! Get ready for a week full of workshops, sessions, and community magic. 🎤 Speaker announcements Make sure not to miss Ramona Schwering, Developer Relations Engineer, mittwald…
Double is a PHP mocking library from Jason McCreary with one API for mocks, spies, and partials, plus failure messages that show the actual call log. The post Mock PHP Classes in Tests With the Double Library appeared first on Laravel News. Join the Laravel Newsletter to get all…
Self-hosted Laravel monitoring powered by laravel/nightwatch telemetry. Keep months of history in your own PostgreSQL with flat pricing from $5/month. The post Laravel monitoring that doesn't bill you by your traffic appeared first on Laravel News. Join the Laravel Newslett…
The growing digital asset industry requires reliable and secure infrastructure. Paranoid Security develops professional cybersecurity. Its capabilities include digital asset treasury platforms and crypto business infrastructure designed to support secure operations. [Paranoid Se…
Sebastian explains why Amp became his default coding harness, and why user experience now matters more to him than model churn. He also shares the AGENTS.md tweaks that reduced overzealous verification during day-to-day coding. Read more
Mercure 1.0 is here in its first public preview, and it is the biggest release in the project’s history! Mercure powers mission-critical real-time communication across hundreds of production deployments. It delivers Server-Sent Events over plain HTTP without requiring clie…
Hey Laravel community 👋 Chatify v2 beta is live — a real-time chat package for Laravel with direct messages, groups, saved messages, typing indicators, read receipts, attachments, voice notes, and a complete Vue 3 messenger UI at `/chatify`. What's new in v2: • Group conversatio…
Most of the Laravel projects I work on expose REST APIs, and I've been trying to move more of my API testing into the terminal instead of relying on a GUI. The goal is simple: use the same workflow locally and in CI/CD. I'm looking for a terminal-based API testing tool that can:…
Yii auth version 3.3.0 was released. In this version: Split AuthenticationMethodInterface into focused authentication and challenge interfaces Bump minimal PHP version to 8.1 Explicitly mark readonly properties Explicitly import classes and functions in "use" section Remove unne…
Laravel is one of the most loved PHP frameworks out there, but "loved by developers" and "loved by Google" aren't automatically the same thing. A lot of teams ship a beautiful Laravel app, wire up Blade or Inertia on the front end, launch, and then wonder six months later why or…
Most of the Laravel applications I work on expose REST APIs, and we've been trying to move more of our API testing into the terminal instead of relying on a GUI. The main goal is to use the same workflow locally and in CI/CD. We were looking for a tool that can: Run API tests fr…
Yii DB Migration version 2.1.0 was released. In this version: Add MigrationBuilder::insertBatch() method, deprecate batchInsert() Explicitly import classes, functions, and constants in "use" section Remove unnecessary files from Composer package Remove confirmation prompt from m…
I replaced our Queue/Horizon tier with a database-backed job engine; now stable, feedback welcome Background: I run a fairly large Queue/Horizon implementation (six-figure job counts, multi-host workers, nightly batch DAGs hundreds of jobs wide), and I kept hitting the same arch…
Hi I am pretty new at laravel and is quite impressed with the massive support in terms of tech stack and more. I am a business analyst with some little experience in coding, i have always been a wordpress person but really impressed with the creativity laravel brings. I am worki…
I've been working on Laravel API projects and recently started reviewing our API documentation workflow. Swagger/OpenAPI tools have been useful for generating documentation, but as projects grow, we're looking for a workflow that covers more than just documentation. Some things …
Yii2 Safaricom Daraja Extension ¶ Example Application Compatibility Installation Yii2 Configuration Environment Variables Basic Usage Yii2 MVC Pattern Example Model: STK Push Form Example Controller STK Push and Query C2B URL Registration and Simulation B2C, B2B, and B2Pochi Rev…
