sast-horusec

name	sast-horusec
description	Multi-language static application security testing using Horusec with support for 18+ programming languages and 20+ security analysis tools. Performs SAST scans, secret detection in git history, and provides vulnerability findings with severity classification. Use when: (1) Analyzing code for security vulnerabilities across multiple languages simultaneously, (2) Detecting exposed secrets and credentials in git history, (3) Integrating SAST into CI/CD pipelines for secure SDLC, (4) Performing comprehensive security analysis during development, (5) Managing false positives and prioritizing security findings.
version	0.1.0
maintainer	asrour
category	secsdlc
tags	["sast","horusec","vulnerability-scanning","multi-language","secrets-detection","static-analysis","secure-sdlc"]
frameworks	["OWASP","CWE"]
dependencies	{"tools":["docker","git"]}
references	["https://github.com/ZupIT/horusec","https://docs.horusec.io/"]

Horusec SAST Scanner

Overview

Horusec is an open-source security analysis tool that performs static code analysis across 18+ programming languages using 20+ integrated security tools. It identifies vulnerabilities during development, scans git history for exposed secrets, and integrates seamlessly into CI/CD pipelines for secure SDLC practices.

Supported Languages

C#, Java, Kotlin, Python, Ruby, Golang, Terraform, JavaScript, TypeScript, Kubernetes, PHP, C, HTML, JSON, Dart, Elixir, Shell, Nginx

Quick Start

Run Horusec scan on current project:

# Using Docker (recommended)
docker run -v /var/run/docker.sock:/var/run/docker.sock \
  -v $(pwd):/src horuszup/horusec-cli:latest horusec start -p /src -P $(pwd)

# Local installation
horusec start -p ./path/to/project

Core Workflows

Workflow 1: Local Security Scan

For developers performing pre-commit security analysis:

1. Navigate to project directory
2. Run Horusec scan:

   horusec start -p . -o json -O horusec-report.json
   

3. Review JSON output for vulnerabilities
4. Filter by severity (HIGH, MEDIUM, LOW, INFO)
5. Address critical and high-severity findings
6. Re-scan to validate fixes

Workflow 2: CI/CD Pipeline Integration

Progress: [ ] 1. Add Horusec to CI/CD pipeline configuration [ ] 2. Configure output format (JSON for automated processing) [ ] 3. Set severity threshold for build failures [ ] 4. Run scan on each commit or pull request [ ] 5. Parse results and fail build on high-severity findings [ ] 6. Generate security reports for audit trail [ ] 7. Track remediation progress over time

Work through each step systematically. Check off completed items.

Workflow 3: Git History Secret Scanning

For detecting exposed credentials and secrets:

1. Run Horusec with git history analysis enabled:

   horusec start -p . --enable-git-history-analysis
   

2. Review detected secrets and credentials
3. Rotate compromised credentials immediately
4. Add detected patterns to .gitignore and .horusec/config.json
5. Use git-filter-branch or BFG Repo-Cleaner to remove from history (if needed)
6. Document incident and update security procedures

Workflow 4: False Positive Management

When managing scan results and reducing noise: