🛡️ SafetyScan

Automated Security Scanning Tool for Linux

Comprehensive SAST & DAST security testing in one powerful command

Features • Installation • Usage • Documentation • Contributing

📖 About

SafetyScan is a powerful, automated security scanning tool designed exclusively for Linux environments. It combines the best of both worlds by seamlessly integrating Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) to provide comprehensive vulnerability detection for your applications.

⚠️ Linux Only: This tool is built specifically for Linux systems and requires a Linux environment to function properly.

Why SafetyScan?

🔄 Two-in-One Solution: Combine SAST and DAST in a single tool
🐳 Isolated Testing: Docker-based containers ensure clean, reproducible scans
📊 Actionable Reports: Get detailed HTML and JSON reports you can actually use
⚡ Developer-Friendly: Simple CLI interface, complex security analysis
🆓 Open Source: Free, transparent, and community-driven

✨ Features

🔍 Static Analysis (SAST)

Powered by Semgrep
Source code vulnerability detection
Insecure coding pattern identification
Multi-language support
Zero false-positive ruleset

🚀 Dynamic Analysis (DAST)

Powered by OWASP ZAP
Runtime vulnerability testing
Active security scanning
API endpoint testing
Configuration issue detection

🎯 Core Capabilities

✅ Automatic Detection: Identifies project types and dependencies
✅ Flexible Execution: Run SAST, DAST, or both simultaneously
✅ Docker Integration: Containerized scans for security and consistency
✅ Rich Reporting: Multiple report formats (HTML, JSON, TXT)
✅ Easy Setup: Single installation script, global command access
✅ Language Agnostic: Supports Node.js, Python, Java, Go, Ruby, PHP, and more

💻 System Requirements

Minimum Requirements

Component	Requirement
Operating System	Linux (Ubuntu 18.04+, Debian 10+, CentOS 7+, Fedora 30+, Arch Linux)
Architecture	x86_64 (64-bit)
RAM	2 GB minimum, 4 GB recommended
Disk Space	5 GB free space
Docker	Version 20.10+
Shell	Bash 4.0+
Python	Python 3.6+ (optional, for comprehensive reports)

Tested Distributions

✅ Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS
✅ Debian 10 (Buster) / 11 (Bullseye) / 12 (Bookworm)
✅ CentOS 7 / 8 / Stream
✅ Fedora 35+
✅ Arch Linux
✅ Linux Mint 20+

Optional Dependencies

Component	Purpose	Installation
Python 3	Generate comprehensive HTML/MD reports	`sudo apt install python3` (Ubuntu/Debian)
jq	Enhanced JSON parsing in summaries	`sudo apt install jq` (Ubuntu/Debian)

📥 Installation

Step 1: Install Docker

Docker is required for SafetyScan to function. Choose your distribution:

Ubuntu / Debian

# Update package index
sudo apt-get update

# Install prerequisites
sudo apt-get install -y \
    apt-transport-https \
    ca-certificates \
    curl \
    gnupg \
    lsb-release

# Add Docker's official GPG key
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg

# Set up stable repository
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu \
  $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

# Install Docker Engine
sudo apt-get update
sudo apt-get install -y docker-ce docker-ce-cli containerd.io

# Verify installation
sudo docker --version

CentOS / RHEL / Fedora

# Remove old versions (if any)
sudo yum remove docker docker-client docker-client-latest docker-common docker-latest docker-latest-logrotate docker-logrotate docker-engine

# Install required packages
sudo yum install -y yum-utils

# Add Docker repository
sudo yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo

# Install Docker Engine
sudo yum install -y docker-ce docker-ce-cli containerd.io

# Start Docker
sudo systemctl start docker
sudo systemctl enable docker

# Verify installation
sudo docker --version

Arch Linux

# Install Docker
sudo pacman -S docker

# Start and enable Docker service
sudo systemctl start docker.service
sudo systemctl enable docker.service

# Verify installation
sudo docker --version

Post-Installation: Add User to Docker Group

Run Docker commands without sudo:

