loading…
no tools match
try clearing filters or a different query
no tools match
try clearing filters or a different query
Run any GitHub repo, instantly. We spin up an ephemeral sandbox container, install the tool, and drop you into a terminal in your browser. Bring your own credentials (kept tab-local, never sent to our servers), or grab the Docker one-liner and run it locally.
The catalog below — 3,134 projects sourced from 325 issues of Clint Gibler's tl;dr sec newsletter — is a curated starter set so you have something to try right away. The platform itself works on any public GitHub URL: paste yours →
For each issue, an LLM extracted named tools (GitHub repos, products, scanners, libraries) along with Clint's description of what they do. Each unique tool was then enriched with a controlled category, keyword tags, and a one-liner by reading its README or homepage.
All tool descriptions and context come from Clint Gibler's writing — this site is just an index. If you find this useful, subscribe to tl;dr sec.
Don't trust our sandbox with your keys? Run the same tool in Docker on your own machine. Your credentials never leave your laptop.
The -e KEY flags pass env vars by reference, not value — they only work after you export them in the same shell. This way your secrets stay out of shell history.
When you click try with creds on a tool, here is exactly what happens to the keys you paste in.
localStorage, never sessionStorage, never a cookie.
Closing the tab, closing the modal, or clicking wipe fields erases them immediately.
{tool, template, env: {KEY:value, …}} to tldrsec-sandbox.root187.workers.dev over HTTPS.
The Worker is a thin proxy — its only job is to receive the request, validate against an allowlist (next step), and hand it to one isolated container.
AWS_ACCESS_KEY_ID for AWS tools). Anything else is silently dropped.
Values are never logged — only the names of the keys passed (so we can debug shape, not content).
sandbox.setEnvVars(...) on a fresh, isolated container. Your keys exist as process env vars inside that one container only.
Every tool also has a run locally button that gives you a Docker one-liner. Run it on your own laptop — your keys never leave your machine. That's the only way to be 100% sure no third party touches your credentials.
Still uneasy? Use the run locally button on any tool — it gives you the same Docker image to run on your own machine, where credentials never leave your laptop.
To prevent abuse, we run a brief check before spinning up your sandbox. No data is collected.