Security Testing Toolkit

Video walkthrough (about 1.5 minutes)

How it works, installing on Mac and Windows, running a scan, reading the report, and scanning every repo in your company.

What it checks

Each scanner looks for a different kind of problem. Together they cover most of the common risks in the OWASP Top 10.

How it works

Every scanner runs inside Docker, so you don't install any of them. Each writes a JSON result. summarize.py merges them into one report sorted by severity, with a "How to fix" column. The run fails if anything at or above your chosen severity (default high) is found, which lets you block risky code from merging.

When it runs on GitHub

Setup (one time, about 2 minutes)

1. Download and unzipUse the download button at the top of this page.
2. Copy the files into your project's root folder
   Copy

   # run from the folder where you unzipped
   cp -r security-testing-toolkit-main/.github security-testing-toolkit-main/security /path/to/your-project/

   On Windows, copy the .github and security folders with File Explorer. Turn on "Show hidden items" to see .github.

3. Ignore the report folder
   Copy

   cd /path/to/your-project
   echo "security-reports/" >> .gitignore
   chmod +x security/scan.sh

4. Commit and push
   Copy

   git add .github security .gitignore
   git commit -m "Add automated security scanning"
   git push

   The first scan starts automatically after the push.

Run a scan

# Scan code, secrets and dependencies
./security/scan.sh

# Also scan your app while it's running locally
./security/scan.sh http://localhost:3000

# Only fail on critical issues for this run
SECURITY_FAIL_ON=critical ./security/scan.sh

# code-only scan
gh workflow run security-scan.yml

# with a live app scan
gh workflow run security-scan.yml -f target_url=https://staging.myapp.com -f fail_on=high

# watch it, then download the reports
gh run watch
gh run download --name security-reports

Scan your whole company GitHub

Check every repository in your organization in one go. You get a company report with the counts for each repo, and each repo links to its full report.

1. Install the GitHub CLI and sign in once
   Copy

   # Mac
   brew install gh
   # Windows (PowerShell)
   winget install GitHub.cli
   
   gh auth login

2. Run the org scanReplace your-company with your GitHub organization name. It clones each repo, scans it, then deletes the copy.
   Copy

   ./security/scan-org.sh your-company
   
   # only the 20 most recently updated repos
   ./security/scan-org.sh your-company 20

3. Open the company reportorg-reports/index.html lists every repo with its critical, high, medium and low counts.
4. Keep every repo covered automaticallyAdd .github/workflows/security-scan.yml and the security/ folder to each repo, so every push and pull request is scanned too.

Private repos are included when your GitHub account can access them. Nothing is uploaded anywhere: the scans run on your computer.

Settings (optional)

On GitHub: Repo → Settings → Secrets and variables → Actions → Variables tab → New repository variable.

Block risky pull requests

Settings → Branches → Add rule for main → turn on "Require status checks to pass" → select security-scan. A PR with high or critical findings then can't be merged.

The same variables work locally as environment variables: SECURITY_TARGET_URL and SECURITY_FAIL_ON.

Reading the results

report.html shows a count per severity, then every finding with the tool, the issue, the file or URL, and how to fix it. You can filter by severity or tool and search.

Files in security-reports/

Fixing common issues

// before
const apiKey = "sk_live_abc123...";
// after
const apiKey = process.env.API_KEY;

npm install lodash@4.17.21        # Node
npm audit fix                     # Node, fix all safe upgrades
pip install -U "django>=4.2.16"   # Python

// bad
db.query("SELECT * FROM users WHERE id = " + req.params.id);
// good
db.query("SELECT * FROM users WHERE id = $1", [req.params.id]);

// Express
npm install helmet
app.use(require("helmet")());

# Django settings.py
SECURE_HSTS_SECONDS = 31536000
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True
X_FRAME_OPTIONS = "DENY"

What the tools can't catch: test these yourself

Automated scanners miss business-logic bugs. These are among the most common real-world vulnerabilities, so add tests for them to your normal test suite:

// Example (Jest + supertest)
test("user cannot read another user's order", async () => {
  const res = await request(app)
    .get("/api/orders/" + orderOfUserB.id)
    .set("Authorization", "Bearer " + tokenOfUserA);
  expect([403, 404]).toContain(res.status);
});

To practice finding these, use PortSwigger Web Security Academy (free labs) and OWASP Juice Shop (a deliberately vulnerable app you run locally).

FAQ