zebbern code-vuln-audit
A code security scanning tool with three core scanning capabilities:
- Dependency Vulnerability Scanning — Automatically detects known vulnerabilities in npm / pip dependencies
- Secret Leak Detection — Discovers hardcoded secrets, tokens, and passwords via regex matching + Shannon entropy analysis
- OWASP Pattern Detection — Identifies common security anti-patterns such as SQL injection, XSS, command injection, and insecure deserialization
Quick Start
# Scan the current directory (all checks)
python3 scripts/security_scan.py .
# Scan dependencies only
python3 scripts/security_scan.py --mode deps .
# Detect secret leaks only
python3 scripts/security_scan.py --mode secrets /path/to/project
# Detect OWASP security patterns only
python3 scripts/security_scan.py --mode owasp .
# Output report in JSON format
python3 scripts/security_scan.py --format json --output report.json .
# Only show findings at high severity and above
python3 scripts/security_scan.py --severity high .
Scan Module Details
1. Dependency Vulnerability Scanning (deps)
Automatically detects the project type and invokes the appropriate tool:
| Project Type | Detection File | Tool Used |
|---|---|---|
| Node.js | package.json + package-lock.json |
npm audit |
| Python | requirements.txt / pyproject.toml / Pipfile |
pip-audit |
If the corresponding audit tool is not installed, a helpful message is displayed instead of an error.
2. Secret Leak Detection (secrets)
Detection is performed in two ways:
Regex Matching: Covers common secret formats
| Secret Type | Example Pattern |
|---|---|
| AWS Access Key | 20-character string starting with AKIA |
| GitHub Token | Starts with ghp_ or github_pat_ |
| Slack Token | Starts with xoxb- or xoxp- |
| Stripe Key | Starts with sk_live_ or pk_live_ |
| Private Key File | -----BEGIN PRIVATE KEY----- |
| Generic API Key | Format like api_key = "..." |
| Credentials in URL | https://user:pass@host |
| JWT Token | eyJ... format |
Shannon Entropy Analysis: Computes information entropy for string constants in code (threshold > 4.5 and length >= 20) to discover secrets in non-standard formats.
3. OWASP Pattern Detection (owasp)
Covers statically detectable security patterns from the OWASP Top 10:
| OWASP Category | Detection Patterns |
|---|---|
| A02: Cryptographic Failures | Weak hashes (MD5/SHA1), weak ciphers (DES/RC4) |
| A03: Injection | SQL injection, command injection (os.system / subprocess shell / eval / exec), XSS (innerHTML / document.write / dangerouslySetInnerHTML / v-html) |
| A04: Insecure Design | Path traversal |
| A05: Security Misconfiguration | Debug mode enabled, CORS wildcard, binding to 0.0.0.0 |
| A08: Integrity Failures | Insecure deserialization (pickle / yaml.load / marshal / unserialize) |
| A10: SSRF | User input passed directly to HTTP requests |
Supported languages: Python, JavaScript/TypeScript, Java, PHP, Ruby, Go, and more.
Parameters
| Parameter | Description | Default |
|---|---|---|
TARGET |
Directory to scan | Current directory |
--mode MODE |
Scan mode: all, deps, secrets, owasp |
all |
--format FORMAT |
Output format: text, json |
text |
--output FILE |
Output file path | stdout |
--severity LEVEL |
Minimum reporting level: low, medium, high, critical |
low |
--exclude-dir DIR |
Additional directories to exclude (repeatable) | - |
--max-file-kb SIZE |
Maximum file size to scan in KB | 512 |
-h, --help |
Show help | - |
Output Format
Text Output (default)
=== Security Scan Report ===
Target: /path/to/project
Modules: deps, secrets, owasp
[CRITICAL] AWS Access Key ID
File: src/config.py:15
Code: AWS_KEY = "AKIAIOSFODNN7EXAMPLE"
[HIGH] SQL Injection (f-string)
File: src/db.py:42
Code: cursor.execute(f"SELECT * FROM users WHERE id={user_id}")
--- Summary ---
Critical: 1 | High: 1 | Medium: 0 | Low: 0
Total findings: 2
JSON Output
{
"target": "/path/to/project",
"scan_time": "2026-04-14T10:30:00",
"findings": [
{
"scanner": "secrets",
"name": "AWS Access Key ID",
"severity": "critical",
"file": "src/config.py",
"line": 15,
"snippet": "AWS_KEY = \"AKIAIOSFODNN7EXAMPLE\"",
"category": "secret-pattern"
}
],
"summary": {"critical": 1, "high": 0, "medium": 0, "low": 0, "total": 1}
}
Exit Codes
| Exit Code | Meaning |
|---|---|
0 |
No findings |
1 |
Findings present (at least one security issue) |
2 |
Scanner internal error |
Prerequisites
- Python 3.7+ (uses standard library only)
- Dependency scanning requires the corresponding tools:
npm(for Node.js projects),pip-audit(for Python projects) - If an audit tool is missing, that module will be skipped with a notice — other modules continue to run normally