Open Source • GPL-3.0 • Python 3.9+

Static Security Analysis Built for Real Codebases

Secara is a CLI-based static code security scanner focused on high-signal findings. It combines AST analysis, taint tracking, and rule-driven detection to catch exploitable issues without sending your code to external services.

Get Started View Repository

pip install secara

$ secara scan ./src --severity HIGH
[HIGH] SQL001  SQLi via dynamic query in app.py:45
[HIGH] CMD001  Unsafe os.system input in tasks.py:19
[MEDIUM] SEC014 High-entropy token candidate in config.js:11
✅ Scan complete: 3 findings | 1,294 files | 2.4s

35+ secret patterns

Tier 1 Python, JS, TS

SARIF CI-ready output

Offline no code upload

Core Capabilities

Designed for Security Teams and Contributors

High-Signal Vulnerability Detection

Detects SQL injection, command injection, SSRF, insecure deserialization, path traversal, weak crypto patterns, and exposed credentials.

Hybrid Analysis Engine

Combines AST analysis, regex matching, and Python interprocedural taint tracking to reduce noise while preserving coverage.

Built for CLI and CI

Runs locally via CLI and exports machine-readable JSON or SARIF output for automated checks in CI pipelines.

Offline by Default

No telemetry or code upload for core scanning. Your source stays on your machine and inside your environment.

Language Support

Multi-Language Coverage Model

Tiered analyzers balance depth and speed across modern application stacks.

Tier 1

Python, JavaScript, TypeScript

AST-focused analysis and taint-aware detections

Tier 2

Java, Kotlin, PHP, Ruby, Go, Bash, JSON, YAML, .env

Rule and regex hybrid detections for broad practical coverage

Rule ID	Category	Example Detection	Severity
SEC001	Hardcoded Secrets	AWS Access Key ID	HIGH
SQL001	SQL Injection	Dynamic SQL string in Python	HIGH
CMD001	Command Injection	os.system with dynamic input	HIGH
CRY001	Crypto Failures	Weak hash algorithms	HIGH
SSRF001	SSRF	User-controlled requests.get URL	HIGH
DSER001	Deserialization	Unsafe pickle.loads usage	HIGH

How It Works

Scanner Pipeline

CLI Entry

secara/cli.py parses options and starts scans for files or directories.

File Scanner + Cache

secara/scanner/file_scanner.py walks source trees and skips unchanged files via SHA-256 cache.

Language Engine

secara/scanner/language_engine.py dispatches language-specific detectors.

Detectors + Output

Detectors generate findings that can be rendered to terminal, JSON, or SARIF for integrations.

Quick Start

Install, Scan, Integrate

Install

pip install secara
pip install --upgrade secara

Run a Scan

secara scan .
secara scan . --severity HIGH
secara scan ./src --verbose

CI Output

secara scan . --json > results.json
secara scan . --sarif --output secara-results.sarif

Versioning

Releases and Changelog

Latest Stable Line

Current stable release is 0.10.0. Install directly from PyPI and use GitHub Releases for tag-level notes.

View on PyPI

GitHub Releases

Use GitHub Releases for packaged tags, release notes, and migration details.

View Releases

Track All Versions

Browse complete tag history to audit version progression and map rule additions over time.

Browse Tags

Project Change Log

Follow feature updates, detector improvements, and bug fixes in the canonical changelog location.

Open Changelog

Project Health

Open-Source Collaboration Ready

Secara includes clear contribution and security-reporting workflows to support community-driven development.

Contributing

Add detectors, reduce false positives, improve performance, or enhance documentation. Test-driven contributions are encouraged.

Read CONTRIBUTING.md

Security Policy

Vulnerabilities in Secara itself should be reported via private advisory, not public issues.

Report Security Issue

License

Distributed under GNU GPLv3 for transparent, auditable security tooling.

View License