ksec

Self-contained security scanner for your codebase. One binary, zero dependencies, five scanners running in parallel.

ksec detects leaked secrets, vulnerable dependencies, supply chain attacks, OWASP Top 10 vulnerabilities, and obfuscated code — all without installing external tools.

$ ksec scan .

═══ ksec scan report ═══

  ✓ secrets — 0 findings (12ms)
  ✓ supply-chain — 0 findings (8ms)
  ✓ sast — 0 findings (6ms)
  ✓ obfuscation — 0 findings (1ms)
  ⚠ deps — 2 findings (680ms)
       HIGH  CVE-2024-1234 — lodash@4.17.20
       MEDIUM  GHSA-abcd — express@4.18.0

─── summary ───
  scanners: 5 run
  findings: 2 total, 1 high/critical

Why ksec?

Tool	Installs needed	What it covers
gitleaks + trivy + osv-scanner + semgrep + socket	5 separate binaries	secrets, deps, SAST, supply chain
ksec	1 binary (4.6 MB)	all of the above + obfuscation

• No external tools required — everything is built-in
• Fast — parallel execution, regex-based scanning, ~3s for a full project scan
• Low false positives — smart allowlists for form labels, test files, comments, config patterns
• Offline-first — only the deps scanner needs network (OSV API)

Install

One-liner (Linux / macOS)

curl -fsSL https://raw.githubusercontent.com/dev-toolings/ksec/master/install.sh | sh

From source (Rust)

git clone https://github.com/dev-toolings/ksec.git
cd ksec
cargo build --release
cp target/release/ksec ~/.local/bin/

Pre-built binaries

Binaries for Linux (x86_64, aarch64) and macOS (x86_64, aarch64) are available on the Releases page.

Usage

# Full scan (all 5 scanners in parallel)
ksec scan .

# Scan specific category
ksec secrets .
ksec deps .
ksec sast .
ksec supply-chain .
ksec obfuscation .

# JSON output (pipeable to jq, CI, etc.)
ksec scan --json .

# Filter by severity
ksec scan --min-severity high .

# Generate pre-commit hooks (lefthook)
ksec init

Scanners

Secrets (60+ rules)

Detects leaked API keys, tokens, private keys, and database URIs using embedded regex patterns.

Covered providers: AWS, GitHub, GitLab, Slack, Stripe, Google, OpenAI, Anthropic, Discord, Twilio, SendGrid, Firebase, Supabase, NPM, PyPI, Docker Hub, Telegram, Heroku, Shopify, Mailchimp, HashiCorp Vault, Datadog, Sentry, Vercel, Cloudflare, and more.

Also detects: private keys (RSA, DSA, EC, OpenSSH, PGP), database URIs with passwords, basic auth in URLs, hardcoded bearer tokens, JWTs, and password assignments.

Smart filtering: Skips comments, regex definitions, form labels, validation schemas, test files, placeholder values, and environment variable references.

Dependencies

Parses lockfiles and queries the OSV API (Google's open vulnerability database) for known CVEs.

Supported lockfiles:

• package-lock.json, bun.lock, yarn.lock (npm)
• Cargo.lock (Rust)
• composer.lock (PHP)
• requirements.txt, poetry.lock (Python)
• go.sum (Go)

Supply Chain

Detects suspicious patterns in JavaScript packages that indicate malicious behavior:

• Dynamic code execution — eval(), Function(), vm.runInNewContext()
• Network exfiltration — HTTP requests, DNS lookups, WebSocket connections
• Filesystem access — reading .ssh/, .env, /etc/passwd
• Obfuscation — hex-encoded strings, String.fromCharCode(), global[] accessors
• Malicious install scripts — curl/wget in postinstall, downloading binaries
• Environment harvesting — dumping process.env over network

SAST (OWASP Top 10)

Static analysis for common security vulnerabilities:

• SQL Injection — string concatenation/interpolation with user input in queries
• XSS — innerHTML, dangerouslySetInnerHTML, document.write()
• Command Injection — exec()/os.system() with user-controlled input
• Path Traversal — user input in file paths
• SSRF — fetch()/requests.get() with user-controlled URLs
• Insecure Crypto — DES, ECB mode, Math.random() for security
• Deserialization — pickle.loads(), yaml.load(), PHP unserialize()
• Prototype Pollution — __proto__ assignment
• NoSQL Injection — $where/$gt/$ne from user input
• Open Redirect — unvalidated redirects
• CORS Misconfiguration — wildcard Access-Control-Allow-Origin

Supported languages: JavaScript, TypeScript, Python, PHP, Go, Rust, Ruby.

Obfuscation

Detects obfuscated code in config files (.config.js, .config.mjs, etc.):

• Lines longer than 500 characters
• global[] accessor patterns
• Heavy hex-encoded content (\x41\x42...)

.ksecignore

Create a .ksecignore file at the root of your project to exclude paths from scanning. Uses gitignore syntax:

# Ignore test fixtures with fake secrets
tests/fixtures/

# Ignore generated files
generated/

# Ignore specific file
scripts/seed-data.sh

# Re-include a specific path
!tests/fixtures/real-secrets.env

Pre-commit hooks

ksec init generates a lefthook.yml that runs ksec on pre-commit (fast checks) and pre-push (full scan):

ksec init
# Install lefthook: go install github.com/evilmartians/lefthook@latest
lefthook install

CI Integration

# .github/workflows/security.yml
name: Security Scan
on: [push, pull_request]

jobs:
  ksec:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install ksec
        run: |
          curl -fsSL https://github.com/dev-toolings/ksec/releases/latest/download/ksec-linux-x86_64 -o /usr/local/bin/ksec
          chmod +x /usr/local/bin/ksec
      - name: Run scan
        run: ksec scan --min-severity high .

JSON Output

All findings are available as structured JSON for integration with other tools:

ksec scan --json . | jq '.[] | select(.findings | length > 0)'

Exit Codes

Code	Meaning
0	No high/critical findings
1	High or critical findings detected

Architecture

ksec (single binary, ~4.6 MB)
├── secrets     60+ regex rules, .gitignore-aware file walker
├── deps        lockfile parsers + OSV API batch queries
├── supply-chain    pattern detection in JS packages
├── sast        OWASP Top 10 rules for JS/TS/Python/PHP/Go/Rust
├── obfuscation     long-line + global[] detection in config files
└── .ksecignore     gitignore-style exclusion file

License

MIT