Self-hosted code security scanning. Install on your own Linux server, connect your Git
repositories, get one merged, de-duplicated security report from many open-source scanners.
🇹🇷 Türkçe kurulum kılavuzu ·
🇬🇧 Installation guide
Project status: Phase 4 of 8. Working today: connect a GitHub/GitLab/Gitea/Bitbucket repository with a read-only deploy key, press Scan now or let push webhooks start scans; the server clones and scans in throw-away sandboxed containers and shows results, new/fixed issues, triage and HTML/JSON/SARIF/SBOM reports, with Slack/Teams/e-mail notifications. Plus setup wizard, accounts + 2FA, organizations, roles, API tokens and audit log (Turkish / English UI). Follow progress in
TASKS.mdand the roadmap below.
git clone https://github.com/ininia/scanx.git
./scanx/scripts/scan.sh /path/to/your/repoYour code is mounted read-only into a throw-away container with no network; nothing
leaves your machine. Reports land in ./scanx-results/ (scanx.html, scanx.json,
scanx.sarif, sbom.cdx.json). Exit code: 0 passed, 1 quality gate failed (default: any
high or critical finding), 2 scan error, 3 bad options. See an
example report of the bundled vulnerable fixture.
Scanners in this release (all open source, all run offline in a network-less container):
| Tool | Looks at |
|---|---|
| Opengrep | source code (SAST), 776 open-licensed rules incl. scanX's own PHP taint rules; only rules for the repository's languages are loaded |
| DevSkim (Microsoft) | security patterns in many languages incl. C# |
| Bandit | Python security |
| gosec | Go security (only for Go repositories) |
| Psalm (taint analysis) | PHP: user input reaching SQL, shell, include, echo, unserialize (only for PHP repositories) |
| Ruff | Python code quality (only for Python repositories) |
| Gitleaks | leaked secrets in the working tree and git history |
| Trivy | vulnerable dependencies, IaC misconfiguration, secrets, licenses |
| OSV-Scanner | vulnerable dependencies (second opinion, Google OSV) |
| Checkov | infrastructure as code: Dockerfile, Kubernetes, Terraform, Helm, Bicep, CI pipelines |
| zizmor | GitHub Actions workflow security (injection, secret exposure, dangerous triggers) |
| actionlint | GitHub Actions workflow mistakes (syntax, expressions, action inputs) |
| kube-linter | Kubernetes manifests and Helm charts |
| Spectral | OpenAPI/Swagger documents against the OWASP API Security Top 10 |
| Hadolint | Dockerfile best practice and security |
| ShellCheck | shell script bugs |
| Lizard | code complexity (code-quality score, not part of the security grade) |
| Syft | SBOM (CycloneDX) |
Each tool runs only when the repository contains what it checks (its language, workflows, manifests or API documents). Findings from different tools are merged into one issue. Pushes are scanned incrementally (only the files the push changed); "Scan now" runs a full scan.
Connect PostgreSQL, MySQL/MariaDB or SQL Server with a read-only account and scanX checks the
structure: language and style of names, singular/plural, reserved words, the same concept named
differently (CreatedAt / CreatedDate), type mismatches, missing primary keys and foreign-key
indexes, redundant indexes, money in floating point, dates stored as text, identity overflow,
plaintext-looking password columns, privileges granted to PUBLIC and more (30 rules).
- The account is verified as soon as it is saved and again before every scan; an account that can write is rejected and its password deleted. Only catalog metadata is read, never table data, from a throw-away sandbox container that cannot reach scanX's own services.
- Defaults are best practice; every rule and option can be changed per organization (for example Turkish names or a fixed name for audit columns).
- Scores per category, quality gate, new/fixed findings, CSV/JSON export, hourly/daily/weekly schedules and the same notification channels as repository scans.
The instance admin decides per organization which modules (repository scanning, database scanning) are available, with limits and switches for schedules and notifications.
- 🔒 Your code never leaves your server. Each scan clones the repository into an isolated, network-less, throw-away container, scans it, then deletes the code. Only reports are kept.
- 🧰 Many scanners, one report. Opengrep/Semgrep, Gitleaks, Trivy, OSV-Scanner, Syft (SBOM), gosec, Bandit, Psalm, Checkov, Hadolint, ShellCheck and more — results are normalized, de-duplicated and prioritized.
- 🔗 Connect GitHub / GitLab / Gitea / Bitbucket with a read-only deploy key; scans run on push (only for the branches you choose), on a schedule, or from CI (GitHub Actions, GitLab CI).
- 🏢 Multi-tenant: organizations, roles, 2FA, audit log. One team never sees another's repos.
- 📊 New / fixed / existing findings between scans, quality gates that fail CI, SARIF, PDF, SBOM.
You need a Linux server with Docker and Docker Compose v2 (at least 4 GB RAM for scanning;
4 vCPU / 8 GB RAM / 100 GB disk recommended) and git.
git clone https://github.com/ininia/scanx.git
cd scanx
./deploy/quickstart.sh --domain scan.yourcompany.comThe script builds scanX, generates all passwords and keys, creates a TLS certificate and starts
everything. When it finishes it prints the address and a one-time setup token: open the address,
enter the token and the setup wizard walks you through the administrator account (with
mandatory 2FA), instance settings and your first organization.
Then add a project, add the shown deploy key and webhook in GitHub — the guide walks through it.
Back up deploy/.env immediately — see the installation guide for
firewall, real TLS certificates, updates, backups and troubleshooting.
| Phase | Content | Status |
|---|---|---|
| 0 | Foundation: server, DB, TLS proxy, installer skeleton, CI | ✅ done |
| 1 | Scan engine + scanx scan CLI (Gitleaks, Opengrep, Trivy, OSV, Syft) |
✅ done |
| 2 | Accounts, organizations, 2FA, web UI, setup wizard | ✅ done |
| 3 | Isolated sandbox, Git + deploy keys, manual scans, report pages | ✅ done |
| 4 | Webhooks (GitHub/GitLab/Gitea/Bitbucket), notifications (schedules: next) | ✅ done |
| 5 | GitHub Action, GitLab CI template, SARIF upload, scheduled scans | ⏳ next |
| 6 | One-line install.sh, Let's Encrypt, backup/restore/update |
|
| 7 | More scanners, PDF reports, trends, SonarQube, ZAP | |
| 8 | Hardening, docs, v1.0.0 |
scanX is source-available under the Business Source License 1.1 (Licensor: İninia Teknoloji Limited Şirketi).
- ✅ Free to use, including inside your company to scan your own code.
- ✅ Free to modify; contributions back to this repository are welcome.
- ❌ Selling scanX or a derivative, or offering it as a paid hosted/SaaS or paid scanning service, requires a commercial license from İninia Teknoloji Limited Şirketi.
- 🔓 Each version automatically becomes AGPL-3.0-or-later four years after release (current Change Date: 2030-10-06).
Third-party scanners keep their own licenses.
- Development needs only Docker:
scripts/dev.sh test | lint | test-integration. See CONTRIBUTING.md (a CLA is required). - Found a vulnerability? Please report it privately — see SECURITY.md.
- Architecture decisions:
docs/adr/· Threat model:docs/security/threat-model.md