Security Scanner

pip install security-scanner

# Scan your project directory
security-scan ./my-app

# JSON output (for CI/CD)
security-scan ./my-app --format json

# Scan and fail on high-severity findings
security-scan ./my-app --fail-on high

# Scan a specific file
security-scan src/api/routes.py

Scanning ./my-app...

HIGH   src/api/users.js:47      Hardcoded API key detected
HIGH   src/routes/admin.js:12   Admin route without authentication
MEDIUM src/db/queries.js:23     SQL string concatenation (potential injection)
MEDIUM src/index.js:8           CORS configured to allow all origins
LOW    src/utils/debug.js:3     Debug logging enabled

5 findings: 2 high, 2 medium, 1 low

# GitHub Actions example
- name: Security scan
  run: |
    pip install security-scanner
    security-scan . --format json --fail-on high > security-report.json