marcinguy/betterscan-ce

Code Scanning/SAST/Static Analysis/Linting using many tools/Scanners + OpenAI GPT with One Report (Code, IaC) - Betterscan Community Edition (CE)

Notice: For commercial use PRO version is recommended (all features available). The CE (Community Edition) WILL NOT show the findings location(s). Serves as a DEMO to check Betterscan capabilities. If you work on Open Source project or you are a Nonprofit, free licenses are available for PRO version.

Open DevSecOps Orchestration Toolchain

Scan your source code and infra IaC against top security risks

Betterscan is a orchestration toolchain that uses state of the art tools to scan your source code and infrastructure IaC and analyzes your security and compliance risks.

Currently supports: PHP, Java, Scala, Python, PERL, Ruby, .NET Full Framework, C#, C, C++, Swift, Kotlin, Apex (Salesforce), Javascript, Typescript, GO, Infrastructure as a Code (IaC) Security and Best Practices (Docker, Kubernetes (k8s), Terraform AWS, GCP, Azure), Secret Scanning (166+ secret types), Dependency Confusion, Trojan Source,

Open Source and Proprietary Checks (total ca. 6,000+ checks).

Checks for misconfigurations across all major (and some minor) cloud providers (AWS Checks, Azure Checks, GCP Checks, CloudStack Checks, DigitalOcean Checks, GitHub Checks, Kubernetes Checks, OpenStack Checks, Oracle Checks)

Open and Developer friendly DevSecOps toolchain

Betterscan uses many tools for Code, Cloud, secrets, dependencies - SCA (software composition analysis) and Supply Chain Risks, and also precise Graph-based SAST analysis for Code and AI/OpenAI GPT. All the best Tools, researched, setup, ran together, unifed and de-duplicated results, so you don't have to do it. Added our own checkers also. Continuous Security. Fit for purpose and results. For commercial use PRO version is recommended (all features available)

Above is sample engine (Binary runtime) run powering everything (CLI, Web Platform, CI/CD Actions, GitHub App, DefectDojo, Reviewdog)

Above is Web Interface.

Even more screenshots and integrations in Wiki

OpenAI GPT plugin is available only in PRO version and requires paid OpenAI plan (billed per usage)

If you want to scan your Code and Infrastructure (including Secrets, SBOMs, and dependencies)

Below setup is for Linux (Ubuntu), you can also run it on MacOS/Docker and Windows via WSL/Docker setup (see here)

Install Docker Engine (Instructions for Ubuntu or on Ubuntu via one command via snap sudo snap install docker), if you don't already have it, and run this in your Git code directory

Quickstart

Sigstore cosign images are available.

2 options are available:

1. Binary runtime

CLI output

Run in command prompt in your Git repository folder:

sh <(curl https://dl.betterscan.io/cli.sh)

HTML, JSON, SARIF output

The result will be in the current directory in "report.html", "report.json" and "report.sarif" file

Run in command prompt in your Git repository folder:

sh <(curl https://dl.betterscan.io/cli-html.sh)

2. Platform with Webinterface and workers

Docker

If you need CI/CD and Web Interface, you need Docker-Compose (Instructions for Ubuntu) installed as well, if you don't already have it.

Run in command prompt (or docker-compose up or docker compose up ):

git clone https://github.com/marcinguy/betterscan-ce.git
cd betterscan-ce/dockerhub
./start.sh

Open up the Browser to:

http://localhost:5000

Sign up locally (and login in when needed)

Kubernetes

For Kubernetes Platform (also minikube)

It is available via Helm package manager

helm repo add betterscan-repo https://marcinguy.github.io/betterscan-chart
helm repo update
helm install betterscan betterscan-repo/betterscan

That's it.

Read more in the Wiki, also for GitHub/GitLab/Azure DevOps Server integration, PR scanning, GitHub Action, GitHub App, DefectDojo, Reviewdog

Sample integrations for BitBucket Pipelines, GitLab CI, Google CloudBuild, CircleCI, Jenkins, TravisCI are also provided.