crimeforgood.xyz GitHub

We do what attackers do first. Then we tell you.

crimeforgood finds leaked keys, booby-trapped repos and hacked sites the way an attacker would, and reports them instead of using them. The lists and the tools are open source.

See what we do Follow on GitHub

Pre-launch. The scanner and the lists are being built in the open.

Same playbook, different ending

Attackers sweep for what's left open and probe what's meant to hold. So do we. The difference is what happens next.

  • Open lists and tools

    We scan public GitHub repositories and publish what we find: repos built to harm you, and repos that will leave you exposed. Anyone can download the lists and run the tools.

    Building now

  • Telling the victims

    Threat feeds block hacked sites as if they were malicious, and nobody tells the owner. A dentist whose site is serving injected phishing links needs to hear about it, not just land on a blocklist.

    Planned

  • Research without the spotlight

    Plenty of skilled researchers skip bug bounties because they don't want their names known. Companies hire crimeforgood for agreed security work and deal only with us; the researchers do it as our contractors, and the client never learns who they were.

    In development

  • A red-team harness anyone can run

    The tools that stress-test AI models cost enterprise money, and the attacks baked into them aren't that sharp. We're building an open harness of real adversarial prompts that runs against any model through its API. You pay for the tokens, not the licence.

    In development

Two lists, kept apart

A repo that attacks you and a repo with a bug in it are different problems. They get different lists, different evidence and different publishing rules.

Malicious

Repos written to hurt whoever runs them: typosquats, credential stealers, backdoored forks, fake exploit code that carries a payload.

Published
As soon as the evidence is recorded
What to do
Don't clone it, don't install it

Vulnerable

Honest projects with a flaw that puts their users at risk: leaked secrets, known-vulnerable dependencies, unsafe defaults. Not bad, but worth knowing about.

Published
After the maintainer has been told and had time to fix it
What to do
Pin, patch or wait for the fix

Every entry shows its evidence

A listing is a claim about someone's code, so each one says which rule fired, on which commit, in which file. If you can't reproduce it, it shouldn't be there.

These are example records with made-up repos. Field names may change before the first release.

list        malicious
repo        github.com/example-user/reqeusts-toolkit
finding     Install script sends environment
            variables to a remote host
rule        install-hook-exfiltration
commit      3f9a1c2
file        setup.py, line 14
first seen  2026-01-01
status      published

How a repo gets listed

  1. Scan

    Open source rules run against public code on GitHub. We read repositories. We don't probe anyone's live systems.

  2. Record the evidence

    A finding only counts with the rule, commit, file and line attached, so anyone can check it.

  3. Tell the maintainer

    For vulnerable repos, the maintainer hears first and gets time to fix it. Malicious repos skip this step.

  4. Publish

    The entry goes on the open list, free to download and build on.

  5. Correct

    Anyone can dispute an entry. Fixed repos come off the vulnerable list, and mistakes are removed in public.

Tools for everyone

Nothing here ships yet. This is what's being built first, and all of it will be open source.

  • Check a repo

    Ask whether a repository is on either list, and why, before you clone it.

    crimeforgood check github.com/owner/repo Planned

  • Check your dependencies

    Run it in CI and fail the build when something you depend on points at a listed repo.

    Planned

  • Download the lists

    Both lists as plain JSON under an open licence, for your own scanners and research.

    Planned

  • Red-team a model

    Run a library of real adversarial prompts against any model and see what gets through, for the price of the API calls.

    crimeforgood redteam <provider/model> Planned

What we hold to

Researchers stay unnamed
We don't. crimeforgood answers for the work, so the people doing it can stay out of view of clients and the public.
Open source
The scanner, the rules and the lists are public. Anyone can see how a repo ended up listed.
Ethical by design
We look at what's public or what we've been hired to test. Owners are told first, and corrections are made in the open.
Crime for good
The skills attackers use, pointed at keeping the community safe.