Skip to main content

Getting Started

Install scan4secrets and run your first scan in under two minutes.

Install​

pipx install git+https://github.com/m14r41/scan4secrets

pip​

pip install git+https://github.com/m14r41/scan4secrets
# or, when on PyPI:
pip install scan4secrets

From source​

git clone https://github.com/m14r41/scan4secrets
cd scan4secrets
pip install -e .

Docker​

docker run --rm -v $(pwd):/scan ghcr.io/m14r41/scan4secrets:latest --path /scan

Prebuilt binaries​

Windows64 and Linux amd64 binaries are published with every release. See Downloads for direct links and checksums.

After install, the scan4secrets command is on your PATH.

scan4secrets --version

Quick start​

SAST. Scan a local directory​

scan4secrets --path /code

By default this scans for secrets only. Add --misconfig to also scan for code vulnerabilities and misconfigurations, or --misconfig-only to scan for vulnerabilities alone:

scan4secrets --path ./src --misconfig                 # secrets + vulnerabilities
scan4secrets --path ./src --misconfig-only            # vulnerabilities only
scan4secrets --path . --misconfig --report html --output report

scan4secrets carries 416 rules total — 193 secret rules plus 223 vulnerability / misconfiguration rules covering injection (SQL/NoSQL/command/code), SSTI, XXE, deserialization, path traversal, SSRF, XSS across 11 templating engines, weak crypto, JWT flaws, and IaC/config misconfig (Terraform, Kubernetes, Dockerfile, GitHub Actions, and more). Each vulnerability finding carries a rich record: name, severity, evidence (file:line), vulnerable code, secure code, remediation, technical & business impact, and CWE + OWASP Top-10 mapping.

DAST. Crawl a live target​

scan4secrets --url https://staging.example.com --threads 32

DAST runs all 15 bundled wordlists (1279 unique paths: /.env, /wp-config.php, /backup.zip, source maps, admin panels, API docs, …) by default.

Use your own wordlist file​

scan4secrets --url https://target.com --wordlist /path/to/my-paths.txt

Combine multiple custom wordlists​

scan4secrets --url https://target.com --wordlist seclists/Common.txt internal-paths.txt

Restrict to specific bundled wordlists by stem​

scan4secrets --url https://wp.example.com --wordlist-only wordpress common env

Turn wordlist seeding off entirely​

scan4secrets --url https://target.com --no-wordlist

Full audit with verification + HTML report​

scan4secrets --path . --url https://app.example.com \
    --verify --report html sarif json \
    --output reports/audit-$(date +%F)

Authenticated DAST with proxy (works with Burp / ZAP)​

scan4secrets --url https://app.example.com \
    --cookie "session=abc123" \
    --header "X-Tenant: acme" \
    --proxy http://127.0.0.1:8080

CI gate. Exit 1 on any high-or-above finding​

scan4secrets --path . --report sarif --fail-on high --output reports/scan

Reports​

scan4secrets --path . --report sarif json jsonl csv html excel pdf --output reports/run
FormatBest for
sarifGitHub Code Scanning, GitLab Security Dashboard, Sonar, Defect Dojo
jsonTooling integrations, post-processing
jsonlSIEM/SOAR pipelines (Splunk, Datadog, Sentinel)
csvSpreadsheet triage
htmlCollapsible, expandable finding cards for client review
excelPivot tables and exec summaries
pdfCompliance evidence packets

The html report renders each finding as an expandable card — the summary shows severity + name + file:line + CWE, and expanding reveals the full record including vulnerable/secure code, remediation, and impacts. It ships with a filter box, severity/file/name sort, and expand/collapse-all, is theme-aware, and is fully self-contained. JSON/CSV/SARIF/Excel/PDF carry all fields.

Secret values are shown in full by default (paste-ready for vendor PoC). Pass --mask to redact them to abcd****wxyz for screenshots or shared transcripts.

Next​