Secure Code Analysis & Review
Five-tool layered security scanning: Semgrep (patterns), Gitleaks (secrets), Trivy (deps/IaC/containers), CodeQL (taint analysis), Horusec (multi-engine sweep).
Layered Defense Model
Layer 1: SECRETS → Gitleaks (API keys, passwords, tokens)
Layer 2: PATTERNS → Semgrep (known vulnerability patterns)
Layer 3: DEPENDENCIES → Trivy SCA (CVEs in libraries)
Layer 4: MISCONFIGS → Trivy IaC (Terraform, K8s, Docker)
Layer 5: CONTAINERS → Trivy Image (base image vulns)
Layer 6: DATA FLOW → CodeQL (taint analysis, attack chains)
Layer 7: FULL SWEEP → Horusec (15+ engines, maximum coverage)
Tool Roles
| Tool |
Speed |
Depth |
Best For |
| Semgrep |
⚡ Seconds |
Medium |
Code-level vulns, custom rules, CI/CD gates |
| Gitleaks |
⚡ Seconds |
Shallow |
Hardcoded keys, tokens, passwords |
| Trivy |
⚡ Sec–Min |
Medium |
Dependency CVEs, container misconfigs, IaC drift |
| CodeQL |
🐢 Minutes |
Deep |
Taint chains, data flow, complex attack paths |
| Horusec |
🐢 Minutes |
Broad |
Maximum coverage, runs 15+ scanners at once |
Quick Start
Full Security Scan (All Layers)
# End-to-end orchestrated scan with results aggregation
bash scripts/secure-scan.sh /path/to/project
# Quick scan — fast layers only (secrets + patterns + deps)
bash scripts/secure-scan.sh /path/to/project --layers quick
# CI gate — fail on any HIGH/CRITICAL finding
bash scripts/secure-scan.sh /path/to/project --ci --severity high,critical
# Specific layers
bash scripts/secure-scan.sh /path/to/project --layers secrets,patterns,deps
# JSON output for downstream processing
bash scripts/secure-scan.sh /path/to/project --format json --output results.json
Individual Tool Quick Commands
# Secrets (always scan first)
gitleaks detect --source /path/to/project -v
# Patterns (fast, catches common vulns)
semgrep --config auto --exclude "node_modules,vendor,.git,dist,build" /path/to/project
# Dependencies + IaC + Secrets
trivy fs --scanners vuln,secret,misconfig /path/to/project
# Deep analysis (slowest, catches data flow)
codeql database create /tmp/codeql-db --language=javascript --overwrite /path/to/project
codeql database analyze /tmp/codeql-db --format=sarif-latest --output=results.sarif
# Full sweep (all engines)
horusec start -p /path/to/project --disable-docker -t 600
Decision Matrix
| Scenario |
Primary Tool |
Secondary |
Why |
| Quick PR check (<30s) |
Semgrep + Gitleaks |
— |
Fastest, catches most common issues |
| Pre-merge security gate |
Semgrep + Gitleaks + Trivy |
— |
Patterns, secrets, dependencies |
| Full security audit |
All 5 tools |
— |
Maximum coverage |
| Hardcoded secrets |
Gitleaks |
Trivy --scanners secret |
Purpose-built for this |
| Dependency CVEs |
Trivy |
— |
Best SCA coverage |
| Container security |
Trivy image |
— |
Purpose-built for images |
| IaC misconfigs |
Trivy --scanners misconfig |
— |
Best Terraform/K8s/Docker |
| Deep taint analysis |
CodeQL |
— |
Only tool tracking data flow across functions |
| Maximum coverage |
Horusec |
— |
Runs 15+ engines |
| Monorepo 5+ languages |
Semgrep + Trivy + Horusec |
— |
Broad language coverage |
Scanning Workflow
Always scan in this order — secrets first because leaked credentials require immediate rotation:
1. Gitleaks → If secrets found: STOP, rotate credentials, then continue
2. Semgrep → Fix ERROR-severity findings before merge
3. Trivy → Update HIGH/CRITICAL dependency CVEs
4. CodeQL → Run on PRs touching security-sensitive code (auth, input handling)
5. Horusec → Weekly full sweep to catch what others miss
Per-Project Profiles
| Project Type |
Layers |
Commands |
| Node.js/TS |
secrets → patterns → deps |
gitleaks detect --source . --no-git → semgrep --config p/javascript --config p/owasp-top-ten --exclude "node_modules,dist" . → trivy fs --scanners vuln --skip-dirs node_modules . |
| Python |
secrets → patterns → deps → deep |
gitleaks detect --source . --no-git → semgrep --config p/python --config p/security-audit --exclude "venv,.venv,__pycache__" . → trivy fs --scanners vuln . → CodeQL python-queries:Security |
| Go |
secrets → patterns → deps → deep |
gitleaks detect --source . --no-git → semgrep --config p/go --config p/security-audit --exclude "vendor" . → trivy fs --scanners vuln . → CodeQL go-queries:Security |
| Docker/Container |
secrets → IaC → image |
gitleaks detect --source . --no-git → trivy config --severity HIGH,CRITICAL . → trivy image --severity HIGH,CRITICAL myapp:latest |
| Monorepo |
secrets → all patterns → all deps → full sweep |
gitleaks detect --source . --no-git → semgrep --config auto --exclude "node_modules,vendor,.git" . → trivy fs --scanners vuln,secret,misconfig . → horusec start -p . --disable-docker |
Severity Actions
| Severity |
Action |
| CRITICAL |
Fix immediately, block deployment |
| HIGH |
Fix before next release |
| MEDIUM |
Fix within sprint, add to backlog |
| LOW |
Fix when convenient |
| INFO |
Review, no action required |
Safety Rules
- NEVER commit real API keys, passwords, or tokens — even in test files
- Rotate any credential found by Gitleaks — do not just delete from code
- Do not suppress findings without justification — document why in comments or config
- Run scans BEFORE merging to main — not after
- Do not skip CodeQL because it's slow — it catches what Semgrep misses (taint chains)
- Review all CRITICAL/HIGH findings — do not auto-dismiss
- Keep rule configs in version control —
.gitleaks.toml, custom Semgrep YAML, .trivyignore
- Run secret detection on git history — not just current code
- Never expose scan results publicly — they contain vulnerability details attackers can use
False Positive Suppression
# Semgrep — inline suppression
# nosemgrep: <rule-id>
# Gitleaks — .gitleaks.toml allowlist
# [[allowlist]]
# paths = ['''tests/test_keys.py''']
# Trivy — .trivyignore
# CVE-2024-XXXX # reason for acceptance
# CodeQL — inline suppression
# codeql[python/clear-text-logging] — suppressed: test fixture
# Horusec — .horusec-config.json
# "horusecCliFalsePositiveHashes": ["<hash>"]
References
- references/tool-commands.md — Complete command reference for all 5 tools (Semgrep, Gitleaks, Trivy, CodeQL, Horusec)
- references/ci-cd-integration.md — GitHub Actions, GitLab CI, and pre-commit hook configurations
- references/custom-rules.md — Custom Semgrep rules, Gitleaks config, and Trivy ignore files
- references/interpretation-guide.md — Results aggregation, severity interpretation, and report generation
- references/project-profiles.md — Language-specific scanning profiles and troubleshooting
1---2name: secure-scan3description: Comprehensive secure code analysis and vulnerability review using Semgrep, Gitleaks, Trivy, CodeQL, and Horusec in a layered defense approach. Covers secret detection, pattern-based SAST, dependency CVEs, IaC misconfigs, container scanning, deep taint analysis, and multi-engine sweeps. Use when performing security scans, vulnerability assessments, code security reviews, secret detection, dependency audits, or CI/CD security gate setup.4---56# Secure Code Analysis & Review78Five-tool layered security scanning: Semgrep (patterns), Gitleaks (secrets), Trivy (deps/IaC/containers), CodeQL (taint analysis), Horusec (multi-engine sweep).910## Layered Defense Model1112```13Layer 1: SECRETS → Gitleaks (API keys, passwords, tokens)14Layer 2: PATTERNS → Semgrep (known vulnerability patterns)15Layer 3: DEPENDENCIES → Trivy SCA (CVEs in libraries)16Layer 4: MISCONFIGS → Trivy IaC (Terraform, K8s, Docker)17Layer 5: CONTAINERS → Trivy Image (base image vulns)18Layer 6: DATA FLOW → CodeQL (taint analysis, attack chains)19Layer 7: FULL SWEEP → Horusec (15+ engines, maximum coverage)20```2122## Tool Roles2324| Tool | Speed | Depth | Best For |25|---|---|---|---|26| **Semgrep** | ⚡ Seconds | Medium | Code-level vulns, custom rules, CI/CD gates |27| **Gitleaks** | ⚡ Seconds | Shallow | Hardcoded keys, tokens, passwords |28| **Trivy** | ⚡ Sec–Min | Medium | Dependency CVEs, container misconfigs, IaC drift |29| **CodeQL** | 🐢 Minutes | Deep | Taint chains, data flow, complex attack paths |30| **Horusec** | 🐢 Minutes | Broad | Maximum coverage, runs 15+ scanners at once |3132## Quick Start3334### Full Security Scan (All Layers)3536```bash37# End-to-end orchestrated scan with results aggregation38bash scripts/secure-scan.sh /path/to/project3940# Quick scan — fast layers only (secrets + patterns + deps)41bash scripts/secure-scan.sh /path/to/project --layers quick4243# CI gate — fail on any HIGH/CRITICAL finding44bash scripts/secure-scan.sh /path/to/project --ci --severity high,critical4546# Specific layers47bash scripts/secure-scan.sh /path/to/project --layers secrets,patterns,deps4849# JSON output for downstream processing50bash scripts/secure-scan.sh /path/to/project --format json --output results.json51```5253### Individual Tool Quick Commands5455```bash56# Secrets (always scan first)57gitleaks detect --source /path/to/project -v5859# Patterns (fast, catches common vulns)60semgrep --config auto --exclude "node_modules,vendor,.git,dist,build" /path/to/project6162# Dependencies + IaC + Secrets63trivy fs --scanners vuln,secret,misconfig /path/to/project6465# Deep analysis (slowest, catches data flow)66codeql database create /tmp/codeql-db --language=javascript --overwrite /path/to/project67codeql database analyze /tmp/codeql-db --format=sarif-latest --output=results.sarif6869# Full sweep (all engines)70horusec start -p /path/to/project --disable-docker -t 60071```7273## Decision Matrix7475| Scenario | Primary Tool | Secondary | Why |76|---|---|---|---|77| Quick PR check (<30s) | Semgrep + Gitleaks | — | Fastest, catches most common issues |78| Pre-merge security gate | Semgrep + Gitleaks + Trivy | — | Patterns, secrets, dependencies |79| Full security audit | All 5 tools | — | Maximum coverage |80| Hardcoded secrets | Gitleaks | Trivy `--scanners secret` | Purpose-built for this |81| Dependency CVEs | Trivy | — | Best SCA coverage |82| Container security | Trivy image | — | Purpose-built for images |83| IaC misconfigs | Trivy `--scanners misconfig` | — | Best Terraform/K8s/Docker |84| Deep taint analysis | CodeQL | — | Only tool tracking data flow across functions |85| Maximum coverage | Horusec | — | Runs 15+ engines |86| Monorepo 5+ languages | Semgrep + Trivy + Horusec | — | Broad language coverage |8788## Scanning Workflow8990Always scan in this order — secrets first because leaked credentials require immediate rotation:9192```931. Gitleaks → If secrets found: STOP, rotate credentials, then continue942. Semgrep → Fix ERROR-severity findings before merge953. Trivy → Update HIGH/CRITICAL dependency CVEs964. CodeQL → Run on PRs touching security-sensitive code (auth, input handling)975. Horusec → Weekly full sweep to catch what others miss98```99100### Per-Project Profiles101102| Project Type | Layers | Commands |103|---|---|---|104| **Node.js/TS** | secrets → patterns → deps | `gitleaks detect --source . --no-git` → `semgrep --config p/javascript --config p/owasp-top-ten --exclude "node_modules,dist" .` → `trivy fs --scanners vuln --skip-dirs node_modules .` |105| **Python** | secrets → patterns → deps → deep | `gitleaks detect --source . --no-git` → `semgrep --config p/python --config p/security-audit --exclude "venv,.venv,__pycache__" .` → `trivy fs --scanners vuln .` → CodeQL python-queries:Security |106| **Go** | secrets → patterns → deps → deep | `gitleaks detect --source . --no-git` → `semgrep --config p/go --config p/security-audit --exclude "vendor" .` → `trivy fs --scanners vuln .` → CodeQL go-queries:Security |107| **Docker/Container** | secrets → IaC → image | `gitleaks detect --source . --no-git` → `trivy config --severity HIGH,CRITICAL .` → `trivy image --severity HIGH,CRITICAL myapp:latest` |108| **Monorepo** | secrets → all patterns → all deps → full sweep | `gitleaks detect --source . --no-git` → `semgrep --config auto --exclude "node_modules,vendor,.git" .` → `trivy fs --scanners vuln,secret,misconfig .` → `horusec start -p . --disable-docker` |109110## Severity Actions111112| Severity | Action |113|---|---|114| **CRITICAL** | Fix immediately, block deployment |115| **HIGH** | Fix before next release |116| **MEDIUM** | Fix within sprint, add to backlog |117| **LOW** | Fix when convenient |118| **INFO** | Review, no action required |119120## Safety Rules1211221. **NEVER commit real API keys, passwords, or tokens** — even in test files1232. **Rotate any credential found by Gitleaks** — do not just delete from code1243. **Do not suppress findings without justification** — document why in comments or config1254. **Run scans BEFORE merging to main** — not after1265. **Do not skip CodeQL because it's slow** — it catches what Semgrep misses (taint chains)1276. **Review all CRITICAL/HIGH findings** — do not auto-dismiss1287. **Keep rule configs in version control** — `.gitleaks.toml`, custom Semgrep YAML, `.trivyignore`1298. **Run secret detection on git history** — not just current code1309. **Never expose scan results publicly** — they contain vulnerability details attackers can use131132## False Positive Suppression133134```bash135# Semgrep — inline suppression136# nosemgrep: <rule-id>137138# Gitleaks — .gitleaks.toml allowlist139# [[allowlist]]140# paths = ['''tests/test_keys.py''']141142# Trivy — .trivyignore143# CVE-2024-XXXX # reason for acceptance144145# CodeQL — inline suppression146# codeql[python/clear-text-logging] — suppressed: test fixture147148# Horusec — .horusec-config.json149# "horusecCliFalsePositiveHashes": ["<hash>"]150```151152## References153154- [references/tool-commands.md](references/tool-commands.md) — Complete command reference for all 5 tools (Semgrep, Gitleaks, Trivy, CodeQL, Horusec)155- [references/ci-cd-integration.md](references/ci-cd-integration.md) — GitHub Actions, GitLab CI, and pre-commit hook configurations156- [references/custom-rules.md](references/custom-rules.md) — Custom Semgrep rules, Gitleaks config, and Trivy ignore files157- [references/interpretation-guide.md](references/interpretation-guide.md) — Results aggregation, severity interpretation, and report generation158- [references/project-profiles.md](references/project-profiles.md) — Language-specific scanning profiles and troubleshooting
DrOlu