loading…
no tools match
try clearing filters or a different query
no tools match
try clearing filters or a different query
tl;dr sec / tools is a searchable index of every software tool mentioned in Clint Gibler's tl;dr sec newsletter — from issue #1 in May 2019 through the most recent issue.
For each of the 325+ issues, an LLM extracted named tools (GitHub repos, products, scanners, libraries) along with Clint's description of what they do and the newsletter section they appeared under. Each unique tool was then enriched with a controlled category, keyword tags, and a one-liner by reading its README or homepage.
All tool descriptions and context come from Clint Gibler's writing — this site is just an index. If you find this useful, subscribe to tl;dr sec.
Don't trust our sandbox with your keys? Run the same tool in Docker on your own machine. Your credentials never leave your laptop.
The -e KEY flags pass env vars by reference, not value — they only work after you export them in the same shell. This way your secrets stay out of shell history.
When you click try with creds on a tool, here is exactly what happens to the keys you paste in.
localStorage, never sessionStorage, never a cookie.
Closing the tab, closing the modal, or clicking wipe fields erases them immediately.
{tool, template, env: {KEY:value, …}} to tldrsec-sandbox.root187.workers.dev over HTTPS.
The Worker is a thin proxy — its only job is to receive the request, validate against an allowlist (next step), and hand it to one isolated container.
AWS_ACCESS_KEY_ID for AWS tools). Anything else is silently dropped.
Values are never logged — only the names of the keys passed (so we can debug shape, not content).
sandbox.setEnvVars(...) on a fresh, isolated container. Your keys exist as process env vars inside that one container only.
Every tool also has a run locally button that gives you a Docker one-liner. Run it on your own laptop — your keys never leave your machine. That's the only way to be 100% sure no third party touches your credentials.
Still uneasy? Use the run locally button on any tool — it gives you the same Docker image to run on your own machine, where credentials never leave your laptop.
To prevent abuse, we run a brief check before spinning up your sandbox. No data is collected.