🔒 sec-scan

AI-powered code security scanner - detect API key leaks, SQL injection, XSS, weak cryptography, and more.

Features

• 🔍 Comprehensive Detection

  • API Key / Secret leaks (AWS, GitHub, Slack, OpenAI, etc.)
  • SQL Injection vulnerabilities
  • XSS vulnerabilities (innerHTML, React dangerouslySetInnerHTML, etc.)
  • Weak cryptography (MD5, SHA1, insecure random)
  • Sensitive file exposure (.env, credentials, SSH keys)
  • Insecure dependencies and configurations

• 🚀 Developer Friendly

  • Lightning fast static analysis
  • Auto-fix for common issues
  • Real-time file watching
  • Beautiful HTML/JSON reports

• 💻 Multi-Language Support

  • JavaScript / TypeScript
  • Python
  • Go

Installation

npm install -g @mazhu/sec-scan

Quick Start

Scan a directory

sec-scan scan ./src

Auto-fix issues

sec-scan scan ./src --fix

Watch for changes

sec-scan watch ./src

Generate report

sec-scan scan ./src
sec-scan report --format html

Commands

sec-scan scan <path>

Scan files or directories for security vulnerabilities.

Options:

• --fix, -f - Automatically fix fixable issues
• --verbose, -v - Verbose output
• --include - File patterns to include (comma-separated)
• --exclude - Patterns to exclude (comma-separated)

sec-scan report

Generate a report from the last scan.

Options:

• --format, -f - Output format (json, html, text)
• --output, -o - Output file path

sec-scan watch <path>

Watch files for changes and scan in real-time.

Options:

• --debounce, -d - Debounce delay in milliseconds (default: 1000)

Detection Types

| Category | Examples | |----------|----------| | 🔑 API Keys | AWS keys, GitHub tokens, Slack tokens, OpenAI keys | | 💉 SQL Injection | String concatenation, template literals in queries | | 🌐 XSS | innerHTML, dangerouslySetInnerHTML, v-html | | 🔐 Weak Crypto | MD5, SHA1, Math.random() for security | | 📁 Sensitive Files | .env, credentials.json, SSH keys | | 🔧 Insecure Config | CORS wildcard, SSL verification disabled |

Severity Levels

• 🔴 Critical - Immediate action required (API keys, private keys)
• 🟠 High - Security risk (SQL injection, XSS)
• 🟡 Medium - Potential issue (weak crypto, CORS)
• 🔵 Low - Informational (debug flags, log files)

Pricing

| Plan | Price | Features | |------|-------|----------| | Free | $0 | Basic scanning, CLI usage | | Pro | $19/mo | Real-time monitoring, CI/CD integration, Advanced reports |

Contributing

Contributions are welcome! Please read the contributing guidelines first.

License

MIT © Mike Wang [email protected]

Made with ❤️ by Mike Wang