Repositories list

• IWA-Java

  Public
  An insecure Java/Spring web application for use in DevSecOps scenarios.

  javajenkinsdevops+ 9springmavenscawebinspectfortifyvulnerable-applicationsecurity-automation+ 2

  Java

  •

  GNU General Public License v3.0

  •32•17•6•0•Updated Feb 18, 2026Feb 18, 2026

• fcli-ncd-examples

  Public
  Examples of how to retrieve NCD license counts using `fcli license` utility

  PowerShell

  •0•0•0•0•Updated Feb 16, 2026Feb 16, 2026

• InsecureRestAPI

  Public
  An insecure NodeJS/Express/MongoDB REST API for educational purposes.

  TypeScript

  •

  GNU General Public License v3.0

  •3•0•0•0•Updated Feb 9, 2026Feb 9, 2026

• fortify-kubernetes-demo

  Public
  Example scripts for running Fortify in KIND (Kubernetes IN Docker) cluster using helm charts

  PowerShell

  •

  GNU General Public License v3.0

  •0•0•0•0•Updated Feb 5, 2026Feb 5, 2026

• aspm-samples

  Public
  Example results files (Sarif, SBOM etc) for importing into ASPM solutions

  GNU General Public License v3.0

  •0•0•0•0•Updated Feb 3, 2026Feb 3, 2026

• IWA-Microservices

  Public
  An insecure microservices application for use in DevSecOps scenarios.

  Java

  •

  GNU General Public License v3.0

  •0•0•0•0•Updated Jan 29, 2026Jan 29, 2026

• fortify-abap-demo

  Public
  ABAP demo environment setup and ABAP On-Premise and Cloud code example for security scanning

  ABAP

  •

  MIT License

  •0•0•0•0•Updated Jan 16, 2026Jan 16, 2026

• fortify-aviator-demo

  Public
  Example project for demonstration of Fortify Aviator

  PowerShell

  •

  GNU General Public License v3.0

  •0•0•0•0•Updated Jan 8, 2026Jan 8, 2026

• fortify-docker-demo

  Public
  Example scripts for running Fortify in a docker environment on Linux

  PowerShell

  •

  GNU General Public License v3.0

  •0•0•0•0•Updated Jan 8, 2026Jan 8, 2026

• EightBallCpp

  Public
  C++ version of the Fortify demo application

  C++

  •

  GNU General Public License v3.0

  •0•0•0•0•Updated Dec 1, 2025Dec 1, 2025

• fortify-fiori-demo

  Public
  Example SAP Fiori App for security scanning

  JavaScript

  •

  MIT License

  •0•0•0•0•Updated Nov 18, 2025Nov 18, 2025

• debricked-scripts

  Public
  A collection of useful scripts for working with Debricked API

  GNU General Public License v3.0

  •0•0•0•0•Updated Oct 7, 2025Oct 7, 2025

• InsecureWebApp

  Public
  An insecure Python/Flask Web application

  HTML

  •

  GNU General Public License v3.0

  •5•0•0•1•Updated Oct 1, 2025Oct 1, 2025

• IWA-DotNet

  Public
  Insecure Web Application - .NET version

  C#

  •

  GNU General Public License v3.0

  •45•0•0•0•Updated Sep 15, 2025Sep 15, 2025

• juice-shop

  Public
  OWASP Juice Shop: Probably the most modern and sophisticated insecure web application

  TypeScript

  •

  MIT License

  •17k•0•0•0•Updated Sep 3, 2025Sep 3, 2025

• SCA-Demo-GitHub

  Public
  OpenText SCA Demo with GitHub integration

  Java

  •

  Other

  •0•0•0•0•Updated Aug 13, 2025Aug 13, 2025

• terragoat

  Public
  TerraGoat is Bridgecrew's "Vulnerable by Design" Terraform repository. TerraGoat is a learning and training project that demonstrates how common configuration e…

  HCL

  •

  Apache License 2.0

  •5.7k•0•0•0•Updated Jul 13, 2025Jul 13, 2025

• IaC-Samples

  Public
  Sample Infrastructure as Code files with vulnerabilities for use in Fortify demonstrations

  HCL

  •

  MIT License

  •3•0•0•0•Updated Jun 5, 2025Jun 5, 2025

• debricked-fingerprint-test

  Public
  A collection of libraries to be used for testing Debricked fingerprinting

  Shell

  •0•0•0•0•Updated Apr 29, 2025Apr 29, 2025

• debricked-demo

  Public
  SCA demo project with open source obstacles.

  Java

  •

  Other

  •22•0•0•0•Updated Apr 25, 2025Apr 25, 2025

• DebrickedDemoApp

  Public
  An insecure web application for use in Debricked demonstrations.

  Java

  •2•0•0•0•Updated Apr 24, 2025Apr 24, 2025

• IWA-Microservices-old

  Public
  An insecure Microservices Application for use in Fortify demonstrations.

  JavaScript

  •

  GNU General Public License v3.0

  •0•0•0•0•Updated Apr 24, 2025Apr 24, 2025

• IWA-API-Go

  Public
  An insecure Go REST API for use in Fortify demonstrations

  Go

  •

  GNU General Public License v3.0

  •0•0•0•0•Updated Apr 22, 2025Apr 22, 2025

• FortifyGoDemo

  Public
  An example Go application for use in Fortify Demonstrations

  Go

  •

  GNU General Public License v3.0

  •0•0•0•0•Updated Apr 15, 2025Apr 15, 2025

• github-actions

  Public
  Common GitHub Actions used in multiple repositories

  GNU General Public License v3.0

  •1•0•0•0•Updated Mar 26, 2025Mar 26, 2025

• fortify-minikube-demo

  Public
  Example scripts for running Fortify in minikube cluster using Fortify helm charts

  PowerShell

  •

  GNU General Public License v3.0

  •1•1•1•0•Updated Mar 18, 2025Mar 18, 2025

• BugTrackerPluginAlm

  Public
  Fortify SSC and AWS - ALM Defect Tracking Integration

  Java

  •0•0•1•0•Updated Mar 14, 2025Mar 14, 2025

• IWA-UI-Angular

  Public
  An insecure Angular SPA for use in Fortify demonstrations

  CSS

  •

  GNU General Public License v3.0

  •0•0•0•0•Updated Dec 13, 2024Dec 13, 2024

• sbom-import

  Public
  An example script to import CycloneDX SBOM into FoD

  Shell

  •0•0•0•0•Updated Dec 13, 2024Dec 13, 2024

• PharmaBot

  Public
  A TensorFlow ChatBot for use in Fortify/Debricked demonstrations

  CSS

  •

  Other

  •0•0•0•0•Updated Jul 10, 2024Jul 10, 2024