Enterprise Security Scanning Tool - Cross-platform security orchestrator for SAST, SCA, and secret detection.
- Single Binary - No dependencies, ~7.5MB for Linux/macOS/Windows
- Multiple Scanners - Semgrep (SAST), Trivy (SCA), TruffleHog (Secrets), SpotBugs (Java)
- Quality Gates - Configurable thresholds with pass/fail for CI/CD
- Report Formats - JSON, HTML (Chart.js), PDF, SARIF (GitHub/Forgejo)
# Linux
curl -sL https://github.com/krisk248/secureforge/releases/latest/download/secureforge-linux-amd64 -o secureforge
chmod +x secureforge && sudo mv secureforge /usr/local/bin/
# macOS
curl -sL https://github.com/krisk248/secureforge/releases/latest/download/secureforge-darwin-amd64 -o secureforge
chmod +x secureforge && sudo mv secureforge /usr/local/bin/
# Docker
docker pull ghcr.io/krisk248/secureforge:latest# Install required scanners
pip install semgrep
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
# Check tools
secureforge tools check
# Initialize config
secureforge init
# Run scan
secureforge scan📖 Quick Start Guide - Complete step-by-step setup guide
# GitHub Actions / Forgejo
- name: Security Scan
run: |
curl -sL https://github.com/krisk248/secureforge/releases/latest/download/secureforge-linux-amd64 -o secureforge
chmod +x secureforge
./secureforge scan -f sarif -o ./reports
- uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: ./reports/secureforge.sarif| Code | Meaning |
|---|---|
| 0 | Success |
| 1 | Error |
| 2 | Threshold exceeded |
| 3 | Partial failure |
MIT