Yii Bulma version 1.1.0 was released. In this version: Bump yiisoft/html version to ^4.2.0 Adapt configuration to changes in yiisoft/form Change PHP constraint in composer.json to 8.1 - 8.5 Adopt last change yiisoft/widget Refactor yiisoft/html classes usage Explicitly import co…
Yii2 eCitizen Payment Extension ¶ What This Package Does What This Package Does Not Do Compatibility Installation Yii2 Configuration Environment Variables Yii2 MVC Pattern Basic Checkout Usage Callback URL Building Example Model: Payment Form Example Controller: Checkout Example…
Yii-Permission ¶ Installation Usage Define your own model.conf Learning Casbin License An authorization library for the Yii 3.0 PHP Framework, based on Casbin. Installation Getting Composer package Configuring application Database Migration Usage Quick start Using Enforcer Api U…
Hi everyone! 👋 I've just open-sourced **Laravel Cooldown**, a package for managing **action cooldowns** in Laravel. While Laravel's built-in `RateLimiter` is excellent for request throttling, I found myself repeatedly needing a reusable solution for **time-based action restricti…
Yii2 PHPStan rules Support Installation Configuration Rules at a glance Rule reference A set of PHPStan rules for Yii2 projects that I put together for my own day-to-day work. Yii2 leans heavily on loosely-typed config arrays and magic properties/methods that PHPStan can't see t…
Hey everyone, I recently built an open-source Textile ERP system and wanted to share it with the community here. While this is built entirely in the Next.js ecosystem, I know a lot of us use React/Next.js alongside our typical backend stacks, so I thought it might be of interest…
Been writing Laravel for years. Every time a project pulls me into Node.js territory, whether it's a side project, a microservice, or just helping a team, the first thing I notice is that nothing feels like Eloquent. Prisma is fine but it's a different mental model entirely. Typ…
Yii2 Sentry ¶ Features Installation Configuration Built-in Collectors Usage How Collectors Work Creating a Custom Collector License Read this in other languages: English, Русский Complete Sentry integration for Yii2 framework: logging, tracing and profiling. Features ¶ Tracking …
Hi everyone, I've been building **KAAL Realtime**, a Laravel package that enables **live updates across connected browsers** while letting you continue using standard Blade templates.  method to Button widget Raise yiisoft/html version to ^3.13 || ^4.0 Fix Collapse re-encoding content already managed by Toggler
Voyti — Yii3 User Management Extension ¶ Features Requirements Installation Documentation Testing войти /vɐjˈtʲi/ verb "to enter" or "to log in" Highly customizable and extensible user management, authentication, and authorization extension for Yii Framework 3. Originally ported…
Yii3 reCAPTCHA ¶ Features Requirements Installation Documentation Testing Google reCAPTCHA v2 and v3 form field + server-side validator for Yii3. Stats for Nerds Features ¶ reCAPTCHA v2 — checkbox/invisible widget field with theme, size, and type options reCAPTCHA v3 — score-bas…
If you’re a **Laravel developer**, you know the pain: you finish a feature, but then you spend another 30 minutes updating YAML files or adding messy docblock annotations just so the frontend team knows how the API works. I built **Laravel API Visibility** to change that. No ann…
Hi Guys, Good day! Can you share some real websites using Laravel? And If I have a website, how do I know if there's any tags or signs that shows it's using Laravel? AI tells me to check like this document.cookie.includes('laravel_session') to see if such a cookie...is that true…
I'm using Laravel 13 and accessing my app via ngrok. I noticed that changing APP_URL in my .env file doesn't affect asset() it still generates localhost URLs. After digging in, I found two ways to fix it: 1. Set ASSET_URL to the ngrok URL 2. Add URL::forceRootUrl(config('app.url…
As a trusted [](https://www.nxdeep.com/erp-software-development), NxDeep Connectz creates strong and scalable ERP solutions designed for specific business needs. Our ERP systems bring together essential business processes, remove data silos, and improve operational efficiency th…
Hey Laravel community! I built Pterocos (https://pterocos.eu.org) - a free online editor that runs PHP code entirely in your browser. No installation, no account required. **Why Laravel developers might find this useful:** - Quickly test PHP snippets without local setup - Protot…
