DevSecCode Scanner
Gamified local SAST. Find SQL injection, hardcoded secrets, XSS, and other CWE classics in your codebase — no SaaS dashboard, no Python toolchain, no CI gate required.
Try it now
npx @devseccode/scanner hunt .No install. No signup. No config file. The scanner downloads a prebuilt ~18 MB binary for your platform and runs locally — your source code never leaves the machine.
What it does
- High-precision SAST rules across 9 CWE families — SQL injection,
XSS, command injection, path traversal, hardcoded secrets, broken crypto, cleartext HTTP, XXE, and CSRF — for Python, JavaScript / TypeScript, Go, Java, and Rust.
- Infrastructure scanning for Dockerfiles and Kubernetes manifests.
- Gamified TUI — a scan map, encounter cards, and a triage flow
designed to be run more than once.
- Standard outputs — SARIF (for GitHub code scanning), JUnit (for
CI test runners), JSON (for downstream tooling), and a colorized terminal report.
- Zero runtime dependencies — a single PyInstaller binary per
platform. No Python install, no nodemodules for the scanner itself, no internet connection at runtime.
Install
# One-shot (recommended for first-timers):
npx @devseccode/scanner hunt .
# Global:
npm install -g @devseccode/scanner
devseccode --help # or `dsc` for short
# Project-local (recommended for CI):
npm install --save-dev @devseccode/scanner
npx devseccode scan . --format sarif --output devseccode.sarifCommon commands
devseccode hunt . # gamified scan
devseccode scan . --format sarif --output out.sarif # CI-friendly scan
devseccode scan . --format json --output out.json # tooling-friendly
devseccode list-rules # what's in the public ruleset
devseccode explain deva.cwe-89.python-sql-injection # rule details
devseccode init # drop a .dsc.yml