A comprehensive command-line tool to check security-related issues in your projects, including vulnerability scanning and license compliance checking.
- Vulnerability Scanning: Check for known security vulnerabilities in your project dependencies
- License Compliance: Verify and analyze license compatibility of your dependencies
- Multi-Package Manager Support: Works with Poetry, npm, pnpm, pip (requirements.txt), and Rye
- Multiple Output Formats: Support for stdout, Slack notifications, and Markdown reports
- Extensible Architecture: Easy to add new package managers and notification methods
pip install security-checkerSecurity Checker provides two main commands: license for license checking and vuln for vulnerability scanning.
Check license compliance of your project dependencies:
# With default settings (all supported package managers)
security-checker license /path/to/your/projectScan for security vulnerabilities in your dependencies:
# With default settings (all supported package managers)
security-checker vuln /path/to/your/projectTo use Slack notifications, set the following environment variables:
export SLACK_BOT_TOKEN="xoxb-your-bot-token"
export SLACK_CHANNEL="#your-channel" export LLM_API_KEY="your-openai-api-key"
export LLM_SUMMARIZE_MODEL="o4-mini"
export LLM_ENDPOINT="https://api.openai.com/v1"- Python >= 3.10
- Rye
git clone https://github.com/Ja-sonYun/security-checker.git
cd security-checker
rye syncThis project uses:
- Ruff: For linting and code formatting
- Type hints: Full type annotation coverage
Run code quality checks:
ruff check .
ruff format .src/security_checker/
├── checkers/ # Core checking logic
│ ├── credentials/ # Credential scanning (TODO)
│ ├── licenses/ # License compliance checking
│ └── vulnerabilities/ # Vulnerability scanning
├── notifiers/ # Output and notification handlers
├── vendors/ # Package manager integrations
├── utils/ # Utility functions
└── cli.py # Command-line interface
- Create a new vendor class in
src/security_checker/vendors/ - Implement the required traits for license and/or vulnerability checking
- Add the vendor to the supported vendors list in
cli.py
- Create a new notifier class in
src/security_checker/notifiers/ - Extend the
NotifierBaseclass - Add the notifier to the supported notifiers list in
cli.py
- Implement credential scanning
- Support result caching to avoid redundant checks
- Add unit tests for all components