scanproject/standalone repository overview

⁠Scan Project - Standalone

ARCHIVED PROJECT: We are currently focusing on a contract with a private company. We will update this page when we release the new generation of our products.

NOTE: We paused daily updates to this image as of 2024-07-01 due to breaking changes in Dependency Check. We will release a new version of our standalone CLI soon, but we are currently focused on serving our customers and our commercial offering. Please let us know if that is blocking you at [email protected]⁠

A "no-hassle" version of our scanner that just works. It requires no server hosting and no commercial scanner licenses.

This image updates daily to include the latest OWASP Dependency Check⁠ database.

⁠Included scanners

Included in this image:

⁠Running scans

To scan a project in the current directory, you can just run the container with this image:

docker run --rm -v ".:/src" scanproject/standalone

By default, it will create a new file tsp-report.json⁠ in the project directory. The file contains the findings report in our generic format⁠.

To see list of available export formats and parameters, run:

docker run --rm -v ".:/src" scanproject/standalone scan -h

⁠Let us know what you think!

Let us know your thoughts or if you find any bugs at [email protected]⁠! You found us during the very early stage of this work, and we can't wait to hear from you!

⁠Changing parameters

By default, the software looks for a project in the container's /src directory and will write the report to /src/tsp-report.json. You can change these parameters and configure the volume mounts however you prefer.

For example, you can use a custom volume mount for the report:

docker run --rm \
  -v "/path/to/project/dir:/custom/path/to/project" \
  -v "/custom/report/path:/report" \
  scanproject/standalone \
  scan /custom/path/to/project --report-path=/report/custom-report-file.json

⁠Semgrep Configuration

Semgrep scanner runs the auto configuration by default. To change it, use the --semgrep-config command line option. Multiple values are supported. For example,

docker run --rm \
  -v ".:/src" \
  scanproject/standalone scan \
  --semgrep-config=p/owasp-top-ten \
  --semgrep-config=p/cwe-top-25 \
  --semgrep-config=p/xss

⁠Advanced usage and documentation

Check our documentation site⁠ to learn about other functionality available in this image, such as consolidating multiple security tool scan results at the SonarQube⁠ dashboard or SARIF⁠ / DefectDojo⁠ exports.

⁠Remarks

• Most security scanners require build artifacts and dependencies to be present in the project folder - otherwise, they return false negatives. So if you just checked the code out, you must run a build before running the scan. At a bare minimum, something like npm install --package-lock or gradle build -x test, depending on your project language and platform.
• The image size is increased because it carries pre-cached databases with vulnerabilities for OWASP Dependency Check⁠ to enable faster startup.

⁠Privacy

Outside the information collected by our partners' tools included in the scan, it is entirely local to the container, and no code is being sent outside. You should expect the information about your dependency names and versions to be leaked by database querying tools.

We do not allow turning off our partner's metrics collection in the free version of our scanner. Please get in touch with [email protected]⁠ if your organization requires no metrics collection in our free products.