Quick Start Guide

Relevant source files

The following files were used as context for generating this wiki page:

• QUICK_START.md
• README.md
• CONTRIBUTING.md
• SECURITY_REVIEW.md
• configs/default.json
• package.json

The Unified Security Scanner is an enterprise-grade security orchestration tool designed to detect vulnerabilities, hardcoded secrets, and supply chain threats with a low false positive rate (under 5%). It utilizes a multi-phase scanning strategy that combines traditional Static Application Security Testing (SAST) with AI-enhanced validation and targeted deep-dive analysis.

This guide provides the necessary steps to install the environment, execute initial scans, and integrate the scanner into development workflows. It covers basic CLI usage, configuration options, and the interpretation of scan results across different severity levels.

Sources: README.md:1-20, QUICK_START.md:9-16

🛠️ Installation and Setup

To begin using the scanner, ensure your environment meets the minimum requirements. The scanner is built on Node.js and utilizes pnpm for efficient dependency management.

Prerequisites

• Node.js: Version 18.0.0 or higher.
• pnpm: Version 8.0.0 or higher.
• Git: Required for repository management.
• External Tools: TruffleHog (for secret detection) and Semgrep (for code analysis).

Sources: QUICK_START.md:19-35, package.json:34-36

Building from Source

For the most up-to-date security rules, it is recommended to build the project directly from the source repository.

git clone https://github.com/GeeksikhSecurity/unified-security-scanner.git
cd unified-security-scanner
pnpm install
pnpm build

Sources: CONTRIBUTING.md:12-19, QUICK_START.md:41-52

🚀 Running Your First Scan

The scanner is executed via the CLI package. A basic scan targets a directory and evaluates it against built-in security rules.

Basic Execution

cd packages/cli
node dist/index.js scan <target_directory>

Sources: QUICK_START.md:76-85

Core Scanning Logic

The scanner follows a structured orchestration flow to ensure high accuracy and comprehensive coverage.

The scan process moves from broad, high-noise filters to specific, validated findings using AI and context-aware logic.
Sources: README.md:24-34, CONTRIBUTING.md:23-32

📊 Understanding Scan Results

Scan findings are categorized by severity to help teams prioritize remediation efforts.

Severity	Description	Examples
🔴 CRITICAL	Exposed secrets or active injection points.	Hardcoded API keys, SQL Injection.
🟠 HIGH	Significant vulnerabilities.	XSS, EOL packages, Path Traversal.
🟡 MEDIUM	Configuration issues or outdated logic.	Outdated packages, React hook bugs.
⚪ LOW	Minor optimizations or code quality.	Missing error handling, Type updates.

Sources: QUICK_START.md:104-122, SECURITY_REVIEW.md:15-20

⚙️ Configuration

The scanner's behavior is managed via a .securityrc.json file. This allows users to enable/disable tools, exclude specific directories like node_modules, and define "fail-on" conditions for CI/CD pipelines.

Configuration Structure

{
  "tools": {
    "truffleHog": { "enabled": true },
    "semgrep": { "enabled": true }
  },
  "scan": {
    "target": ".",
    "exclude": ["**/node_modules/**", "**/dist/**"]
  },
  "severity": {
    "failOn": ["CRITICAL", "HIGH"]
  }
}

Sources: configs/default.json:2-45, QUICK_START.md:280-310

Integration Workflow

For automated environments, the scanner can be integrated into GitHub Actions to block pull requests containing critical vulnerabilities.

🔍 Troubleshooting Common Issues

• "Cannot find module": Typically caused by missing build artifacts. Run pnpm build in the root directory.
• Command Not Found: Ensure external tools like trufflehog or semgrep are installed on the system path.
• Performance Issues: Add large directories (e.g., dist, coverage, node_modules) to the exclude list in your configuration.

Sources: QUICK_START.md:360-425, SECURITY_REVIEW.md:110-130

The Quick Start Guide facilitates immediate deployment of the Unified Security Scanner, allowing teams to establish a robust security posture through automated, AI-validated analysis of their codebase.