Every workflow, source included_
A curated catalogue of the strongest open-source security workflows, mirrored from public repositories by commit and scored on the bench. Read any of them before you run one.
Read-only GitHub app · first run on us · no card
A manifest and instructions.
A workflow is a folder. The manifest declares the tools the agent may call, the files it may read, the models and budgets for each profile, and the schema of what it reports. The instructions are Markdown: how to audit, what to look for, what counts as proof. Nothing is hidden, and nothing runs that the manifest did not declare.
name: asvs/auth-review
version: 3
stacks: [web, api]
tools: [read, grep, run-tests, http]
scope: ["src/**", "api/**", "!**/*.test.*"]
profiles: # credits are the run price for a mid-sized repository
low: { model: fast, passes: 1, credits: 3 }
balanced: { model: leading, passes: 2, credits: 7, verify: true }
max: { model: strongest, passes: 4, credits: 18, verify: true }
report: { schema: findings/v1, proof: required }Curated, not crowdsourced.
A workflow enters the registry when it declares its tools and scope, passes the schema, runs cleanly on at least one benchmark, embeds no benchmark answers, and has a maintainer who answers issues. We mirror the source at a pinned commit; new versions are scored before they replace old ones. Contributions are welcome and reviewed in public when the registry is open.
Talk to us about contributingWeb applications
authentication, authorisation, injection, session handling, business logic
APIs
authorisation gaps, IDOR, rate limits, schema abuse
Solidity and EVM
reentrancy, access control, oracle and accounting flaws, with proof-of-concept transactions
Infrastructure code
misconfiguration, secrets, supply chain, container and IaC checks
asvs/auth-review
Authentication and session flows against ASVS.
credits: low 3 · balanced 7 · max 18
owasp/top-10-web
The classic ten, with proof for each hit.
credits: low 2 · balanced 6 · max 15
api/authz-idor
Object-level authorisation across every route.
credits: low 3 · balanced 7 · max 16
evm/reentrancy-access
Reentrancy, access control and accounting invariants.
credits: low 4 · balanced 9 · max 22
supply-chain/deps-audit
Dependencies, lockfiles, install scripts, provenance.
credits: low 2 · balanced 4 · max 10
iac/misconfig
Terraform, Kubernetes and Docker misconfiguration.
credits: low 2 · balanced 5 · max 12
Examples of the kind of workflow the registry will hold. There is no public GitHub catalogue yet.
Choose how hard it looks.
| profile | models | depth | typical credits | use it for |
|---|---|---|---|---|
low | fast | one pass | 2–4 | pull requests, triage |
balanced | leading | standard, one verification pass | 5–10 | repository audits |
max | strongest | deep, repeated passes, verification | 12–25 | releases, bounty targets |
Typical credits for a mid-sized repository. The exact price is shown before every run.
What is a workflow?
A folder in a public repository: a YAML manifest (tools, file scope, model settings, output schema) and Markdown instructions that tell the agent how to audit. Midkernel mirrors the folder, pins its commit, runs it, and scores it.
Can I run workflows without Midkernel?
That is the design: workflows and a runner that you can read and run yourself. Those repositories are not public yet. Midkernel is the hosted, benchmarked, one-button version when it ships.
Can I use a private workflow?
Yes, on Team: fork any registry workflow into your workspace and run your version. Private forks are not scored on the bench.
Who maintains them?
Their authors — researchers, auditors and maintainers — with Midkernel as curator and mirror. Every workflow page names its maintainer.
Can I submit one?
Yes — write to hello@midkernel.com. The public GitHub registry is not open yet. Workflows will be scored on the bench and appear in the catalogue once they pass review.