isitsecure AI-powered security scanner for modern web apps. SAST + DAST + LLM code review in a single scan. Built for developers and vibe coders shipping web apps who need to know if their code is secure — without becoming security experts. Supports: TypeScript/JavaScript (Next.js, Express, tRPC), Python (Django, FastAPI, Flask), Java/Kotlin (Spring Boot) — and any HTTP API for DAST. Demo isitsecure scan --repo ./your-app — every scanner narrates as it runs, then you get a graded report (and a browseable HTML page) with the fixes. Contents Demo · What It Does Install · Quick Start · What It Costs Scan Modes · Scan Depth What It Scans — DAST · Special DAST · SAST · LLM · Cross-Referencing Language Support · Output Formats Auto-Fix · Security Badge How We Compare · What It Does NOT Cover Configuration — API Keys · OOB Callbacks · Authenticated Scanning CLI Reference · Web UI · MCP (AI coding tools) · Try It on the Test App Benchmarks · Privacy · Architecture Scanner Documentation · LSP Setup Contributing · License · Acknowledgements What It Does isitsecure runs 40 rule-based scanners by default — up to 44 with --depth deep — (plus optional AI code review) against your web app in a single command. It combines four approaches that commercial tools sell separately: SAST (Static Analysis) — scans your source code for vulnerabilities without running it DAST (Dynamic Analysis) — tests your live app by sending real HTTP requests LLM Code Review — uses AI to find business logic flaws that pattern matchers can't detect AI Fix Generation — generates code patches with unified diffs for every finding The unique parts: SAST findings automatically generate targeted DAST tests. Code shows no auth check → scanner sends an unauthenticated request and confirms it's exploitable. AI generates fixes, not just reports. --output fixes produces a Markdown fix plan you can paste into Cursor or Claude Code. Code → SAST → Findings → Guide DAST → Test → Cross-Reference → LLM Triage → Report → Fixes ↑ | └──────────────── LSP validates / suppresses false positives ───────────────────────────┘ Install Requirements: Python 3.11+ and git. (isitsecure isn't on PyPI — the isitsecure name there is an unrelated project, so don't pip install it.) Quick install (recommended) The installer verifies Python/git, then clones the repo, sets up an isolated environment, installs everything, and runs first-time setup: # macOS / Linux — download it, glance at it, run it curl -fsSLo install.sh https://raw.githubusercontent.com/jaurakunal/isitsecure/main/install.sh bash install.sh # Windows (PowerShell) irm https://raw.githubusercontent.com/jaurakunal/isitsecure/main/install.ps1 -OutFile install.ps1 ./install.ps1 If Python or git are missing, the installer tells you the exact command to install them for your OS and stops cleanly — it never leaves a half-finished state. Manual install Prefer to do it by hand: # 1. Clone the repo git clone https://github.com/jaurakunal/isitsecure.git cd isitsecure # 2. Install into a virtual environment (recommended) python3 -m venv .venv source .venv/bin/activate # Windows: .venv\Scripts\activate # 3. Install with all features (browser DAST, LLM review, OOB detection) pip install -e ".[all]" # 4. First-time setup — installs the Chromium browser, language servers, optionally saves an API key isitsecure setup pip install -e ".[all]" is the recommended install and enables every scanner. If you want a lighter footprint, the extras are opt-in: Install What works pip install -e . SAST / code-only scans only (--mode code-only) pip install -e ".[browser]" Adds DAST / live-URL scanning (requires isitsecure setup to install Chromium) pip install -e ".[llm]" Adds LLM code review, triage, and AI fixes (requires an API key) pip install -e ".[all]" Everything URL/DAST scanning needs the [browser] extra — without it, isitsecure scan <url> exits with a message telling you to install it. Quick Start # Scan a live URL (DAST only, no API key needed) isitsecure scan https://your-app.com --llm none # Scan source code (SAST only) isitsecure scan --repo https://github.com/you/your-app --mode code-only --llm none # Full scan (SAST + DAST + LLM review) isitsecure scan https://your-app.com --repo https://github.com/you/your-app --mode full # One command: scan + fix everything (the magic) isitsecure fix --repo ./your-app # Or dry-run first to preview fixes isitsecure fix --repo ./your-app --dry-run # Generate a security badge for your README isitsecure badge --repo ./your-app # Export for GitHub Code Scanning isitsecure scan --repo https://github.com/you/your-app --output sarif # Open the web UI (for non-CLI users) isitsecure launch What It Costs isitsecure is free and open source. The only cost is LLM API tokens for the AI-powered features: Scan Mode API Key Needed Estimated Cost URL-only (DAST without LLM) No $0 Code-only (SAST without LLM) No $0 Code-only + LLM review Yes ~$5–8 Full scan (SAST + DAST + LLM) Yes ~$10–15 Without an API key, you still get all rule-based scanners — 40 in the default quick depth (15 DAST + 8 special DAST + 17 SAST), or 44 with --depth deep (which adds 4 slower/aggressive DAST scanners). The LLM adds business logic review, semantic rule verification, and intelligent triage — things no pattern matcher can do. Supported LLM providers: Anthropic (Claude), Google (Gemini) Scan Modes Mode What It Does Requires url-only DAST scanners against a live URL Target URL code-only SAST scanners against source code GitHub repo URL authenticated DAST with login credentials (IDOR, cross-user BOLA, RLS, privilege escalation) URL + credentials (add a second account for cross-user tests) full Everything: SAST + DAST + authenticated + LLM review + cross-referencing URL + repo + credentials + API key auto (default) Detects mode from what you provide Whatever you give it Scan Depth Orthogonal to mode, --depth trades speed for coverage: Depth What runs When to use quick (default) Structural + config checks, error-based injection, and the snapshot-based scanners (headers, CORS, RLS, source-map, SRI, client-exposure, redirects…). Fast. Everyday scans — a solid first pass in a fraction of the time. deep Everything in quick plus the slow/aggressive probes: time-based (blind) SQL injection, active XSS, auth-bypass timing, rate-limit bursts, and password-reset flows. When you want the full arsenal and can wait. # Fast pass (default) isitsecure scan https://your-app.com --llm none # Full, aggressive DAST isitsecure scan https://your-app.com --depth deep --llm none The scan narrates each phase and every scanner as it runs (with elapsed time), so a longer deep scan shows continuous progress rather than appearing to hang. What It Scans DAST Scanners — Tests Your Live App 19 total — 15 run in the default quick depth; the 4 marked ◆ (slower/aggressive probes) are added by --depth deep.
