/sast-horusec

name: sast-horusec
description: >
  Multi-language static application security testing using Horusec with support for 18+ programming
  languages and 20+ security analysis tools. Performs SAST scans, secret detection in git history,
  and provides vulnerability findings with severity classification. Use when: (1) Analyzing code
  for security vulnerabilities across multiple languages simultaneously, (2) Detecting exposed
  secrets and credentials in git history, (3) Integrating SAST into CI/CD pipelines for secure SDLC,
  (4) Performing comprehensive security analysis during development, (5) Managing false positives
  and prioritizing security findings.
version: 0.1.0
maintainer: asrour
category: secsdlc
tags: [sast, horusec, vulnerability-scanning, multi-language, secrets-detection, static-analysis, secure-sdlc]
frameworks: [OWASP, CWE]
dependencies:
  tools: [docker, git]
references:
  - https://github.com/ZupIT/horusec
  - https://docs.horusec.io/

Horusec SAST Scanner

Overview

Horusec is an open-source security analysis tool that performs static code analysis across 18+ programming languages using 20+ integrated security tools. It identifies vulnerabilities during development, scans git history for exposed secrets, and integrates seamlessly into CI/CD pipelines for secure SDLC practices.

Supported Languages

C#, Java, Kotlin, Python, Ruby, Golang, Terraform, JavaScript, TypeScript, Kubernetes, PHP, C, HTML, JSON, Dart, Elixir, Shell, Nginx

Quick Start

Run Horusec scan on current project:

# Using Docker (recommended)
docker run -v /var/run/docker.sock:/var/run/docker.sock \
  -v $(pwd):/src horuszup/horusec-cli:latest horusec start -p /src -P $(pwd)

# Local installation
horusec start -p ./path/to/project

Core Workflows

Workflow 1: Local Security Scan

For developers performing pre-commit security analysis:

1. Navigate to project directory 2. Run Horusec scan:

   horusec start -p . -o json -O horusec-report.json

3. Review JSON output for vulnerabilities 4. Filter by severity (HIGH, MEDIUM, LOW, INFO) 5. Address critical and high-severity findings 6. Re-scan to validate fixes

Workflow 2: CI/CD Pipeline Integration

Progress: [ ] 1. Add Horusec to CI/CD pipeline configuration [ ] 2. Configure output format (JSON for automated processing) [ ] 3. Set severity threshold for build failures [ ] 4. Run scan on each commit or pull request [ ] 5. Parse results and fail build on high-severity findings [ ] 6. Generate security reports for audit trail [ ] 7. Track remediation progress over time

Work through each step systematically. Check off completed items.

Workflow 3: Git History Secret Scanning

For detecting exposed credentials and secrets:

1. Run Horusec with git history analysis enabled:

   horusec start -p . --enable-git-history-analysis

2. Review detected secrets and credentials 3. Rotate compromised credentials immediately 4. Add detected patterns to `.gitignore` and `.horusec/config.json` 5. Use git-filter-branch or BFG Repo-Cleaner to remove from history (if needed) 6. Document incident and update security procedures

Workflow 4: False Positive Management

When managing scan results and reducing noise:

1. Run initial scan and export results:

   horusec start -p . -o json -O results.json

2. Review findings and identify false positives 3. Create or update `.horusec/config.json` with ignore rules:

   {
     "horusecCliRiskAcceptHashes": ["hash1", "hash2"],
     "horusecCliFilesOrPathsToIgnore": ["**/test/**", "**/vendor/**"]
   }

4. Re-run scan to verify false positives are suppressed 5. Document risk acceptance decisions for compliance 6. Periodically review ignored findings

Configuration

Create `.horusec/config.json` in project root for custom configuration:

{
  "horusecCliCertInsecureSkipVerify": false,
  "horusecCliCertPath": "",
  "horusecCliContainerBindProjectPath": "",
  "horusecCliCustomImages": {},
  "horusecCliCustomRulesPath": "",
  "horusecCliDisableDocker": false,
  "horusecCliFalsePositiveHashes": [],
  "horusecCliFilesOrPathsToIgnore": [
    "**/node_modules/**",
    "**/vendor/**",
    "**/*_test.go",
    "**/test/**"
  ],
  "horusecCliHeaders": {},
  "horusecCliHorusecApiUri": "",
  "horusecCliJsonOutputFilePath": "./horusec-report.json",
  "horusecCliLogFilePath": "./horusec.log",
  "horusecCliMonitorRetryInSeconds": 15,
  "horusecCliPrintOutputType": "text",
  "horusecCliProjectPath": ".",
  "horusecCliRepositoryAuthorization": "",
  "horusecCliRepositoryName": "",
  "horusecCliReturnErrorIfFoundVulnerability": false,
  "horusecCliRiskAcceptHashes": [],
  "horusecCliTimeoutInSecondsAnalysis": 600,
  "horusecCliTimeoutInSecondsRequest": 300,
  "horusecCliToolsConfig": {},
  "horusecCliWorkDir": ".horusec"
}

Output Formats

Horusec supports multiple output formats for different use cases:

• `text` - Human-readable console output (default)
• `json` - Structured JSON for CI/CD integration
• `sonarqube` - SonarQube-compatible format

Specify with `-o` flag:

horusec start -p . -o json -O report.json

Common Patterns

Pattern 1: Fail Build on High Severity

Configure CI/CD to fail on critical findings:

horusec start -p . \
  --return-error-if-found-vulnerability \
  --severity-threshold="MEDIUM"

Exit code will be non-zero if vulnerabilities at or above threshold are found.

Pattern 2: Multi-Project Monorepo Scanning

Scan multiple projects in monorepo structure:

# Scan specific subdirectories
for project in service1 service2 service3; do
  horusec start -p ./$project -o json -O horusec-$project.json
done

Pattern 3: Custom Rules Integration

Add custom security rules:

1. Create custom rules file (YAML format) 2. Configure path in `.horusec/config.json`:

   {
     "horusecCliCustomRulesPath": "./custom-rules.yaml"
   }

3. Run scan with custom rules