# Add your user to the docker group
sudo usermod -aG docker $USER

# Apply changes (log out and back in, or run)
newgrp docker

# Verify - this should work without sudo
docker run hello-world

Step 2: Install SafetyScan

# Clone the repository
git clone https://github.com/IsMohit/SafetyScan-Automated-Security-Scanning-Tool-for-Linux-.git

# Navigate to directory
cd SafetyScan-Automated-Security-Scanning-Tool-for-Linux-

# Make install script executable
chmod +x install.sh

# Run installation (may require sudo)
./install.sh

Step 3: Verify Installation

# Check if safetyscan is accessible
safetyscan --help

# Should display usage information

Optional: Install jq for Enhanced JSON Parsing

# Ubuntu/Debian
sudo apt-get install jq

# CentOS/RHEL/Fedora
sudo yum install jq

# Arch Linux
sudo pacman -S jq

🚀 Usage

Basic Syntax

safetyscan <project_path> --mode [sast|dast|both] [OPTIONS]

Command-Line Options

Option	Description	Required	Example
`<project_path>`	Path to your project directory	✅ Yes	`./myapp`
`--mode`	Scan type: `sast`, `dast`, or `both`	✅ Yes	`--mode both`
`--start`	Command to start your application	⚠️ DAST only	`--start "npm start"`
`--port`	Application port number	⚠️ DAST only	`--port 3000`
`-h, --help`	Display help information	❌ No	`-h`

📚 Usage Examples

Example 1: Static Analysis Only

Perfect for code review before runtime testing:

safetyscan ./my-web-app --mode sast

What it does:

Analyzes source code for vulnerabilities
Identifies insecure coding patterns
Generates semgrep.json and semgrep-summary.txt

Example 2: Dynamic Analysis - Node.js Application

Test a running Node.js application:

safetyscan ./my-node-app --mode dast --start "npm install && npm start" --port 3000

What it does:

Installs dependencies and starts your app
Runs OWASP ZAP against http://localhost:3000
Generates HTML and JSON DAST reports

Example 3: Dynamic Analysis - Python Flask Application

Test a Flask web application:

safetyscan ./my-flask-app --mode dast --start "pip install -r requirements.txt && python app.py" --port 5000

Example 4: Dynamic Analysis - Java Spring Boot

Test a Spring Boot application:

safetyscan ./my-spring-app --mode dast --start "mvn spring-boot:run" --port 8080

Example 5: Complete Security Audit (SAST + DAST)

Run both static and dynamic analysis:

safetyscan ./my-application --mode both --start "npm install && npm start" --port 3000

What it does:

✅ Performs static code analysis (SAST)
✅ Starts your application in a container
✅ Runs dynamic security tests (DAST)
✅ Generates comprehensive reports for both

Example 6: React Application with Custom Port

safetyscan ./my-react-app --mode both --start "npm install && npm run start" --port 3001

Example 7: Django Application

safetyscan ./my-django-app --mode both --start "pip install -r requirements.txt && python manage.py runserver 0.0.0.0:8000" --port 8000

📂 Report Structure

After scanning, all reports are saved in a timestamped directory:

<project_root>/
└── reports/
    └── <project_name>_YYYYMMDD_HHMMSS/
        ├── semgrep.json                          # Raw SAST output (machine-readable)
        ├── semgrep-summary.txt                   # SAST findings summary (human-readable)
        ├── zap-report.html                       # Full DAST report (browser-friendly)
        ├── zap-report.json                       # Raw DAST output (machine-readable)
        ├── zap-warnings.html                     # Critical DAST warnings (prioritized)
        ├── scan-summary.txt                      # Overall scan overview
        ├── comprehensive-security-report.html    # 🆕 Comprehensive HTML report
        └── comprehensive-security-report.md      # 🆕 Comprehensive Markdown report

🆕 Comprehensive Security Reports

SafetyScan now generates beautiful, detailed, and organized comprehensive reports that combine both SAST and DAST findings into a single, easy-to-read document!

