GitScan (pronunciation) is a comprehensive and versatile security scanner. GitScan has scanners that look for security issues, and targets where it can find those issues.
Targets (what GitScan can scan):
- Container Image
- Filesystem
- Git Repository (remote)
- Virtual Machine Image
- Kubernetes
- AWS
Scanners (what GitScan can find there):
- OS packages and software dependencies in use (SBOM)
- Known vulnerabilities (CVEs)
- IaC issues and misconfigurations
- Sensitive information and secrets
- Software licenses
To learn more, go to the GitScan homepage for feature highlights, or to the Documentation site for detailed information.
GitScan is available in most common distribution channels. The full list of installation options is available in the Installation page. Here are a few popular examples:
brew install gitscan
docker run aquasec/gitscan
- Download binary from https://github.com/aquasecurity/gitscan/releases/latest/
- See Installation for more
GitScan is integrated with many popular platforms and applications. The complete list of integrations is available in the Ecosystem page. Here are a few popular examples:
- GitHub Actions
- Kubernetes operator
- VS Code plugin
- See Ecosystem for more
gitscan <target> [--scanners <scanner1,scanner2>] <subject>
Examples:
gitscan image python:3.4-alpine
Result
trivy-image.mov
gitscan fs --scanners vuln,secret,config myproject/
Result
trivy-fs.mov
gitscan k8s --report summary cluster
tri
is pronounced like trigger, vy
is pronounced like envy.
GitScan is an Aqua Security open source project.
Learn about our open source work and portfolio here.
Contact us about any matter by opening a GitHub Discussion here