drogonsec - High-performance open-source security scanner comb

项目说明

<di="center">

🛡️ Drogonsec Security Scanner

![CI/CD]()
![OWASP Top 10 2025]()
![Go 1.26.6+]()
![GitHub Release]()
![GitHub Issues]()

</div>

<img alt="The DrogonSec banner: the ASCII logo, the engines it runs — SAST, SCA, leaks, git-history and IaC — and the of the build" src="docs/assets/banner.gif" />

> An open-source, comprehensi scanner combining SAST, SCA, and secret detection aligned with OWASP Top 10:2025 — created for intelligent remediation.

---

What's New in v0.4.0

Full-depth SCA. The dependency engine now reads the tree that actually
ships — every transiti, at the installed — for all eight
supported ecosystems, instead of the handful a manifest declares.

Every ecosystem in full: lockfiles and installed trees for npm, Yarn,

Python, PHP, Rust (new) and Ruby; the package manager's own cache for Go and
Dart; and Ma offline by Maven's own rules, matching
m:tree artifact for artifact. gradle.lockfile is read too.

Dependency paths: every SCA finding says how the package got there —

Required : via com.example:core — so the fix lands on the dependency a
de can actually change.

SBOM dependency graph: the CycloneDX export carries every edge, for Grype,

Trivy and Dependency-Track.

Stable fingerprints: every finding keeps its identity across scans and

code moves, in JSON and as SARIF partialFingerprints.

Fixed: Ma were ne against an ad, and

manifest ranges no longer produce false positives.

Full details in the CHANGELOG.

---

Documentation

📖 Full Documentation: --> Drogonsec Doc

---

Features

| Engine | Description |
|--------|-------------|
| SAST | Static Application Security Testing for 20+ languages |
| SCA | Software Composition Analysis — the full transitive tree, not just what you declared |
| Leaks | Secret detection — 50+ patterns (AWS, GCP, GitHub, JWT, SSH keys...) |
| IaC | Infrastructure as Code misconfigurations (Terraform, Kubernetes) |
| AI | AI-powered remediation — Ollama (local/free) or cloud pro |

Security Frameworks

OWASP Top 10:2025 — All 10 categories covered (including 2 new: Supply Chain & Mishandling Exceptions)

CWE — Common Weakness Enumeration mapping

CVSS 3.1 — Se scoring

SARIF 2.1 — GitHub/Azure DevOps integration

Supported Languages

Python Java Ja TypeScript Go Kotlin C# PHP Ruby Swift Dart Elixir Erlang Shell C/C++ HTML Terraform Kubernetes Nginx

Dependency Co

A manifest names a handful of packages, at *ranges*. A lockfile names
every package that will actually be installed, at the it will be
installed at — and that second group is nearly all the code you ship, and where
nearly all the ad are. So the column that matters is depth:

| Ecosystem | Read from | Depth |
|---|---|---|
| Node.js | package-lock.json, yarn.lock, node_modules/, package.json | Full tree |
| Python | poetry.lock, uv.lock, Pipfile.lock, .venv/, pyproject.toml, requirements.txt | Full tree |
| PHP | composer.lock, /composer/installed.json, composer.json | Full tree |
| Rust | Cargo.lock, Cargo.toml | Full tree |
| Ruby | Gemfile.lock | Full tree |
| Go | go.mod, routes from the module cache | Full set |
| Java | pom.xml resol against ~/.m2, gradle.lockfile | Full tree |
| Dart | pubspec.lock, pubspec.yaml | Full tree |

For npm, Python and PHP the engine falls back through three sources — the
lockfile, then the installed tree on disk (node_modules/, a ,
/), then the manifest. A repository that does not commit a lockfile is
still scanned in full after an install.

For Go, Dart and Java the edges come from the package manager's own cache — the
module cache, the pub cache, the Ma repository — which already holds
every dependency's manifest once the project has been built. Maven, which has no
lockfile, is resol by Maven's own rules (parent POMs, imported BOMs,
nearest-wins, dependency management, exclusions) and matches
m:tree artifact for artifact.

Every finding carries whether the package is direct and, where the source
records it, the route that introduced it:

A range is not a . A dependency read from a manifest is checked
against ad only when the requirement names a single release.
lodash: "4.17.15" is checked; lodash: "^4.17.15" is not — it installs
4.17.21, and reporting the ad for 4.17.15 would name a you never
installed. Those packages still appear in the in and the SBOM, and the
scan says how many it had to skip. Committing a lockfile is the fix, and it buys
the transitive tree at the same time.

No network. Resolving a range against a registry would answer a different
question — what would install *today* — and would put a scan that runs
air-gapped on the far side of the internet.