Features of Comprehensive Reports:

📊 Executive Summary Dashboard - Visual overview of all findings by severity
🎨 Professional Design - Beautiful HTML with gradient headers and color-coded severity badges
📋 Table of Contents - Easy navigation through all findings
🔍 Detailed Findings - Each vulnerability includes:
- Severity level with color coding
- Complete description and context
- File location and line numbers (SAST)
- Affected URLs (DAST)
- CWE/OWASP mappings
- Remediation guidance
- Code snippets (when applicable)
💡 Smart Recommendations - Prioritized action items based on findings
📚 Security Resources - Links to OWASP, CWE, and documentation
🖨️ Print-Friendly - Optimized CSS for PDF export

Report Formats:

HTML Report (comprehensive-security-report.html)
- Open in any browser
- Interactive and visually appealing
- Perfect for sharing with stakeholders
- Can be converted to PDF
Markdown Report (comprehensive-security-report.md)
- Text-based, version control friendly
- Easy to include in documentation
- Compatible with GitHub, GitLab, etc.
- Simple to parse programmatically

Traditional Report Files

File	Format	Purpose	Best For
`semgrep.json`	JSON	Complete SAST findings with metadata	CI/CD integration, automated processing
`semgrep-summary.txt`	Text	Human-readable vulnerability summary	Quick review, documentation
`zap-report.html`	HTML	Comprehensive DAST test results	Detailed analysis, stakeholder reports
`zap-report.json`	JSON	Structured DAST findings	Automation, tracking, dashboards
`zap-warnings.html`	HTML	High-priority vulnerabilities	Immediate action items
`scan-summary.txt`	Text	Combined SAST + DAST overview	Executive summary
`comprehensive-security-report.html`	HTML	🆕 Complete security analysis	Primary report for all stakeholders
`comprehensive-security-report.md`	Markdown	🆕 Text-based full report	Documentation, version control

🔧 Technical Architecture

Report Generation Pipeline

SafetyScan uses a two-stage architecture for comprehensive reporting:

┌─────────────────────────────────────────────────────────┐
│                    Bash Script (safetyscan.sh)          │
│                                                           │
│  ┌──────────────┐        ┌──────────────┐               │
│  │ SAST Scan    │        │ DAST Scan    │               │
│  │ (Semgrep)    │        │ (OWASP ZAP)  │               │
│  └──────┬───────┘        └──────┬───────┘               │
│         │                       │                        │
│         ▼                       ▼                        │
│  ┌────────────────────────────────────┐                 │
│  │  semgrep.json     zap-report.json  │                 │
│  └────────────┬───────────────────────┘                 │
│               │                                          │
│               ▼                                          │
│  ┌────────────────────────────────────┐                 │
│  │  Python Report Generator            │                 │
│  │  (report_generator.py)              │                 │
│  │                                      │                 │
│  │  • Parses JSON outputs               │                 │
│  │  • Categorizes by severity           │                 │
│  │  • Generates statistics              │                 │
│  │  • Creates beautiful HTML            │                 │
│  │  • Exports Markdown                  │                 │
│  └────────────┬───────────────────────┘                 │
│               │                                          │
│               ▼                                          │
│  ┌────────────────────────────────────┐                 │
│  │  Comprehensive Reports              │                 │
│  │  • HTML with CSS styling            │                 │
│  │  • Markdown for documentation       │                 │
│  └────────────────────────────────────┘                 │
└─────────────────────────────────────────────────────────┘

Benefits of this architecture:

✅ Modular design - each component can be updated independently
✅ Language-specific strengths - Bash for orchestration, Python for data processing
✅ Fallback support - Works even if Python is not available
✅ Extensible - Easy to add new report formats or analysis tools

