Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/tcosolutions/betterscan
Code Scanning/SAST/Static Analysis/Linting using many tools/Scanners with One Report (Code, IaC) - Betterscan
https://github.com/tcosolutions/betterscan
code-quality code-quality-analyzer compliance devops devops-tools devsecops gdpr owasp sast security-audit security-automation security-orchestration security-scanner security-tools sonarqube static-analysis static-analyzers static-code-analysis vulnerability vulnerability-scanner
Last synced: about 2 months ago
JSON representation
Code Scanning/SAST/Static Analysis/Linting using many tools/Scanners with One Report (Code, IaC) - Betterscan
- Host: GitHub
- URL: https://github.com/tcosolutions/betterscan
- Owner: tcosolutions
- License: agpl-3.0
- Created: 2022-01-31T14:28:29.000Z (almost 3 years ago)
- Default Branch: main
- Last Pushed: 2024-07-16T13:39:49.000Z (5 months ago)
- Last Synced: 2024-07-16T18:04:20.138Z (5 months ago)
- Topics: code-quality, code-quality-analyzer, compliance, devops, devops-tools, devsecops, gdpr, owasp, sast, security-audit, security-automation, security-orchestration, security-scanner, security-tools, sonarqube, static-analysis, static-analyzers, static-code-analysis, vulnerability, vulnerability-scanner
- Language: Python
- Homepage: https://betterscan.io
- Size: 12.1 MB
- Stars: 764
- Watchers: 18
- Forks: 89
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
- Code of conduct: CODE_OF_CONDUCT.md
Awesome Lists containing this project
- awesome-hacking-lists - tcosolutions/betterscan - Code Scanning/SAST/Static Analysis/Linting using many tools/Scanners with One Report (Code, IaC) - Betterscan (Python)
- awesome-repositories - tcosolutions/betterscan - Code Scanning/SAST/Static Analysis/Linting using many tools/Scanners with One Report (Code, IaC) - Betterscan (Python)
- awesome-security - Scanmycode CE (Community Edition) - Code Scanning/SAST/Static Analysis/Linting using many tools/Scanners with One Report. Currently supports: PHP, Java, Scala, Python, Ruby, Javascript, GO, Secret Scanning, Dependency Confusion, Trojan Source, Open Source and Proprietary Checks (total ca. 1000 checks) (Web / Scanning / Pentesting)
README
.svg)
Open DevSecOps Orchestration Toolchain
## License
Released under [AGPL-3.0](/LICENSE) by [@tcosolutions](https://github.com/tcosolutions).
Scan your source code and infra IaC against top **security** risks
Betterscan is a orchestration toolchain that uses state of the art tools to scan your source code and infrastructure IaC and analyzes your security and compliance risks.
Currently supports: **Java**, **Python**, **PERL**, **Ruby**, **C**, **C++**, **Javascript**, **Typescript**, **GO**, Infrastructure as a Code (IaC) Security and Best Practices (**Docker**, **Kubernetes (k8s)**, **Terraform AWS, GCP, Azure**), Secret Scanning, Trojan Source,
Open Source and Proprietary Checks
Checks for misconfigurations across all major (and some minor) cloud providers (AWS Checks, Azure Checks, GCP Checks, CloudStack Checks, DigitalOcean Checks, GitHub Checks, Kubernetes Checks, OpenStack Checks, Oracle Checks)
## Open and Developer friendly DevSecOps toolchain
Betterscan uses many tools for Code, Cloud, secrets. All the best Tools, researched, setup, ran together, unifed and de-duplicated results, **so you don't have to do it**. Added our own checkers also. Continuous Security. Fit for purpose and results.
More info in **[Wiki](https://github.com/tcosolutions/betterscan/wiki)**
## License Information
## Debian Base Image
Docker images includes software from the Debian GNU/Linux distribution. Debian is made available under various open-source licenses. See below for details:
The full text of the licenses for software included in Debian can be found in /usr/share/common-licenses/ within the Debian system.
## Additional Software Licenses
Docker images includes software licensed under various licenses. The full license texts can be found in the image at `/srv/betterscan/LICENSE`.
If you want to scan your Code and Infrastructure (including Secrets, SBOMs, and dependencies)
Below setup is for Linux (Ubuntu), you can also run it on MacOS/Docker and Windows via WSL/Docker.
# Quickstart
## **2 options** are available:
### 1. Binary runtime
#### CLI output
Run in command prompt in your Git repository folder:
`sh <(curl https://raw.githubusercontent.com/tcosolutions/betterscan/main/cli.sh)`
### HTML, JSON, SARIF output
The result will be in the current directory in "report.html", "report.json" and "report.sarif" file
Run in command prompt in your Git repository folder:
`sh <(curl https://raw.githubusercontent.com/tcosolutions/betterscan/main/cli-html.sh)`
### 2. Platform with Webinterface and workers
#### Docker
If you need CI/CD and Web Interface, you need Docker-Compose installed as well, if you don't already have it.
Run in command prompt:
```
git clone [email protected]:tcosolutions/betterscan.git
cd betterscan/dockerhub
docker compose up
```
#### Kubernetest / Minikube
Installable via helm chart.
Helm Chart for Betterscan.io DevSecOps Toolchain platform
Please install under name betterscan
```
helm repo add betterscan-repo https://marcinguy.github.io/betterscan-chart
helm repo update
helm install betterscan betterscan-repo/betterscan
```
Open up the Browser to:
`http://localhost:5000`
Sign up locally (and login in when needed)
That's it.
Read more in the **[Wiki](https://github.com/tcosolutions/betterscan/wiki)**