Full detail in docs/modules.md.

---

Quick Start

Installation

Go Install (requires Go 1.26.6+):

From source:

Docker:

Basic Usage

---

Output Formats

Text (default)

JSON

SARIF (GitHub Security Integration)

CycloneDX SBOM

Export a CycloneDX 1.5 Software Bill of Materials of the
dependencies discovered by the SCA engine. The output is consumable by tools
like Grype, Trivy, and Dependency-Track.

> Note: where a lockfile or an installed tree is a, the SBOM covers
> the full transitive set and carries the CycloneDX dependencies graph — every
> edge, so a consumer can work out for itself which component pulled in a
> one. An ecosystem read from a manifest alone contributes its
> declared components without edges, because a manifest records none. SPDX
> output is planned for a later release.

---

Configuration

Create .drogonsec.yaml in your project root:

---

AI-Powered Remediation

DrogonSec includes AI-powered remediation, pro intelligent, context-aware fixes for detected . Ollama + DeepSeek Coder is the recommended open-source option — Ollama is open-source (MIT license) and runs 100% locally with no data leaving your machine.

Local AI (Ollama) — Recommended for OSS

Cloud AI (API Key Required)

Bring Your Own AI

Any OpenAI-compatible endpoint works as a custom provider:

Security Hardening

The AI client includes several defensi, documented in docs/security.md:

No HTTP redirects — refuses 3xx responses to prevent x-api-key leaking to a third-party host via 302 Location: …

HTTPS enforcement — non-loopback HTTP endpoints are rejected; only https:// or / are accepted

HMAC-SHA256 cache integrity — every cached response is tagged with a per-user key under ~/.drogonsec/ai-cache/cache.key (0600); tampered entries are discarded on read

Ollama shape — auto-detection requires a valid {"models":[...]} response from /api/tags, not just HTTP 200 on port 11434

Cache + output perms — cache dir is 0700, every cached file and every --output report is 0600 (reports embed code snippets and secrets)

---

Shell Completion

Drogonsec supports rich tab-completion for bash, zsh, fish, and PowerShell — with inline descriptions for enum flags, context-aware model suggestions, and directory-only completion for scan paths. See the Usage docs for details.

> Security note: --ai-key is deliberately excluded from completion so API keys are ne by shell history-completion caches. Always pass keys via AI_API_KEY.

---

OWASP Top 10:2025 Co

| # | Category | Status |
|---|----------|--------|
| A01 | Broken Access Control | ✅ 23 rules |
| A02 | Security Misconfiguration | ✅ 31 rules |
| A03 | Software Supply Chain Failures 🆕 | ✅ SCA Engine |
| A04 | Cryptographic Failures | ✅ 18 rules |
| A05 | Injection | ✅ 45 rules |
| A06 | Insecure Design | ✅ 15 rules |
| A07 | Authentication Failures | ✅ 20 rules |
| A08 | Software or Data Integrity Failures | ✅ 9 rules |
| A09 | Security Logging & Alerting Failures | ✅ 11 rules |
| A10 | Mishandling of Exceptional Conditions 🆕 | ✅ 8 rules |

---

Secret Detection Patterns

Drogonsec detects 50+ secret patterns including:

Cloud: AWS Access Keys, GCP API Keys, Azure Storage Keys

SCM: GitHub tokens (classic, fine-grained, OAuth, App)

Payment: Stripe Secret/Restricted Keys

Communication: Slack Bot/App tokens, Webhook URLs

Email: SendGrid API Keys

Crypto: RSA/EC/SSH/PGP private keys, JWT tokens

DB: Connection strings (PostgreSQL, MySQL, MongoDB, Redis)

Generic: Hardcoded passwords, API keys, secrets

---

Architecture

---

Contributing

Contributions are welcome! Areas to contribute:

New security rules for any language

Additional secret patterns

Parser impro

Documentation

Bug fixes

See CONTRIBUTING for guidelines. All participants are expected to follow our Code of Conduct.

To report a security , please follow our Security Policy — do not open a public issue.

---

License

Apache License 2.0 — See LICENSE

---

Credits

Inspired by Horusec. DrogonSec is its modern, actively maintained, and updated with enhanced capabilities.

Built with: Go, Cobra, Viper, go-git.

---

Maintained by

This open-source project is maintained and supported by CROSS-INTEL.

项目信息

开发语言：Go

Star 数：182

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕High-performance open-source security scanner combining SAST, SCA, Secret Detection, and IaC analysis, built for developers and CI/CD pipelines, using AI for recommendation!展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。