Skip to content

Synapse v0.1.0 — deterministic security & code-quality scanner

Choose a tag to compare

View all tags
@nghiadaulau nghiadaulau released this 22 Jul 07:56
· 188 commits to main since this release
v0.1.0
50db3a9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

The first release of Synapse — a deterministic, CI-native scanner that finds security and code-quality problems in one pass, and gates your pipeline on them.

Point it at a source repo or a container image and it returns ranked, evidence-backed findings. Not a wrapper around someone else's engine: Synapse owns its SBOM parsing and advisory matching, adds first-party SAST / secret / IaC analysis, and ranks by real-world risk. No AI in the finding path — every result is deterministic and reproducible.

What's in the box

  • Software Composition Analysis — vendor-neutral, owned SBOM across many lockfile ecosystems, matched against OSV · GHSA · CSAF and cross-checked with Grype's offline DB. Container images are cataloged down to OS packages (Debian/dpkg, Alpine/apk) and language dependencies.
  • First-party SAST — deterministic pattern rules for Go, Python, JavaScript/TypeScript, Java, C#, C, and C++. Security weaknesses carry a CWE and are kept separate from code-quality lint.
  • Secret scanning — redacted and deterministic; test/fixture/example noise suppressed by default.
  • IaC misconfiguration — Dockerfile, Terraform, Kubernetes, Helm, CloudFormation, GitHub Actions.
  • License policy — allow/deny verdicts with SPDX category and risk.
  • Risk-based prioritization — CISA KEV → EPSS × CVSS, never raw CVSS.
  • Air-gapped ready — scan local docker save image tarballs with no registry; offline advisory and offline NVD-CVSS databases; full --offline mode.
  • CI-native — SARIF 2.1.0 output for GitHub code-scanning, --fail-on <severity> gate, and a reproducible evidence digest.

Install

GitHub Action (installs the CLI + syft + grype, verifies checksums):

- uses: KKloudTarus/synapse-ce@v0.1.0
  with:
    fail-on: high
    sarif: "true"

Binary — download the archive for your platform below (SHA-256 in checksums.txt), extract synapse-cli, put it on PATH. Requires syft (+ grype for the offline DB) alongside it.

From source — go build ./cmd/synapse-cli, or build the CLI image from Dockerfile.cli.

Quickstart

synapse-cli scan .                         # source: SCA + SAST + secret + IaC misconfig
synapse-cli scan app.tar --image           # container image, incl. air-gapped docker-save tarball
synapse-cli scan . --sarif --fail-on high  # gate CI and emit SARIF for code-scanning

Deterministic. Reproducible. Ships with the evidence.

Assets 8
Loading