Hi everyone, I’ve been running into an issue in queue-heavy Laravel apps where the real origin of a change gets lost. Typical flow: HTTP request → service → queue → job → model update By the time the model is updated, the audit log usually only shows the job or system as the act…
I often need to compare different versions of documentation, website content, configuration snippets, and notes. Git works great for source code, but for plain text I sometimes find it more convenient to use a dedicated comparison tool. I'm interested in learning what other deve…
Hey everyone 👋 I built a small Laravel package for filtering Eloquent models via request query strings, and I'd love to get some feedback from the community. **Package:** https://github.com/AhmedEzz20/laravel-query-filters **Packagist:** https://packagist.org/packages/dev-astro/…
Hey everyone, I recently released the first alpha of **CarvePHP**, an open-source Laravel package for teams working with large Laravel monoliths. The goal is not automatic “one-click microservices.” I know that is not realistic for most real-world systems. Instead, CarvePHP focu…
JWT, JWE, JWS, etc. are terrible designs and need to be scrapped, not resuscitated.
A deep dive into the security engineering decisions that went into CMS Airship. A lot of the decisions we made are subtle.
Application security has a checklist problem; we propose a better way forward.
How to implement field-level data encryption while still allowing fast queries.
Why your software product needs code audits (particularly with cryptography), and how we deliver a higher standard of service.
A quick comparison of libsodium functions with similar names/purposes, and which one to use for a specific use case
How to use Sapient, our new Secure API Toolkit, to Harden your PHP 7 software.
With Chronicle, you probably don't need a blockchain to solve your problems anymore.
A reflection on the first six months of the year, ext/sodium landing in PHP 7.2, and where to go from here.
Ward is our latest security product, intended to help secure e-Commerce platforms.
How to build your own automatic update system that is verifiably secure.
Recent events have put supply chain attacks against software updaters on everyone's radar. Scott explains what this means and what to do about it.
Our new open source library, which keeps your Certificate Authority certificate bundle up-to-date.
Introducing PIE-Hosted Services to Help Further our Goals to Secure the Entire PHP Ecosystem
How to build a homomorphic encryption scheme that is not vulnerable to chosen-ciphertext attacks, using blockchain-like protocols.
Everything a developer needs to know to build secure software in the PHP programming language in the year 2018
Let's solve application security at an ecosystem level by updating outdated and/or insecure blog posts to refer developers to better practices.
Paseto (Platform-Agnostic Security Tokens) is everything JWT should be, but isn't (namely, secure)
Our company's name was decided on March 14, 2015, which makes its birthday very easy to remember.
A deep dive into preventing chosen-ciphertext (e.g. padding oracle) attacks against RSA in custom encrypted transport protocols.
A brief overview of the various common use-cases of asymmetric cryptography (also known as "public-key cryptography") from the perspective of a software developer.
If you're planning on implementing the W3C and FIDO Alliance's new WebAuthn standard for hardware security token support, skip ECDAA for now.
Paragon Initiative Enterprises answers several reader questions
We have a lot of work ahead of us in 2019, and we hope it benefits the entire PHP community
CipherSweet is a PHP library that provides searchable encryption for the most common cases a web developer is likely to encounter.
A simple, accessible recommendation for key sizes and recommended algorithms for various cryptographic algorithms.
We wrote a cryptography library entirely in PHP to make your WordPress site secure against supply-chain attacks.
Your webserver can initiate HTTP requests too, and securing those matters a lot.
We'll be doing for JavaScript (Node.js) what we've been doing for PHP for several years now.
Why versioned protocols are superior to "cipher agility"-based cryptographic designs.
