🎯 Sicario: Developer-First Security Scanner

The developer-first security scanner for modern web applications.

AI coding assistants (Cursor, v0, GitHub Copilot) allow you to ship full-stack applications in hours. But while they write beautiful code, they frequently introduce critical vulnerabilities — like hardcoded secrets, business logic bypasses, LLM injection vectors, and supply chain risks.

Legacy scanners (Snyk, Burp) are built for enterprise compliance, not rapid development. They output dense PDFs that nobody reads.

Sicario is different. It is a locally-running static analysis scanner that understands your code's semantic intent — parsing your source into an Abstract Syntax Tree to detect complex flaws that regex-based tools miss. Beautiful output. Interactive workflow. Fix with one command.

🚀 Quickstart

No API keys to copy. No configuration files to edit.

# Scan current directory (no install needed)
npx sicario-red-team@latest

# Or install globally
npm install -g sicario-red-team

# Link to cloud dashboard
sicario login

# Continuous scanning as you code
sicario watch

# AI fix + GitHub PR
sicario fix --pr

✨ Features

• AST-Based Scanning — Parses TypeScript, JavaScript, Python, Go, and Rust into ASTs for deep semantic analysis
• Secrets Detection — 30+ patterns including AWS keys, GitHub tokens, Stripe keys, and high-entropy strings
• LLM Vulnerability Detection — Prompt injection, insecure output handling, unsafe model configurations
• Business Logic Analysis — Missing auth checks, IDOR, mass assignment, rate limiting gaps
• Supply Chain Auditing — OSV database queries, typosquatting detection, SBOM generation (--sbom)
• AI Auto-Fix (Scribe) — Generates and applies code patches, or opens GitHub PRs with sicario fix --pr
• Cloud Dashboard — Sync findings to Mission Control for team visibility and compliance reporting
• Beautiful Output — Rich terminal UI with interactive post-scan menu, watch mode, and CI/CD integration

🔧 Core Commands

| Command | Description | |---|---| | sicario scan [path] | Scan a directory or file | | sicario fix | Apply AI-generated patches locally | | sicario fix --pr | Open a GitHub PR with the fix | | sicario triage | Launch the interactive TUI Mission Control | | sicario login | Authenticate with the cloud dashboard | | sicario watch | Continuous scanning as you code | | sicario init | Initialize a .sicarioignore config file |

Useful Flags

| Flag | Description | |---|---| | --sbom | Generate a CycloneDX JSON Software Bill of Materials | | --baseline <file> | Suppress findings present in a saved baseline file | | --fail-on <severity> | Exit with code 1 at/above this severity (CI/CD gating) | | --dry-run | Preview what would be scanned/fixed without writing files | | --incremental | Scan only files changed since last Git commit | | --format <fmt> | Output format: text, json, sarif, markdown |

☁️ Cloud Dashboard

After running sicario login, scan results automatically sync to your Mission Control dashboard at usesicario.xyz/dashboard.

The dashboard provides:

• Scan history and finding trends over time
• Severity distribution and OWASP category breakdown
• Compliance report export (OWASP, PCI-DSS, HIPAA)
• Remote AI remediation for GitHub-connected repositories

# Authenticate once — all future scans sync automatically
sicario login

🛡️ Detection Engines

Sicario runs 4 detection engines on every scan:

1. Secrets Engine — Detects hardcoded credentials, API keys, and high-entropy strings
2. LLM Guard — Identifies prompt injection, unsafe AI output handling, and insecure model configs
3. Business Logic Engine — Finds auth bypasses, IDOR, mass assignment, and missing rate limits
4. Supply Chain Engine — Audits dependencies against the OSV database, detects typosquatting

Supported Languages: TypeScript · JavaScript · Python · Go · Rust

💎 Pricing

| Tier | Price | Includes | |---|---|---| | Hacker | Free | Full AST scanning, SARIF/JSON/Markdown reports, watch mode, CI/CD integration, cloud dashboard | | Pro | Paid | Everything in Hacker + AI auto-fix, GitHub PR creation, SBOM generation, remote fix from dashboard | | Enterprise | Coming Soon | SSO, custom SLAs, dedicated support |

Upgrade at usesicario.xyz.

📄 License

See LICENSE for details.