A secure drop box for tips and misconduct reports, GlobaLeaks lets organizations, newsrooms, and public institutions receive anonymous submissions and reply to the people behind them. Whistleblowers answer a questionnaire, attach files, and leave with a unique 16-digit receipt that reopens their report later for replies, comments, and the choice of whether and when to reveal their identity. Administrators build the intake form with a questionnaire builder, route reports through channels by topic or department, and host several branded whistleblowing sites from one installation in more than 90 languages. Recipients triage in a searchable inbox with labels, reminders, and customizable case statuses. Analysts, custodians, and administrators get separate roles, and the custodian role can gate access to a reporter's identity. Reports and messages are encrypted, an automatic Tor onion service gives whistleblowers an anonymous way in, two-factor authentication protects staff logins, and PGP secures email notifications. Audit logs track staff actions, and retention rules expire old reports to support GDPR duties and EU Directive 2019/1937 workflows. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Ory Hydra is an OpenID Certified OAuth 2.0 and OpenID Connect provider that plugs into any existing user database or authentication system through a headless consent and login bridge, letting you own your authorization infrastructure without rebuilding identity management from scratch. The Go binary ships at under 15MB with zero system dependencies and exposes two distinct API surfaces: a public endpoint on port 4444 handling authorization code flows, token exchanges, PKCE challenges, device authorization grants per RFC 8628, and OpenID Connect discovery, plus an admin endpoint on port 4445 managing client registration, token introspection, consent session lifecycle, and JWKS rotation. Access tokens can be issued as opaque reference tokens or signed JWTs for stateless validation at resource servers, while refresh token rotation, token revocation per RFC 7009, and pairwise subject identifiers provide granular security controls. Persistent storage spans PostgreSQL, MySQL, and CockroachDB with automatic schema migrations, and the architecture supports horizontal scaling behind load balancers with shared database state. Dynamic client registration per RFC 7591 enables automated provisioning, and the OAuth 2.0 Threat Model security considerations are implemented as default behaviors rather than optional add-ons. Trusted by OpenAI and other internet-scale platforms. Helm charts and Docker Compose quickstarts provide production-ready deployment paths alongside the broader Ory ecosystem including Kratos for identity management, Oathkeeper for zero-trust API proxying, and Keto for fine-grained permissions. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Agentic SOC Platform compresses hours of manual security analysis into seconds by deploying specialized AI agents that autonomously triage, investigate, and enrich security alerts. The Python/Django backend processes SIEM webhooks through Redis Streams into a modular pipeline where LangGraph-orchestrated agents extract IOCs, correlate signals, and generate Cases with severity, confidence, impact, priority, and structured verdicts. The built-in SIRP provides full case management with Alerts, Artifacts, Enrichments, Tickets, and a Knowledge base that accumulates institutional memory for both human analysts and LLM agents. Native Splunk and Elasticsearch/Kibana integrations deliver unified log search through a standardized interface so agents and analysts share identical security context. The playbook engine combines traditional SOAR automation with AI-powered investigation — launching threat hunting agents, knowledge extraction, threat intelligence enrichment, and CMDB lookups from a single orchestration layer. MCP Plugin support exposes ASP capabilities to Claude Code, Codex, and OpenCode, enabling external AI agents to operate cases, search logs, query threat intelligence, and write custom modules directly. Python Modules adapt new alert sources while Playbooks orchestrate LLM analysis and automated response actions, scaling the platform with your security scenarios. Deploy via Docker Compose with all data staying inside your network. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Parse DMARC reads the DMARC aggregate reports that Google, Microsoft, and Yahoo email about your domain every day and shows you, in one dashboard, who is sending mail as you and whether it passes authentication. It fetches the reports over IMAP, unpacks the gzip, zip, and XML attachments automatically, and charts your pass rate, message volume, and top sending sources at a glance. Any report opens down to its raw records, so when an unfamiliar IP starts sending as you, the evidence is one click away instead of buried in XML. Reports forwarded through Exchange or Outlook as message attachments are unwrapped too, and a local Maildir intake covers servers where the mailbox lives on the same host. A built-in generator writes your _dmarc TXT record from a form, so tightening your policy does not mean hand-writing DNS syntax from memory. Twenty-eight Prometheus metrics and a shipped Grafana dashboard move the same data into the monitoring stack you already run. An MCP server lets an AI assistant query your reports directly, asking which sources failed DKIM this week in plain language. Everything stores in a single SQLite file inside one static Go binary, with dark mode for late-night incident reviews. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Ultimate Certificate Manager, or UCM, runs your own certificate authority from a web interface, so issuing, renewing, and revoking certificates stops being a pile of OpenSSL commands. Create root and intermediate CAs, arrange them in a hierarchy, and manage every certificate through its life: issue, sign, renew in place, revoke with a reason, and export as PEM, DER, PKCS#12, or JKS. Devices and servers enroll themselves through ACME, SCEP, and EST endpoints, while OCSP answers status checks in real time and CRL distribution points publish revocations on schedule. Network discovery scans your address space and reports the certificates it finds, so expiring or unknown certificates surface before they cause an outage. Templates define server, client, code-signing, email, and smartcard profiles, with key types from RSA and elliptic curves to post-quantum ML-DSA, and issuance policies can route sensitive requests through an approval queue. Signing keys can live in an HSM so private material never leaves the hardware, and every key at rest can be encrypted under a master key. Operators sign in with passwords, TOTP, WebAuthn, mTLS, LDAP, OAuth2, or SAML, and role-based permissions decide who may issue, approve, or merely audit. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Most AI agents are a chat box with confidence; Antares is a working security specialist that shows its evidence. Point it at a target you are authorized to test and its specialist agents map the surface, test web applications against OWASP, probe APIs, and record every confirmed finding with its reproduction steps. When the run ends, the findings are already compiled into a report, because the agent kept the evidence as it went instead of reconstructing it afterward. The same workspace handles ordinary work between engagements: it reads and writes files, runs your shell, drives a real browser, searches the web, and retrieves from a built-in memory and RAG index that remembers what matters across sessions. Give it a goal and it holds to that goal across turns, schedules its own follow-up work, and answers from Telegram and Discord when you are away from the dashboard. Bring your own models, since everything runs on your machine or server from one binary, with the dashboard, terminal UI, and API served by a single process. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Security-conscious IT departments pick Passbolt for its cryptography: every user holds an OpenPGP key pair, and shared credentials are encrypted individually to each recipient's public key - real end-to-end encryption, not a vault password handed around. All crypto runs client-side in the mandatory browser extension (distributed and signed through the Chrome and Firefox stores, deliberately separating the crypto code from the server that stores ciphertext); private keys and passphrases never touch your instance, and the server admin cannot read a single secret. Authentication uses the challenge-based GpgAuth protocol, secrets are digitally signed to verify sender integrity, and metadata encryption extends protection to resource names and URLs. Day to day it behaves like a polished commercial manager: auto-fill and auto-save in forms, strong password generation, anti-phishing protection, TOTP storage, folder hierarchies shared per-user or per-group with fine-grained permissions and instant cryptographic revocation. Native iOS, Android, and desktop apps ship alongside a JSON API, CLI, and SDKs for CI/CD secret retrieval and rotation. The PHP server runs on MariaDB and is AGPL-licensed open source - including the paid tiers' codebase - with published security audits.

Backed by 9,000+ GitHub stars and developed by a Germany-based team with deep FIDO2 expertise, Hanko delivers the open-source authentication platform that replaces Auth0, Clerk, and Firebase Auth with a passkey-first architecture built on phishing-resistant WebAuthn credentials. The Go backend exposes both public and administrative HTTP APIs handling passkey registration and login, password authentication, email passcodes, TOTP-based MFA, security key verification, server-side sessions with remote revocation, and JWT issuing with configurable expiry and refresh policies. OAuth SSO connects Apple, Google, GitHub, Microsoft, and custom OIDC providers, while SAML Enterprise SSO integrates corporate identity providers for single sign-on across the organization. Hanko Elements provides framework-agnostic web components that embed complete onboarding, login, and user profile flows into any application with two lines of code, fully customizable via CSS variables and supporting i18n with custom translations. The JavaScript frontend SDK handles API communication, credential management, and session state for teams building custom authentication UIs without the pre-built components. Webhooks notify external services of authentication events including user creation, login, email verification, and password changes. Privacy-first design principles enforce data minimalism with user-deletable passwords and configurable identifier strategies supporting email-only, username-only, or combined approaches. Docker deployment starts the backend with PostgreSQL or MySQL, serving both APIs on configurable ports. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 (backend) / MIT (frontend) licensed.

Big repositories, small questions: Open Kritt is a self-hosted platform that splits vulnerability research into focused tasks for AI agents and returns ranked, de-duplicated findings. Build a workflow as a tree of prompt steps, where each step declares the structured output it must produce and the next level launches one fresh agent per result. Scan remote or local repositories along with their dependencies, using Codex, Claude Code, or Grok Build as the harness. Every workflow ends in one fixed finding schema covering file, line, vulnerability type, trigger flow, and a malicious input example. Post-scripts then validate each finding, build a proof of concept, or write the report. Markdown severity rankers tell the model how to prioritize for your bounty program, and repeated findings collapse automatically. Model access comes from a Codex login or OpenAI, Anthropic, DeepSeek, OpenRouter, or xAI keys, with an Active switch to choose which accounts take new work. A dashboard tracks blueprints, scans, and findings, a headless command-line tool imports workflows and launches scans on servers without a browser, and finished scans export as one ZIP with a share-safe manifest. Built-in workflows, including an entry-point-driven hunt, give you a starting point. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Watchtower puts AI-driven security assessments into one web console, where sessions probe your attack surface while every request, finding, and piece of evidence is captured as it happens. The AI session console follows the attack surface, session progress, tool calls, and findings as an assessment runs, so you can watch an engagement unfold instead of reading a log afterwards. A built-in proxy workflow records HTTP and HTTPS traffic history with highlighted patterns, and any captured request can be sent to the Repeater for editing, replay, and response comparison. Mobile work is covered too: connect phones over USB or wireless, capture app traffic separately from accessibility control, and import WeChat mini-program packages to configure an assessment session. A public vulnerability intelligence library can be searched by component, severity, and source and kept synchronized locally, giving assessments current context without sending your targets anywhere. Findings are managed by source, severity, and status, each linked back to its supporting evidence, and the report editor assembles them with a live preview, impact notes, and remediation guidance. The dashboard tracks assets, tasks, AI sessions, token usage, and runtime resources, and task admission is budgeted against physical memory so heavy scans do not starve the host. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Every production incident starts the same way: someone asks "what do the logs say?" and the answer takes 45 minutes to find. LogTide collapses that search into seconds with a unified observability platform that indexes logs, traces, and metrics into a single queryable interface, backed by your choice of TimescaleDB, ClickHouse, or MongoDB. The log search interface supports full-text queries across millions of entries with filters for trace ID, session ID, project, service, hostname, and severity level, plus a live tail mode that streams new log lines as they arrive. Distributed traces render as waterfall timelines showing every span, its duration, and cross-service dependencies, while correlated logs for each trace are one click away. The metrics explorer visualizes OTLP gauge and counter data from your applications with system CPU, memory, disk, and network panels that update in near real-time. Where LogTide diverges from standard observability is its built-in SIEM engine: Sigma-compatible detection rules scan incoming logs for security threats like SQL injection, privilege escalation, lateral movement, and C2 communication, surfacing findings on a dedicated security dashboard with severity distribution, detection timelines, and affected service breakdowns. Alerting pushes notifications to Email, Slack, or Discord webhooks when thresholds trip or security rules fire. Native SDKs for Node.js, Python, Go, PHP, Kotlin, and Ruby ship logs with retry logic and circuit breakers, and the platform accepts OpenTelemetry data natively. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Four hundred servers need a security patch, they run five different Linux distributions, and a spreadsheet says which ones were done. Uyuni replaces that spreadsheet: one server inventories your fleet, mirrors the software channels each machine subscribes to, and shows exactly which patches and errata apply where. Administrators register clients manually, by bootstrap script, or automatically through activation keys, then group them into systems sets so an action aimed at a group lands on staging first and production on schedule. Patch management creates and applies errata with CVE context, and CVE audits check systems against vulnerability data so you can prove a fix landed instead of believing it did. Configuration channels push files, directories, and symbolic links rendered with Jinja templates through the built-in Salt master, which also runs remote commands and orchestration across tens of thousands of clients. The Content Lifecycle Manager promotes package sets from development through testing to production channels, so every environment consumes tested content in order. Provisioning reinstalls or network-boots machines through PXE with AutoYaST, Kickstart, or cloud-init profiles, proxies cache content for branch offices, and built-in Prometheus and Grafana monitoring watches the management server itself. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-2.0 licensed.

