The security scanner that
lives in your workflow
Open-source SAST scanner for JavaScript, TypeScript, Python, PHP and ASP.NET. 189+ OWASP rules, git hooks, and taint analysis — zero repo footprint, zero friction.
Built for developers
who ship fast
scd disappears into your workflow. Scanning happens automatically via git hooks — findings stay local, nothing slows your team down.
Taint analysis
Tracks user-controlled data from HTTP input through your code to dangerous sinks. Catches real injection vulnerabilities, not just surface-level pattern matches.
OWASP A03Git hooks
Pre-commit secrets scan blocks exposed credentials before they reach your repo. Pre-push full OWASP scan runs before code leaves your machine. Automatic after scd install.
Context-aware scanning
Files are classified as source, test, config, frontend, or backend before any rule runs. Test files are scanned separately — false positives that would trip in a test fixture are suppressed in production findings. More context types are being added continuously.
PrecisionLocal reports
HTML, Markdown, and JSON reports with per-finding fix guidance. Every scan stored with a unique ID — regenerate any historical report at any time with scd report --scan <id>.
Exception management
Accept risks or mark false positives by finding ID — never by editing source comments. Exceptions are hash-bound to the relevant code line: if the code changes, re-approval is required automatically.
AuditableCI/CD ready
Auto-detects non-interactive contexts. Use --log-to for explicit pipeline control. JSON output for integration with external tooling. Works as a subprocess without a TTY.
Up and running in four commands
After setup, scd runs automatically on every commit and push — no manual trigger needed.
Install scd
Requires Node.js 22 or later on macOS, Linux, or Windows. The -g flag installs scd globally so the scd command is available everywhere.
Install git hooks
Run once per machine. Sets up global git hooks in ~/.scd/hooks/ and configures git to use them across every repository automatically.
Register your project
Run once per project. Creates a config file in ~/.scd/repos/ — nothing is written to your repository. Your repo stays clean.
Run your first scan
From here, git hooks trigger scans automatically. Run on demand at any time — add --verbose for file-grouped and rule-grouped detail.
Platform-specific setup, Node.js instructions, and troubleshooting in the documentation →
-
JavaScriptNode.js, Express, browser — injection, XSS, JWT, logging, secrets and more
-
TypeScriptTypeScript-specific rule set on top of full JavaScript coverage
-
PythonDjango, Flask, FastAPI — SQL injection, command injection, deserialization
-
PHPDirect input to dangerous functions, session handling, file inclusion
-
ASP.NETC# and ASPX markup — injection, authentication, ViewState, identity patterns
Secrets and sensitive data scanning goes beyond source code — scd inspects all files that commonly leak credentials or data.
189+ rules.
OWASP Top 10
Every rule maps to OWASP Top 10 categories — the same categories used in NIS2 and EU Cyber Resilience Act compliance documentation. Findings automatically carry the right regulatory context.
One runtime dependency. Intentionally lightweight — a small dependency surface is itself a security decision. Verify with npm audit and npm list at any time.
"Your code stays where you put it."
maximum_privacy
Every external API call blocked — SAST scanning runs fully locally today. The strongest guarantee for codebases where no data can leave the network.
Coming soon — Deep AI analysis via a local AI provider: full AI power, zero external communication.
balanced
Default. Deep analysis via Claude API available as an explicit opt-in today. Appropriate for the vast majority of commercial codebases.
Coming soon — Local AI provider as preferred option — local first, cloud AI as fallback opt-in.
maximum_analysis
Cloud AI (Claude API) for maximum analysis depth. Only the triggering code line and 8 lines of surrounding context are sent — whole files are never transmitted. Requires scd-server.
scd CLI is the foundation.
scd-server brings the team.
When you're ready for aggregated findings across all repositories and developers, exception approval workflows, and CRA compliance reports — scd-server runs in your own infrastructure.