vulnerability-scanner

Run python scripts/security_scan.py followed by your project path to execute all four scan types: dependencies, secrets, code patterns, and configuration. Use the --scan-type flag to run a specific scan, and --output summary for a human-readable report instead of JSON.

The scanner detects API keys, bearer tokens, AWS access keys, Azure and GCP credentials, database connection strings, private keys, SSH keys, and JWT tokens using regex patterns. Findings are classified as critical, high, or medium severity based on exposure risk.

Yes, it scans files with extensions including .js, .ts, .jsx, .tsx, .py, .go, .java, .rb, and .php. Dependency auditing via npm audit runs automatically when a package.json is present, and lock file checks cover npm, yarn, pnpm, and pip.

OWASP 2025 adds Software Supply Chain Security as A03 and Exceptional Conditions as A10, merges SSRF into Broken Access Control, and elevates Security Misconfiguration for cloud and container environments. The focus shifts from symptoms to root causes.

Regex-based detection can match placeholder values, example credentials in documentation, or test fixtures that resemble real secrets. Review each finding in context, maintain a verified baseline of known false positives, and exclude test directories from scans.