Supported Security Tools

Relevant source files

The following files were used as context for generating this wiki page:

• README.md
• api/securitytest/bandit.go
• api/securitytest/brakeman.go
• api/securitytest/gitleaks.go
• api/securitytest/gosec.go
• api/securitytest/npmaudit.go
• api/securitytest/safety.go
• api/securitytest/securitycodescan.go
• api/securitytest/securitytest.go
• api/securitytest/spotbugs.go
• api/securitytest/tfsec.go
• api/securitytest/yarnaudit.go
• api/util/api/api.go
• cli/analysis/analysis.go
• client/analysis/output.go
• client/types/types.go

huskyCI is an open-source tool that orchestrates various static security analysis tools and centralizes their results. It integrates into CI/CD pipelines to automatically scan for vulnerabilities in source code and dependencies. The system is designed to run different security tools based on the languages detected in a given repository, executing them in isolated container environments.

The core of huskyCI's functionality lies in its ability to manage, execute, and parse the output of a suite of security scanners. Each tool is configured as a SecurityTest and is associated with a specific language or purpose. This allows for a flexible and extensible security analysis framework.

Sources: README.md, api/securitytest/securitytest.go

Analysis Flow

Each security test follows a standardized lifecycle managed by the huskyCI API. The process is initiated for each relevant security tool, executed in a container, and the results are then analyzed and stored.

Sources: api/securitytest/securitytest.go:73-95

The diagram below illustrates the general flow for a single security test scan.

Sources: api/securitytest/securitytest.go:73-125

Key Components

• SecTestScanInfo: A struct that holds all information for a single security test run, including the repository URL, branch, and the container details.
• securityTestAnalyze map: A map that routes a scan to the correct analysis function based on the security tool's name (e.g., "bandit" maps to analyzeBandit).
• dockerRun/kubeRun: Functions responsible for executing the security tool's command inside a Docker or Kubernetes container.
• analyze(): A generic function that calls the appropriate tool-specific analyzer (e.g., analyzeBandit, analyzeGosec) to parse the container's output.
• prepare<ToolName>Vulns(): A set of functions, one for each tool, responsible for translating the tool's native output into the standardized HuskyCIVulnerability format.
• prepareContainerAfterScan(): Finalizes the container status (passed, failed, error) based on the analysis results.

Sources: api/securitytest/securitytest.go:17-69, 127-141

Core Data Structures

huskyCI uses a set of standardized data structures to manage analysis results from different tools. This ensures consistency in how vulnerabilities are stored, processed, and displayed.

The diagram below shows the relationship between the main data structures.

Sources: client/types/types.go:30-143

Summary of Supported Tools

huskyCI supports a range of security tools for different programming languages and purposes. The system automatically detects the languages in a project and runs the corresponding scanners.

Language / Type	Tool Name	Docker Image	Default
Go	gosec	huskyci/gosec	Yes
Python	bandit	huskyci/bandit	Yes
Python	safety	huskyci/safety	Yes
Ruby	brakeman	huskyci/brakeman	Yes
JavaScript	npmaudit	huskyci/npmaudit	Yes
JavaScript	yarnaudit	huskyci/yarnaudit	Yes
Java	spotbugs	huskyci/spotbugs	Yes
HCL	tfsec	huskyci/tfsec	Yes
C#	securitycodescan	huskyci/securitycodescan	Yes
Generic	gitleaks	huskyci/gitleaks	Yes
Generic	enry	-	Yes
Generic	gitauthors	huskyci/gitauthors	Yes

Sources: cli/analysis/analysis.go:138-163, api/util/api/api.go:142-144

Language & Generic Scanners

Go

Gosec

gosec is a Go AST scanner that inspects source code for security problems.

• Output Parsing: The JSON output from the gosec container is unmarshalled into a GosecOutput struct, which contains a slice of GosecIssue.
• Vulnerability Mapping: Each GosecIssue is converted into a HuskyCIVulnerability. The Severity field from the issue (LOW, MEDIUM, HIGH) is used to categorize the vulnerability.

Sources: api/securitytest/gosec.go:29-86

Python

Bandit

bandit is a tool designed to find common security issues in Python code.

• Output Parsing: The JSON output is parsed into a BanditOutput struct.
• Vulnerability Mapping: Each result is processed by prepareBanditVulns. Vulnerabilities are categorized based on issue_severity and issue_confidence. Comments containing #nohusky are treated as ignored vulnerabilities and are stored in the NoSecVulns slice.