LaraOwl watches your Laravel applications from your own server, streaming every request, exception, slow query, and attack attempt into one live dashboard. Install one Composer package in each app, point it at your LaraOwl server, and requests arrive with method, path, status, duration, and middleware timing attached. Exceptions group themselves by fingerprint with stack traces, occurrence counts, and first and last seen times, so a resolved bug that comes back announces itself. Slow queries and N+1 patterns are flagged with execution times, jobs report failures and retries, and scheduled tasks check in like heartbeats that complain when they stop. A built-in security lens scores threats such as SQL injection, cross-site scripting, and path traversal, tracks hostile IPs, and can push a block into your Cloudflare firewall in one click. Uptime checks run every thirty seconds, alerts fan out to Slack, Discord, Telegram, email, or any webhook, and throttles keep a bad night from becoming a thousand messages. Teams organize multiple projects with their own tokens, thresholds, and retention policies, and daily pruning keeps last quarter's noise from filling the disk. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Most home and office networks quietly accumulate dozens of devices nobody can name, and LAN Orangutan answers the basic questions about all of them: what is connected, what changed since yesterday, and what should not be there at all. It scans one or several networks with nmap and merges in the host ARP table, resolving MAC addresses, manufacturers, hostnames, and device types so a phone, printer, TV, and server each show up as themselves rather than as bare IP addresses. You label devices, file them into your own groups and locations, and attach notes that survive every rescan, turning a one-off scan into a maintained inventory. Snapshots freeze the network at a moment in time, and comparing two of them shows exactly which devices appeared, vanished, or moved to a new address. Mark the devices you expect, and the dashboard flags newcomers and missing hardware, with webhook notifications to Telegram, Discord, Slack, ntfy, or Home Assistant when something changes. Tailscale peers appear next to local devices, so the laptop on your tailnet and the printer downstairs live in the same list. Risky exposures such as Telnet or FTP get flagged, scans show live progress you can cancel, and a password you create on first open guards the whole dashboard. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

TLSPROXY puts automatic Let's Encrypt TLS in front of every service on your server, so many names can share one port while each backend gets exactly the encryption treatment it needs. Terminate TLS and hand plain text to a local service. Pass raw TLS straight through when the proxy should see nothing. Or terminate and re-encrypt towards a TLS backend, with client certificates checked on the way in. QUIC and HTTP/3 connections terminate here too, and Encrypted Client Hello keeps even the handshake private. Certificates arrive and renew by themselves through http-01 and tls-alpn-01 challenges, PROXY protocol headers preserve real client addresses, and SNI routing with round-robin balancing spreads names across backends. People get in with OpenID Connect, SAML, or passkeys; the same sign-in can mint short-lived SSH user certificates, and built-in certificate authorities manage client and backend credentials for you. Static sites can be served straight from disk, TPM-backed keys keep private material in hardware, and a built-in console shows what the proxy is doing. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Eliminate scattered configuration files and leaked credentials across development teams with Shelve, an open-source secrets management platform that secures environment variables across development, staging, and production tiers. Engineering teams can organize sensitive database passwords and third-party API credentials within a centralized vault protected by AES-256 encryption and SHA-256 integrity verification. The platform synchronizes configurations directly to GitHub Actions and repository secret stores through an official GitHub App integration. Developers can inject encrypted variables directly into local processes using the dedicated CLI without saving plain-text secrets to disk. The built-in sharing vault creates self-destructing, password-protected links to exchange sensitive credentials securely with external contractors. Administrators can define custom workspace teams with granular role-based access controls, track change audit logs across configuration histories, and navigate management views using a keyboard-driven command palette. Automated schema validation engines detect missing parameters and enforce uniform uppercase naming standards across application tiers. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Fail2Ban quietly bans thousands of bots on a typical VPS and just as quietly keeps the whole story buried in a log file nobody reads, and Fail2Ban Report digs that story out into a dashboard you will actually open. Shell scripts convert each day of fail2ban.log into JSON, and the web interface lays every ban and unban on a searchable, filterable timeline you can slice by jail, server, or time window. Aggregated statistics for today, yesterday, seven days, and thirty days show which jails absorb the most attacks, while markers flag repeat offenders and escalating ban counts so persistent scanners stand out from one-time noise. Blocklists live per jail and per server as plain JSON, and ban or unban actions execute through UFW, giving you permanent bans that survive independently of jail restarts. Bulk actions handle whole ranges at once, with a pending state until the next sync applies them. Multiple servers feed one console through a pull-based HTTPS endpoint, so a fleet of small machines reports to a single pane without exposing SSH. Optional AbuseIPDB and IP-Info lookups add reputation and region context to any address. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Bots that knock on your server's login ports are always turned away by Knock-Knock, a multi-protocol honeypot that shows every attempt on a live dashboard. Honeypots answer on the standard ports for SSH, Telnet, FTP, RDP, SMB, SIP, HTTP, and SMTP, with MQTT, Node-RED, Modbus, S7, and SNMP as optional extras. Authentication is always rejected, so no bot ever gets a shell. Who is knocking? The live feed shows each attempt's country, username, password, ISP, IP, and protocol. From where? A 3D globe marks the origin in one of six styles, including an extruded country heat map. Trying what? Leaderboards rank countries, usernames, passwords, ISPs, and IP addresses, and a trivia panel explains why bots favor certain credentials. A protocol filter re-slices the feed, globe, and leaderboards together; SIP shows dialed numbers and toll-call destinations, and RDP shows hostnames and accounts. Too fast? Press the space bar to pause, right-click any knock for details, or switch on a virtual Geiger counter that clicks as attacks arrive. Want to fight back? Download hourly 30-day and 365-day blocklists with recipes for CSF, CrowdSec, ipset, nftables, and pfSense, or query the optional API for any IP, CIDR range, or ASN. Several honeypot servers can stream into one aggregated dashboard. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.