SAST Engine: Semgrep

Technology	Semgrep - Open-source static analysis
Analysis Method	Abstract Syntax Tree (AST) pattern matching
Language Support	30+ languages including JavaScript, TypeScript, Python, Java, Go, Ruby, PHP, C, C++, C#, Rust
Rulesets	OWASP Top 10, CWE, custom security rules
Output	Detailed vulnerability locations with severity ratings

DAST Engine: OWASP ZAP

Technology	OWASP Zed Attack Proxy (ZAP)
Analysis Method	Active web application penetration testing
Test Coverage	SQL Injection, XSS, CSRF, Security Headers, SSL/TLS, Authentication
Scanning Mode	Automated spider + active scanner
Standards	OWASP Top 10, PCI DSS compliance checks

🛠️ Troubleshooting

Common Issues and Solutions

🔴 Docker daemon not running

Error: Cannot connect to the Docker daemon

Solution:

# Start Docker service
sudo systemctl start docker

# Enable Docker to start on boot
sudo systemctl enable docker

# Check Docker status
sudo systemctl status docker

🔴 Permission denied (Docker socket)

Error: Got permission denied while trying to connect to the Docker daemon socket

Solution:

# Add user to docker group
sudo usermod -aG docker $USER

# Apply changes
newgrp docker

# OR log out and back in

# Verify
docker run hello-world

🔴 Port already in use

Error: Port 3000 is already in use

Solution:

# Find process using the port
sudo lsof -i :3000

# OR
sudo netstat -tulpn | grep :3000

# Kill the process (replace PID)
kill -9 <PID>

# OR use a different port
safetyscan ./myapp --mode dast --start "npm start" --port 3001

🔴 Application fails to start in container

Issue: Application startup command doesn't work in Docker

Solution:

Ensure all dependencies are installed in the start command
Use && to chain commands: "npm install && npm start"
Check application logs in the container
Verify the application binds to 0.0.0.0, not just localhost

🔴 Comprehensive reports not generated

Issue: HTML/Markdown comprehensive reports are missing

Symptoms:

⚠ Python 3 not found - skipping comprehensive report generation

Solution:

# Check Python installation
python3 --version

# Install Python 3 if not present
# Ubuntu/Debian
sudo apt install python3

# CentOS/RHEL
sudo yum install python3

# Fedora
sudo dnf install python3

# Verify report generator is installed
which safetyscan-report-generator
ls -la /usr/local/bin/safetyscan-report-generator

# Reinstall if needed
cd SafetyScan-Automated-Security-Scanning-Tool-for-Linux
sudo ./install.sh

Note: Basic reports (JSON, TXT, HTML from ZAP) will still be generated even without Python.

🔴 White text in HTML report

Issue: Text appears white on white background in comprehensive report

Solution: This has been fixed in the latest version. Update your installation:

cd SafetyScan-Automated-Security-Scanning-Tool-for-Linux
git pull origin main
sudo ./install.sh

# Or manually update report generator
sudo cp report_generator.py /usr/local/bin/safetyscan-report-generator
sudo chmod +x /usr/local/bin/safetyscan-report-generator

🔴 HTML tags visible in report

Issue: Seeing <p>, <br> tags in descriptions and solutions

Solution: This has been fixed in the latest version. The report generator now:

Strips HTML tags from OWASP ZAP output
Preserves formatting by converting tags to newlines
Properly escapes content for display

Update to the latest version:

cd SafetyScan-Automated-Security-Scanning-Tool-for-Linux
git pull origin main
sudo ./install.sh

🔴 Command not found: safetyscan

Solution:

# Reinstall with proper permissions
cd SafetyScan-Automated-Security-Scanning-Tool-for-Linux-
sudo ./install.sh

# OR manually copy
sudo cp safetyscan.sh /usr/local/bin/safetyscan
sudo chmod +x /usr/local/bin/safetyscan

🔴 Disk space issues

Solution:

