Secrover - Open-Source Security Reports, Made Simple - 100% f

项目说明

<p align="center">
<img src=" height="40" alt="Secrover" />
</p>

Secrover is a free and open-source tool that generates clear, professional security audit reports — without paywalls or proprietary SaaS. Just useful insights you can trust and share.

Secrover

!GitHub last commit
!Docker Pulls
!Docker Stars

🔍 Features

* 🔒 Security Audits: Scans your dependencies, code, and domains to find .
* 🧠 Human-readable Reports: Clear, actionable reports — even for non-technical audiences.
* ⚡ Easy Setup & Automation: Configure with a simple YAML file, schedule recurring scans cron, or run automatically using GitHub Actions.
* 📤 Remote Export: Upload reports to SFTP, WebDAV, SMB, S3, or Google Drive.
* 💻 Cross-platform: Works on Linux, macOS, and Windows.
* 🌟 Actively Maintained: Continuously improved with new features and workflow enhancements.

Audits

| Category | Checks | Supported languages |
| --------------- | ------------------------------------------------------ | -------------------------- |
| Dependencies | check | All languages supported by os |
| Code | Static check | All languages supported by opengrep |
| Domains | SSL certificate, HTTP→HTTPS Redirect, HSTS header, TLS , Open Ports, Security Headers, Hosting Location | - |

Screenshots

| Dependencies Audit | Code Audit | Domains Audit |
| --- | --- | --- |
| <a href=" <img src=" height="200" alt="Dependencies Audit" /> </a> | <a href=" <img src=" height="200" alt="Code Audit" /> </a> | <a href=" <img src=" height="200" alt="Domains Audit" /> </a> |

Demo

You can see Secrover in action right now:

How the demo works

The demo repository uses GitHub Actions to automatically:

1. Pull the latest of Secrover ().
2. Run security scans on Secro and domains.
3. Generate an HTML security report.
4. Deploy the report to GitHub Pages, making it publicly accessible.

> This setup is ideal for publicly sharing reports, for example on GitHub Pages or a public website.

➡️ You can copy the workflow from the demo repository’s .github/workflows/secrover.yml to get started quickly.

Flexible Deployment Options

Secrover is not limited to GitHub Actions — you can also export reports to any remote destination (SFTP, WebDAV, SMB, S3, Google Drive, etc.) using rclone, making them automatically a on internal servers, intranet sites, cloud storage, or backup locations.

This flexibility ensures that whether you want public reporting or private/internal hosting, Secrover can fit your workflow.

Getting Started

Secrover is designed to be simple: configure what you want to scan, then run it with Docker.
Within minutes, you’ll have a professional HTML security report you can share.

Create a new folder/repo with a config.yaml file inside where you will list your repositories and domains to scan.

Example:

#### Accessing Private Repositories

Secro cloning private repositories in two ways:

##### HTTPS

1. Create a GitHub Personal Access Token
* Go to your GitHub account
* Click "Generate new token" (fine-grained)
* Give it a name like Secrover
* Choose "Only select repositories" and select the private repos Secro to clone
* Under Repository permissions, grant:
* Contents: Read-only
* Generate and copy the token

2. Create a .env file

In the same directory as your config.yaml, create a .env file:

> ⚠️ Do not share this file or commit it to control.
> Add .env to your .gitignore file to prevent accidental leaks.

##### SSH

To allow Secrover to access private repositories via SSH, forward your local SSH agent to the container. This avoids permission issues and keeps your private keys off the container filesystem entirely.
First, make sure your SSH agent is running and your key is added:

Then run Secrover with the agent socket forwarded:

Install & run with Docker

You can run Secro using Docker without installing any local dependencies.

One-Time Scan (on-demand)

From the folder where your config.yaml (and optionally .env) lives, run:

> 💡 If you’re only scanning public repositories or do not need to change default settings, the --en .env flag is optional.

What happens:

* Secrover read the list of repositories and domains from your config.yaml
* It clones repositories, scan them, as well as your domains
* It generates a full HTML security report into the output/ folder

Automated Scans (Cron Mode)

Secrover also supports automatic recurring scans using an internal cron scheduler (via Supercronic).

You can schedule scans to run periodically inside the container — ideal for servers, NAS setups,...

Example: Run every day at midnight

What happens:

* Secro Supercronic in the background
* It executes a new scan based on the chosen schedule
* By default, results are written to /output and logs to /output/secrover.log

Exporting Reports (Optional)

Secrover can upload generated reports to remote destinations (SFTP, WebDAV, SMB, S3, etc.) via rclone.

For setup instructions and ad options, see EXPORT.md.

En Reference

| | Required | Default | Description |
| ---------------- | -------- | -------------------- | ------------------------------------------------------------------------------------------------------------ |
| CONFIG_FILE | ✅ | /config.yaml | Path to your YAML configuration inside the container. |
| OUTPUT_DIR | ✅ | /output | Directory where reports and logs are saved. |
| REPOS_DIR | ✅ | repos/ | Directory where git repos are cloned. |
| GITHUB_TOKEN | ❌ | - | Used to clone private GitHub repositories o. |
| CRON_SCHEDULE | ❌ | - | Optional cron expression to schedule recurring scans |
| EXPORT_ENABLED | ❌ | false | Enable exporting reports to remote destinations using rclone. |
| RCLONE_REMOTES | ❌ | - | Comma-separated list of rclone remote names (from rclone.conf) to upload reports to. |
| RCLONE_PATH | ❌ | /secro/ | Path on the remote(s) where reports should be uploaded. Supports timestamp expansion using $(date +FORMAT) |
| IP2LOCATION_DB_PATH | ❌ | data/IP2Location/ | Path to the IP2Location database file used for resolving country information from IP addresses. |

All can be defined in your .env file or passed directly using -e flags when running the container.
For example:

is equi to having them set in your .env file.

Thanks and Acknowledgments

This project benefits from the fantastic work of several open-source projects:

A big thanks to all the maintainers and contributors behind these amazing projects, without whom this project wouldn't be possible!

License

Secrover is released under the GNU General Public License v3.0 (GPL-3.0).

👉 Read the full license here

Stargazers over time

项目信息

开发语言：Python

Star 数：254

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Open-Source Security Reports, Made Simple - 100% free. No paywalls, just actionable insights.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。