🇬🇧 English | 🇳🇴 Norsk

Click to view screenshots / Klikk for å se skjermbilder

Dashboard	New Scan

Scan Report	Settings

Findings	Help

Security vulnerability scanner for applications and AI-constructed websites.

• Secrets Scanning: Detect hardcoded secrets, API keys, and credentials using gitleaks
• Dependency Scanning: Find vulnerable dependencies using osv-scanner and trivy
• SAST: Static analysis with semgrep for code vulnerabilities
• Config Scanning: Detect misconfigurations in Dockerfiles, Kubernetes manifests, Terraform, etc.
• Web Scanning: Fast web application security scanning with Nuclei + OWASP ZAP
• SBOM Generation: Generate Software Bill of Materials with syft

pip install -e .

secscan check-tools

# Full scan with table output
secscan scan ./my-project

# Generate HTML report
secscan scan ./my-project -f html -o report.html

# Generate JSON report
secscan scan ./my-project -f json -o report.json

# Scan specific types only
secscan scan ./my-project -t secrets -t deps

# Fail on high severity (for CI)
secscan scan ./my-project --fail-on high

secscan scan ./source.zip -o report.html -f html

secscan scan https://example.com -t web

Start the web interface:

macOS/Linux:

# Recommended: start both backend + frontend
bash run_servers.sh

# OR manually:
# Start the API backend (port 8000)
uvicorn apps.api.main:app --reload --host 0.0.0.0 --port 8000 &

# Start the frontend dev server
cd apps/web && npm run dev

Windows (run in two separate terminals):

# Terminal 1: Start the API backend (port 8000)
uvicorn apps.api.main:app --reload --host 0.0.0.0 --port 8000

# Terminal 2: Start the frontend dev server
cd apps/web
npm run dev

Open http://localhost:5173 in your browser.

• POST /scans - Create a new scan
• GET /scans/{scan_id} - Get scan status
• GET /scans/{scan_id}/report?lang=en|no - Get scan report payload in selected language
• GET /scans/{scan_id}/report.json?lang=en|no - Download JSON report in selected language
• GET /scans/{scan_id}/report.html?lang=en|no - Get HTML report in selected language
• GET /tools - List available scanner tools
• POST /scans/upload - Upload and scan a zip file

Install the scanner tools:

macOS/Linux (Homebrew):

Notes:

• Web scans use both Nuclei and ZAP when available.
• If ZAP is not installed, web scans still run with Nuclei only.
• Frontend requires Node.js and npm.

Windows (Scoop):

# Install Scoop first: https://scoop.sh
scoop install gitleaks trivy osv-scanner syft
pip install semgrep
# Nuclei: go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
# ZAP: install OWASP ZAP from https://www.zaproxy.org/download/

Sikkerhetsscanner for applikasjoner og AI-genererte nettsider.

• Hemmelighetsscanning: Oppdager hardkodede passord, API-nøkler og legitimasjon med gitleaks
• Avhengighetsscanning: Finner sårbare biblioteker med osv-scanner og trivy
• SAST (Kodeanalyse): Statisk analyse med semgrep for kodesårbarheter
• Konfigurasjonsscanning: Oppdager feilkonfigurasjon i Dockerfiler, Kubernetes, Terraform, osv.
• Nettskanning: Rask skanning av webapplikasjoner med Nuclei + OWASP ZAP
• SBOM-generering: Genererer Software Bill of Materials med syft

pip install -e .

secscan check-tools

# Full skanning med tabellutdata
secscan scan ./mitt-prosjekt

# Generer HTML-rapport
secscan scan ./mitt-prosjekt -f html -o rapport.html

# Generer JSON-rapport  
secscan scan ./mitt-prosjekt -f json -o rapport.json

# Skann kun bestemte typer
secscan scan ./mitt-prosjekt -t secrets -t deps

# Feil ved høy alvorlighetsgrad (for CI)
secscan scan ./mitt-prosjekt --fail-on high

secscan scan ./kildekode.zip -o rapport.html -f html

secscan scan https://eksempel.no -t web

Start webgrensesnittet:

macOS/Linux:

# Anbefalt: start både backend + frontend
bash run_servers.sh

# ELLER manuelt:
# Start API-backend (port 8000)
uvicorn apps.api.main:app --reload --host 0.0.0.0 --port 8000 &

# Start frontend-utviklingsserver
cd apps/web && npm run dev

Windows (kjør i to separate terminaler):

# Terminal 1: Start API-backend (port 8000)
uvicorn apps.api.main:app --reload --host 0.0.0.0 --port 8000

# Terminal 2: Start frontend-utviklingsserver
cd apps/web
npm run dev

Åpne http://localhost:5173 i nettleseren.

• POST /scans - Opprett ny skanning
• GET /scans/{scan_id} - Hent skannestatus
• GET /scans/{scan_id}/report?lang=en|no - Hent rapportdata på valgt språk
• GET /scans/{scan_id}/report.json?lang=en|no - Last ned JSON-rapport på valgt språk
• GET /scans/{scan_id}/report.html?lang=en|no - Hent HTML-rapport på valgt språk
• GET /tools - List tilgjengelige skannerverktøy
• POST /scans/upload - Last opp og skann en zip-fil

Installer skannerverktøyene:

macOS/Linux (Homebrew):

Merknader:

• Nettskanning bruker både Nuclei og ZAP når begge er installert.
• Hvis ZAP mangler, kjører nettskanning fortsatt med Nuclei.
• Frontend krever Node.js og npm.

Windows (Scoop):

# Installer Scoop først: https://scoop.sh
scoop install gitleaks trivy osv-scanner syft
pip install semgrep
# Nuclei: go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
# ZAP: installer OWASP ZAP fra https://www.zaproxy.org/download/

🇬🇧 English:

⚠️ WARNING: This tool is designed for LOCAL USE ONLY

SecScan analyzes source code and discovers vulnerabilities, which makes it a sensitive security tool. Do not deploy this as a public web service without proper security measures.

Why?

• Users upload source code containing secrets, credentials, and proprietary information
• Vulnerability reports contain sensitive security information
• The tool becomes an attractive target for attackers
• GDPR, NDA, and compliance requirements

Recommended Usage:

• ✅ Local development - Run on your own machine
• ✅ CI/CD pipelines - GitHub Actions, GitLab CI (isolated environments)
• ✅ On-premise deployment - Internal company servers with access control
• ⚠️ Self-hosted - Only with strict authentication, encryption, and network isolation
• ❌ Public cloud hosting - Not recommended without comprehensive security hardening

The web interface is provided for convenience in secure, trusted environments only.

🇳🇴 Norsk:

⚠️ ADVARSEL: Dette verktøyet er designet for LOKAL BRUK

SecScan analyserer kildekode og oppdager sårbarheter, noe som gjør det til et sensitivt sikkerhetsverktøy. Ikke deploy dette som en offentlig nettjeneste uten grundige sikkerhetstiltak.

Hvorfor?

• Brukere laster opp kildekode som inneholder hemmeligheter, passord og proprietær informasjon
• Sårbarhetsrapporter inneholder sensitiv sikkerhetsinformasjon
• Verktøyet blir et attraktivt mål for angripere
• GDPR, NDA og compliance-krav

Anbefalt bruk:

• ✅ Lokal utvikling - Kjør på din egen maskin
• ✅ CI/CD pipelines - GitHub Actions, GitLab CI (isolerte miljøer)
• ✅ On-premise deployment - Interne bedriftsservere med tilgangskontroll
• ⚠️ Self-hosted - Kun med streng autentisering, kryptering og nettverksisolering
• ❌ Offentlig cloud-hosting - Ikke anbefalt uten omfattende sikkerhetstiltak

Webgrensesnittet er laget for bekvemmelighet i sikre, betrodde miljøer kun.

secscan/
├── apps/
│   ├── api/          # FastAPI web API
│   ├── cli/          # Typer CLI application
│   ├── web/          # React frontend (Vite)
│   └── worker/       # Background scan worker
├── packages/
│   ├── core/         # Core models, pipeline, scoring
│   ├── adapters/     # Scanner tool adapters
│   ├── reporter/     # JSON/HTML report generators
│   └── storage/      # SQLite/PostgreSQL storage
└── configs/          # Default configuration

MIT