Sources: api/securitytest/bandit.go:35-96

Safety

safety checks Python dependencies for known security vulnerabilities.

• Output Parsing: The tool checks for the presence of requirements.txt. If not found, a low-severity warning is generated. If found, the JSON output is parsed into a SafetyOutput struct.
• Vulnerability Mapping: Each issue found is considered high severity and converted into a HuskyCIVulnerability.

Sources: api/securitytest/safety.go:35-131

Ruby

Brakeman

brakeman is a static analysis security vulnerability scanner for Ruby on Rails applications.

• Output Parsing: The JSON output is unmarshalled into a BrakemanOutput struct, which contains slices for Warnings and IgnoredWarnings.
• Vulnerability Mapping: Each WarningItem is converted to a HuskyCIVulnerability. The Confidence level (High, Medium, Low) is used to categorize the finding. Ignored warnings are placed in the NoSecVulns slice.

Sources: api/securitytest/brakeman.go:31-97

JavaScript

Npm Audit

npmaudit scans a project's dependencies for known vulnerabilities using the npm audit command.

• Output Parsing: The system checks for package-lock.json. If not found, a warning is generated. The JSON output from npm audit is parsed into an NpmauditOutput struct.
• Vulnerability Mapping: Each advisory is processed, and its severity (low, moderate, high, critical) is mapped to the corresponding HuskyCIVulnerability category.

Sources: api/securitytest/npmaudit.go:36-100

Yarn Audit

yarnaudit performs a vulnerability scan on dependencies using the yarn audit command.

• Output Parsing: The system checks for yarn.lock. If not found, a warning is generated. The JSON output is parsed into a YarnAuditOutput struct.
• Vulnerability Mapping: Similar to npmaudit, each advisory's severity is used to classify the vulnerability.

Sources: api/securitytest/yarnaudit.go:36-102

HCL (Terraform)

TFSec

tfsec is a static analysis security scanner for Terraform code.

• Output Parsing: The JSON output is unmarshalled into a TFSecOutput struct.
• Vulnerability Mapping: Each TFSecResult is converted into a HuskyCIVulnerability. The severity from the result (LOW, MEDIUM, HIGH) is used directly.

Sources: api/securitytest/tfsec.go:31-80

Java

SpotBugs

spotbugs (with the Find Security Bugs plugin) is a static analysis tool that looks for bugs in Java code.

• Output Parsing: The XML output is parsed into a SpotBugsOutput struct.
• Vulnerability Mapping: Each BugInstance is processed. The priority attribute is mapped to a severity level: 1 -> High, 2 -> Medium, 3 -> Low.

Sources: api/securitytest/spotbugs.go:35-95

C#

Security Code Scan

securitycodescan is a vulnerability scanner for .NET projects.

• Output Parsing: The tool checks for a .sln file. If not found or if the tool fails, a low-severity warning is generated. The SARIF JSON output is parsed into a SecurityCodeScanOutput struct.
• Vulnerability Mapping: Each SecurityCodeScanResult is processed. The level field is mapped to a severity: error -> High, warning -> Medium, recommendation -> Low.

Sources: api/securitytest/securitycodescan.go:48-138

Generic

Gitleaks

gitleaks is a tool for detecting hardcoded secrets like passwords, API keys, and tokens in git repositories.

• Output Parsing: The JSON output is an array of GitLeaksIssue structs.
• Vulnerability Mapping: Each issue is processed. Issues in vendor/ or node_modules/ are skipped. Severity is determined based on the Rule name (e.g., "RSA" private key is HIGH, "AWS Secret Key" is MEDIUM).

Sources: api/securitytest/gitleaks.go:40-128

Result Aggregation and Output

After all security tests are complete, the huskyCI client aggregates the results from each tool to provide a consolidated summary.

The diagram below shows how the client processes the final analysis data to generate a summary.

Sources: client/analysis/output.go:94-301

The prepareAllSummary function populates a Summary struct by counting the number of high, medium, low, and "nosec" vulnerabilities for each security tool. It then calculates a grand total. The printAllSummary function iterates through these summaries and prints a formatted, human-readable report to the standard output, followed by the detailed findings of each vulnerability.

Sources: client/analysis/output.go:94-301, client/types/types.go:145-171