# Clean up Docker
docker system prune -a --volumes

# Check disk usage
df -h

# Remove old scan reports
rm -rf ./reports/*_old

🤝 Contributing

We welcome contributions from the community! Here's how you can help:

How to Contribute

🍴 Fork the repository
🌿 Create a feature branch
```
git checkout -b feature/amazing-feature
```
💻 Commit your changes
```
git commit -m 'Add amazing feature'
```
📤 Push to your branch
```
git push origin feature/amazing-feature
```
🔀 Open a Pull Request

Contribution Guidelines

✅ Follow existing code style and conventions
✅ Write clear, descriptive commit messages
✅ Add comments for complex logic
✅ Test your changes thoroughly on multiple Linux distributions
✅ Update documentation for new features
✅ Ensure all scans pass before submitting PR

Ideas for Contributions

🆕 Add support for additional scanners
🐛 Fix bugs and improve error handling
📖 Improve documentation and examples
🎨 Enhance report formatting
⚡ Performance optimizations
🌐 Add CI/CD integration examples

📄 License

This project is licensed under the MIT License - see the LICENSE file for full details.

MIT License

Copyright (c) 2025 Mohit Khambekar

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software...

🙏 Acknowledgments

SafetyScan is built on the shoulders of giants:

Semgrep - Fast, lightweight static analysis
OWASP ZAP - World's most popular DAST tool
Docker - Containerization platform
Linux Community - For the amazing ecosystem

👨‍💻 Author

Mohit Khambekar

📞 Support & Contact

Need help? Have questions? Found a bug?

🐛 Bug Reports: Open an Issue
💡 Feature Requests: Suggest a Feature
💬 Discussions: GitHub Discussions
📧 Direct Contact: Reach out via GitHub

⭐ Show Your Support

If SafetyScan helps secure your applications, please consider:

⭐ Starring this repository
🐛 Reporting bugs or issues
💡 Suggesting new features
📢 Sharing with your team and network
🤝 Contributing to the codebase

📊 Project Stats

Made with ❤️ for the Linux Community

Secure Code. Secure Future.

⬆ Back to Top

Name		Name	Last commit message	Last commit date
Latest commit History 5 Commits
README.md		README.md
install.sh		install.sh
report_generator.py		report_generator.py
safetyscan.sh		safetyscan.sh

Folders and files

Latest commit

History

Repository files navigation

🛡️ SafetyScan

Automated Security Scanning Tool for Linux

📖 About

Why SafetyScan?

✨ Features

🔍 Static Analysis (SAST)

🚀 Dynamic Analysis (DAST)

🎯 Core Capabilities

💻 System Requirements

Minimum Requirements

Tested Distributions

Optional Dependencies

📥 Installation

Step 1: Install Docker

Post-Installation: Add User to Docker Group

Step 2: Install SafetyScan

Step 3: Verify Installation

Optional: Install jq for Enhanced JSON Parsing

🚀 Usage

Basic Syntax

Command-Line Options

📚 Usage Examples

Example 1: Static Analysis Only

Example 2: Dynamic Analysis - Node.js Application

Example 3: Dynamic Analysis - Python Flask Application

Example 4: Dynamic Analysis - Java Spring Boot

Example 5: Complete Security Audit (SAST + DAST)

Example 6: React Application with Custom Port

Example 7: Django Application

📂 Report Structure

🆕 Comprehensive Security Reports

Features of Comprehensive Reports:

Report Formats:

Traditional Report Files

🔧 Technical Architecture

Report Generation Pipeline

SAST Engine: Semgrep

DAST Engine: OWASP ZAP

🛠️ Troubleshooting

Common Issues and Solutions

🤝 Contributing

How to Contribute

Contribution Guidelines

Ideas for Contributions

📄 License

🙏 Acknowledgments

👨‍💻 Author

📞 Support & Contact

⭐ Show Your Support

📊 Project Stats

About

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages