Multi-language static application security testing using Horusec with support for 18+ programming languages and 20+ security analysis tools. Performs SAST scans, secret detection in git history, and provides vulnerability findings with severity classification. Use when: (1) Analyzing code for security vulnerabilities across multiple languages simultaneously, (2) Detecting exposed secrets and credentials in git history, (3) Integrating SAST into CI/CD pipelines for secure SDLC, (4) Performing comprehensive security analysis during development, (5) Managing false positives and prioritizing security findings.
Instrucciones de origen · Vista previa de solo lectura
name
sast-horusec
description
Multi-language static application security testing using Horusec with support for 18+ programming languages and 20+ security analysis tools. Performs SAST scans, secret detection in git history, and provides vulnerability findings with severity classification. Use when: (1) Analyzing code for security vulnerabilities across multiple languages simultaneously, (2) Detecting exposed secrets and credentials in git history, (3) Integrating SAST into CI/CD pipelines for secure SDLC, (4) Performing comprehensive security analysis during development, (5) Managing false positives and prioritizing security findings.
Horusec is an open-source security analysis tool that performs static code analysis across 18+ programming languages using 20+ integrated security tools. It identifies vulnerabilities during development, scans git history for exposed secrets, and integrates seamlessly into CI/CD pipelines for secure SDLC practices.
# Using Docker (recommended)
docker run -v /var/run/docker.sock:/var/run/docker.sock \
-v $(pwd):/src horuszup/horusec-cli:latest horusec start -p /src -P $(pwd)
# Local installation
horusec start -p ./path/to/project
Core Workflows
Workflow 1: Local Security Scan
For developers performing pre-commit security analysis:
Navigate to project directory
Run Horusec scan:
horusec start -p . -o json -O horusec-report.json
Review JSON output for vulnerabilities
Filter by severity (HIGH, MEDIUM, LOW, INFO)
Address critical and high-severity findings
Re-scan to validate fixes
Workflow 2: CI/CD Pipeline Integration
Progress:
[ ] 1. Add Horusec to CI/CD pipeline configuration
[ ] 2. Configure output format (JSON for automated processing)
[ ] 3. Set severity threshold for build failures
[ ] 4. Run scan on each commit or pull request
[ ] 5. Parse results and fail build on high-severity findings
[ ] 6. Generate security reports for audit trail
[ ] 7. Track remediation progress over time
Work through each step systematically. Check off completed items.
Workflow 3: Git History Secret Scanning
For detecting exposed credentials and secrets:
Run Horusec with git history analysis enabled:
horusec start -p . --enable-git-history-analysis
Review detected secrets and credentials
Rotate compromised credentials immediately
Add detected patterns to .gitignore and .horusec/config.json
Use git-filter-branch or BFG Repo-Cleaner to remove from history (if needed)
Document incident and update security procedures
Workflow 4: False Positive Management
When managing scan results and reducing noise:
Run initial scan and export results:
horusec start -p . -o json -O results.json
Review findings and identify false positives
Create or update .horusec/config.json with ignore rules:
Sensitive Data Handling: Horusec scans for exposed secrets. Ensure scan results are stored securely and access is restricted to authorized personnel only
Access Control: Limit access to Horusec configuration files and scan results. Use read-only mounts in Docker for source code scanning
Audit Logging: Log all scan executions, findings, and risk acceptance decisions for compliance auditing
Compliance: Integrates with SOC2, PCI-DSS, and GDPR compliance by identifying vulnerabilities and tracking remediation
Safe Defaults: Configure severity thresholds appropriate for your risk tolerance. Start with MEDIUM or HIGH to reduce noise
