Method
How the list is built, what each status and note means, and what the data does not tell you.
Where the tools come from
The catalog combines the GitHub entries of the curated lists below. Entries that point anywhere other than a GitHub repository are left out, because their maintenance cannot be measured the same way. Tool names come from the lists. Descriptions are each repository's own description on GitHub, written by its owner.
The categories are hackshelf's own. Each section of a source list is assigned to one of them, and the section heading is kept as the subcategory.
| List | License | Tools |
|---|---|---|
| awesome-cyber-security-tools | CC0-1.0 | 42 |
| awesome-incident-response | Apache-2.0 | 77 |
| awesome-forensics | CC0-1.0 | 51 |
| awesome-detection-engineering | CC0-1.0 | 18 |
| awesome-threat-detection | CC0-1.0 | 35 |
| awesome-security | MIT | 12 |
| awesome-threat-intelligence | Apache-2.0 | 72 |
| my-arsenal-of-aws-security-tools | Apache-2.0 | 30 |
| awesome-malware-analysis | CC-BY-4.0 | 31 |
What is checked
Once a week a GitHub Actions job reads each repository through the GitHub REST API: whether it is archived, the latest commit on its default branch, the number of commits per week over the last 52 weeks, the latest published release and its files, the license GitHub detects, the star count, and the security advisories the maintainers published. Nothing is cloned, downloaded or run.
Status
| Active | Last commit on the default branch within 90 days. |
|---|---|
| Slowing | Last commit 91 to 365 days ago. |
| Inactive | No commit for more than 365 days. |
| Archived | The owner archived the repository on GitHub. It is read-only. |
| Unavailable | The repository was deleted, made private or blocked since it was listed. |
The days are counted from the commit date recorded in Git. Whoever makes a commit can set that date, so a single recent commit is weaker evidence than a regular history. That is why each tool also shows its commits per week: a tool with commits in 30 of the last 52 weeks is maintained differently from one with a single commit last month. The page recalculates the status from the commit date when it is opened, so an older snapshot does not show an outdated status.
The scale next to each tool runs from today to two years; the two lines mark 90 and 365 days. Status describes maintenance activity only. It does not say whether the code is safe to run, whether it works, or whether it is the right tool for a task. Some tools are finished and need few changes; read an inactive status together with the open issues on the repository.
Repository identity
GitHub repositories can be renamed or moved to another account, and the old name can then be registered by someone else. To avoid following a name to a different project, each tool is pinned to its numeric GitHub repository id when it is first checked and is always looked up by that id afterwards. When the pinned repository has a new name, the page shows the name it was listed under. When it moved to another account after it was listed, the page says so in red and the change is reviewed by hand.
Notes shown on a tool
| No signature or checksum file | The latest release offers files to download but no file to verify them with. |
|---|---|
| Checksum file only | The release has a checksum file but no signature. A checksum detects a damaged download; it does not show who built the file, because it is published next to the file it describes. |
| No license file | GitHub found no license. Without one, the default copyright rules apply to the code. |
| No published releases | The project publishes no GitHub releases, so builds come from the source or from elsewhere. |
| Fork of another repository | The listed repository is a fork; the original may be maintained separately. |
A signature file is recognised by its name (.sig, .asc, .minisig, Sigstore bundles, in-toto attestations). The file itself is not downloaded or verified.
Security advisories
A tool page lists the security advisories its maintainers published on GitHub. Vulnerabilities that were reported only elsewhere, for example only in the NVD, do not appear there.
Changes
From October 19, 2026, every weekly check records status changes, new releases and moved repositories. The changes page shows the last eight weeks and is also available as an Atom feed.
Data
The full data set is published as tools.json, with collection errors in meta.json. If a repository cannot be read during a run, its previous record is kept with its own check time.