|
| 1 | +# SecuScan |
| 2 | + |
| 3 | +A dual-platform static vulnerability scanner for **Android** and **Web** applications. |
| 4 | + |
| 5 | +## Features |
| 6 | +- **Auto-Detection**: Automatically detects if the project is Android or Web. |
| 7 | +- **Web Scanning**: Uses `Bandit` to find security issues in Python code. |
| 8 | +- **Android Scanning**: Uses `MobSF` (via Docker) for deep APK analysis. |
| 9 | +- **Reporting**: Output to Console (Rich Table), HTML, or JSON. |
| 10 | +- **CI/CD Ready**: Exit codes for passing/failing builds based on severity. |
| 11 | + |
| 12 | +## Getting Started |
| 13 | + |
| 14 | +### Option 1: Docker (Easiest) |
| 15 | +You can use the pre-built image directly from Docker Hub without installing Python dependencies. |
| 16 | + |
| 17 | +```bash |
| 18 | +# Pull the latest image |
| 19 | +docker pull secuscan/secuscan:latest |
| 20 | + |
| 21 | +# Run a scan on the current directory |
| 22 | +docker run --rm -v $(pwd):/scan secuscan/secuscan:latest scan /scan |
| 23 | +``` |
| 24 | +*Note: The official image is available at `secuscan/secuscan`.* |
| 25 | + |
| 26 | +### Option 2: Local Installation |
| 27 | +If you prefer to run it as a Python package: |
| 28 | + |
| 29 | +```bash |
| 30 | +git clone https://github.com/nkuv/SecuScan.git |
| 31 | +cd SecuScan |
| 32 | +python3 -m venv venv |
| 33 | +source venv/bin/activate # Windows: venv\Scripts\activate |
| 34 | +pip install -e . |
| 35 | +``` |
| 36 | + |
| 37 | +### Option 3: Build from Source |
| 38 | +To build the Docker image locally: |
| 39 | + |
| 40 | +```bash |
| 41 | +docker build -f docker/Dockerfile -t secuscan . |
| 42 | +docker run --rm -v $(pwd):/scan secuscan scan /scan |
| 43 | +``` |
| 44 | + |
| 45 | +## Usage |
| 46 | + |
| 47 | +### Basic Scan |
| 48 | +```bash |
| 49 | +secuscan scan . |
| 50 | +``` |
| 51 | + |
| 52 | +### Output Formats |
| 53 | +```bash |
| 54 | +secuscan scan . --format table # Pretty table (default via console) |
| 55 | +secuscan scan . --format console # Text list |
| 56 | +secuscan scan . --format json --output report.json |
| 57 | +secuscan scan . --format html --output report.html |
| 58 | +``` |
| 59 | + |
| 60 | +### CI/CD Integration |
| 61 | +SecuScan will exit with **code 1** if any **HIGH** or **CRITICAL** vulnerabilities are found. |
| 62 | + |
| 63 | +```yaml |
| 64 | +steps: |
| 65 | + - name: Security Scan |
| 66 | + uses: docker://secuscan/secuscan:latest |
| 67 | + with: |
| 68 | + args: scan . |
| 69 | +``` |
0 commit comments