Six scanners, one Docker image
Segrep now ships deps-cves (OSV/GHSA), Syft, Gitleaks, and Checkov alongside Trivy and Semgrep — broader dependency, IaC, secrets, and SBOM coverage in every scan.
By Segrep
We started Segrep with Trivy and Semgrep — dependency CVEs and SAST-style code patterns in one command. Then we expanded to secrets, IaC, and SBOM coverage. Now we add deps-cves to query OSV directly for npm lockfile packages and map GHSA/CVE aliases into findings.
Current default bundle includes six scanners:
| Scanner | What it finds |
|---|---|
| deps-cves | OSV/GHSA dependency CVEs for npm lockfile packages |
| Trivy | Dependency and container-image CVEs plus selected misconfigurations |
| Semgrep | SAST-style code patterns and insecure API usage |
| Syft | CycloneDX SBOM written to .Segrep/sbom.cyclonedx.json |
| Gitleaks | Hardcoded tokens, API keys, and other secrets |
| Checkov | Terraform, Kubernetes, Dockerfile, and other IaC issues |
In addition to the core scanners, opt-in tools cover DAST (OWASP ZAP), Kubernetes security (Kubescape), AWS posture (Prowler), native SAST (segrep-sast), local SBOM (segrep-sbom), local vulnerability scanning (segrep-vuln), passive DAST (segrep-dast), license compliance (segrep-license), and native secret detection (segrep-secrets). Select them with --scanners when needed.
One command, full coverage
docker run --rm -v "$(pwd):/repo:ro" \
ghcr.io/szaranger/security-scanner:latest \
scan /repo --scanners all --format jsonJSON output now includes optional result.sbom metadata (component count and path) when Syft runs, plus merged findings from every scanner.
Pick individual tools when you need them:
# Secrets only
scan /repo --scanners gitleaks
# IaC only (skips gracefully when no Terraform/K8s files are present)
scan /repo --scanners checkovSafe secret reporting
Gitleaks findings are always critical severity and terminal output is redacted — you'll see Secret detected in path/to/file:42 [rule-id] without the matched token.
Try it
Pull the image or build from source:
git clone https://github.com/szaranger/security.git
cd security
pnpm docker:build
pnpm docker:scanSee the full scan product guide for CI examples, JSON shape, and --fail-on thresholds.