Introducing Ristretto255 for PHP developers
Announcing new versions of the PASETO protocol, which offer better arguments for security in a wider range of use cases.
PASERK adds public-key encryption, key-wrapping, key serialization, and unique key identification to PASETO.
How we plan to discourage insecure implementations of PASETO.
Our project, Gossamer, is the best first step to solving supply chain security for the PHP ecosystem.
A short summary of the work we've done to make the Internet more secure for everyone.
Your PHP 5 code won't break, but your PHP 8.1+ code will be faster and cleaner
Leveraging the ubiquity of the PHP programming language to make everyone more secure.
Announcing a PHP extension and pure-PHP polyfill providing post-quantum cryptography for the PHP open source software community.
Introduction Installation Quick Setup Core Features Best Practices Common Patterns Troubleshooting Additional Resources Conclusion Introduction ¶Inertia.js is a modern approach to building single-page applications (SPAs) without the complexity of building an API. It allows you t…
yii2-recurring-date ¶ Main Features Installation Usage JSON Format (persisted) Calculation of the Next Expiration Date Configuration and Customization Validations and UX Behavior Internationalization (i18n) Tests Best Practices and Notes Contributing License A Yii2 extension/wid…
ChartJs Widget ¶ Installation Usage Further Information Contributing Credits License Este paquete es un fork de 2amigos/yii2-chartjs-widget, el cual se encuentra en modo de solo lectura. Este fork fue creado para mantener vivo el paquete y continuar su mantenimiento. Renders a C…
Yii2 IDE Helper ¶ 功能特性 安装 使用 PhpStorm Meta 文件详解 PhpStorm 配置 生成文件示例 测试 贡献 许可证 致谢 为 Yii2 框架提供 PhpStorm 智能代码补全支持,灵感来源于 barryvdh/laravel-ide-helper 功能特性 ¶ ✅ 为 Yii2 组件生成完整的 PHPDoc 类型提示 ✅ 为 ActiveRecord 模型生成属性和方法文档 ✅ 为 ActiveQuery 生成查询构建器提示 ✅ 生成 PhpStorm Meta 文件支持高级 IDE 特性(DI 容器、类型推断)…
First stable version of FrankenPHP worker runner released. The runner allows using FrankenPHP in worker mode. In this mode application is initializer once per worker and is serving multiple reqests in this state resulting in signficiant performance gains. Since the application d…
Yii Log Email Target version 4.2.0 was released. In this version: Change PHP constraint in composer.json to 8.1 - 8.5 Raise the minimum yiisoft/mailer version to ^6.0 and adapt the code accordingly Explicitly import classes in "use" section
We are pleased to announce the release of Yii Framework version 2.0.55. Please refer to the instructions at https://www.yiiframework.com/download/ to install or upgrade to this version. In this release: Security fix for CVE-2026-39850: internal variables in View::renderPhpFile()…
Yii RBAC PHP File Storage version 2.1.0 was released. In this version: Change PHP constraint in composer.json to 8.1 - 8.5 Bump yiisoft/rbac version to ^2.1 Apply code style fixes Explicitly import functions and constants in "use" section
Yii Active Record version 1.1.0 was released. In this version: Clarify $relations parameter type in JoinWith::__construct() from array<string|Closure> to array<string|callable(ActiveQueryInterface):void> Optimize performance of ActiveRecord::get() method Remove check…
Yii HTML version 4.1.0 was released. In this version: Add test helper functions for controlling HTML ID generation
Yii Runner RoadRunner version 3.2.0 was released. In this version: Add PHP 8.5 support Add spiral/roadrunner-http version ^v4.0.0 support
Yii HTML version 4.2.0 was released. In this version: Add beforeInput() and afterInput() methods to abstract BooleanInputTag, extended by Radio and Checkbox Add beforeCheckbox() and afterCheckbox() methods to CheckboxList, and beforeRadio() and afterRadio() methods to RadioList