Core + opt-in scanners
Six repo scanners run with `--scanners all`, including deps-cves for OSV/GHSA-based dependency findings. Add ZAP, Kubescape, Prowler, segrep-license, or segrep-secrets for URL, K8s, AWS, license, or secrets coverage.
Developer security
Scan every repo before it ships
Segrep bundles six core scanners in one Docker image — deps-cves (OSV/GHSA), Trivy, Semgrep, Gitleaks, Checkov, and Syft — with SARIF export, policy-as-code, and optional DAST, Kubernetes, and AWS scans. Run locally, gate CI, or sign in at app.segrep.com for teams and trends.
docker run --rm -v "$(pwd):/repo:ro" \
ghcr.io/szaranger/security-scanner:latest \
scan /repo --scanners all --format sarif --fail-on high > segrep.sarifScanners included
--scanners all runs the six core repo scanners. Opt-in tools cover staging URLs, Kubernetes manifests, and AWS accounts.
Core (default)
| Scanner | Coverage | Description |
|---|---|---|
| deps-cves | Dependencies (OSV/GHSA) | Queries OSV for npm lockfile dependencies and maps GHSA/CVE aliases to actionable package findings. |
| Trivy | Dependencies, images & config | Finds known vulnerabilities in open-source packages, container images, and misconfigured file permissions. |
| Semgrep | SAST & code patterns | Static analysis that catches insecure coding patterns, injection flaws, and unsafe API usage in source code. |
| Syft | SBOM generation | Produces a Software Bill of Materials listing every component in your repo or image for supply-chain visibility. |
| Gitleaks | Secret detection | Scans git history and files for exposed API keys, tokens, and credentials before they reach production. |
| Checkov | IaC misconfigurations | Checks Terraform, Kubernetes, Docker, and CloudFormation for security and compliance misconfigurations. |
Opt-in
| Scanner | Coverage | Description |
|---|---|---|
| OWASP ZAP | DAST (URL) | Baseline scan against staging or local apps with `--target-url` — opt-in only, authorized targets. |
| Kubescape | Kubernetes | CIS/NSA framework checks on manifest files or clusters via `--kubeconfig` — no cluster required for CI. |
| Prowler | AWS posture | Read-only cloud configuration review with `--aws-profile` — maps findings to your org dashboard. |
| segrep-license | License compliance | Classifies dependency licenses by risk tier — flags copyleft and unknown licenses in your node_modules. |
| segrep-secrets | Secret detection | Native regex-based scanner for API keys, tokens, passwords, private keys, and connection strings — no binary required. |
Built for developers and teams
Docker-first
One image for local scans and CI — with copy-paste configs for GitHub Actions, GitLab, Azure DevOps, and Jenkins.
Findings intelligence
Fingerprint dedup, risk scores, SARIF for GitHub Security tab and IDEs, `.segrep/policy.yml`, and `--changed-only` PR scans.
Optional platform
GitHub App scans every PR with inline comments — plus org-scoped API keys, Slack alerts, and 30-day trend charts at app.segrep.com.
Ready to see your findings?
Sign in with GitHub for org-scoped scan history, API keys, and Slack alerts — or run the scanner in your pipeline today.