One command runs the right security scanners for your stack and merges everything into one clean, deduplicated report.

secsuite scan .                    # scan your code, dependencies, secrets, IaC
secsuite dast https://staging.app  # scan your running app (needs Docker)

secsuite detects your stack and shells out to Semgrep, Trivy, Gitleaks, and OWASP ZAP - in parallel - then normalizes and deduplicates their findings into one report. It is a defensive DevSecOps orchestrator and contains no attack code of its own.

Works on JavaScript/TypeScript, Python, Java/Kotlin, C#/.NET, Go, Rust, PHP, and Ruby.

secsuite is a single static binary with no runtime to install. Every option below gives you the same executable - pick whichever fits your setup.

Download (macOS, Linux, Windows - all releases):

curl -sfL https://github.com/kousthubha-sky/secsuite-cli/releases/latest/download/secsuite_linux_amd64.tar.gz | sudo tar -xz -C /usr/local/bin secsuite

npm (the package ships the prebuilt binary; Node is only the launcher):

npm i -g secsuite     # or: pnpm add -g secsuite / bun add -g secsuite / npx secsuite

Go:

go install github.com/kousthubha-sky/secsuite-cli/cmd/secsuite@latest

Docker (all static scanners bundled, nothing else to install):

docker run --rm -v "$PWD:/scan" kousthubhaone/secsuite-cli:latest scan /scan

The scanners themselves are separate tools - run secsuite doctor to see what is missing and how to install it, or use the Docker image, which bundles them. The dast command needs Docker running; the static scan does not. Missing scanners are skipped with a warning, never a hard failure.

scan exits 1 when it finds anything at or above --severity, so a failed job blocks the deploy. One step on GitHub Actions (Ubuntu runners):

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }        # full history so Gitleaks can scan past commits
      - uses: kousthubha-sky/secsuite-cli@v0.2.0
        with:
          severity: high
          sarif-file: secsuite.sarif    # optional: for GitHub Code Scanning
  deploy:
    needs: security                     # deploy only runs if the gate passed

Upload the SARIF and findings appear in your repo's Security tab and as inline PR annotations:

      - uses: github/codeql-action/upload-sarif@v4
        if: always()
        with: { sarif_file: secsuite.sarif }

(Needs permissions: security-events: write on the job.) A full copy-paste workflow, including a manual-install variant for non-Ubuntu runners, lives in examples/ci/github-actions.yml.

Your first scan will report old findings you cannot fix today. Accept them once instead of turning the gate off:

secsuite baseline .
git add .secsuite-baseline.json && git commit -m "Accept current security baseline"

From then on scan gates only on NEW findings. Baselined ones stay visible in --json/--sarif output, marked "baselined": true. Known limit: matching is exact (tool + rule + file + line), so a finding whose line shifts reappears as new - re-run secsuite baseline after big refactors.

secsuite dast https://staging.example.com          # passive baseline scan (safe)
secsuite dast https://staging.example.com --full   # active scan - sends real attack payloads

The default baseline scan spiders the app and applies passive rules only. --full attacks the target and mutates state: only point it at targets you are authorized to test, never live production. Burp Suite has no free headless API; ZAP covers this lane, and src/adapters/zap.ts is the extension point if your organisation owns Burp Enterprise.

scan:

dast supports --full, --severity, --json, --sarif, and --raw.

Commit a secsuite.yaml so your team and CI share one policy:

severity_threshold: high
ignore:
  paths: ["tests/", "vendor/", "**/generated/**"]

A scanner exiting non-zero because it found something is not an error - secsuite trusts the scanner's report file over its exit code.

secsuite follows the AXI agent-experience guidelines:

• Exit codes are the contract; an unknown flag exits 2, never 1.
• --json - prints one compact JSON payload to stdout; all progress goes to stderr.
• JSON omits raw scanner payloads unless --raw is passed.
• Human output appends help: lines suggesting the next command.
• Bare secsuite prints live status, not help text.

detect stack -> run scanners in parallel -> normalize to one schema -> dedupe -> report

Every finding becomes { tool, category, ruleId, severity, title, location, sources, ... } regardless of which scanner produced it. Two findings merge only when different tools report the same file, line, and category (e.g. Trivy and Gitleaks both flagging one hardcoded key) - the survivor lists both in sources. Multiple findings from the same tool at one location stay separate, because they are distinct issues.

secsuite scan fixtures/vulnerable --severity high

An intentionally-vulnerable sample (SQL injection, outdated deps, fake AWS keys, bad Dockerfile) ships in fixtures/vulnerable/ to exercise the scanners. Nothing in it is a real secret.

MIT