# Horusec | An Open Source Tool That Improves Identification Of Vulnerabilities In Your Project **URL:** \ **Category:** Tools & Scripts\ **Tags:** programming\ **Created:** [February 23, 2021, 11:38am UTC](https://onehack.st/t/horusec-an-open-source-tool-that-improves-identification-of-vulnerabilities-in-your-project/173454 "2021-02-23T11:38:04Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![PlayBoy83](https://onehack.st/user_avatar/onehack.st/playboy83/32/164314_2.png) [@PlayBoy83](https://onehack.st/u/PlayBoy83)\ **Post date:** [February 23, 2021, 11:38am UTC](https://onehack.st/t/horusec-an-open-source-tool-that-improves-identification-of-vulnerabilities-in-your-project/173454/1 "2021-02-23T11:38:04Z")
![image](https://onehack.st/uploads/default/original/3X/1/1/11d8e0531aa67d47b178e5cf451aea3551c2d114.png) Horusec is an open source tool that performs static code analysis to identify security flaws during the development process. Currently, the languages for analysis are: C#, Java, Kotlin, Python, Ruby, Golang, Terraform, Javascript, Typescript, Kubernetes, PHP, C, HTML, JSON, Dart. The tool has options to search for key leaks and security flaws in all files of your project, as well as in Git history. Horusec can be used by the developer through the CLI and by the DevSecOps team on CI /CD mats. See in our [DOCUMENTATION](https://horusec.io/docs) the complete list of tools and languages that we perform analysis **Project roadmap 2021** We started the project to aggregate within our company, but as the search grew more and more we chose to apply good practices and open it up for everyone to collaborate with this incredible project. In order to achieve our goals, we separated in some delivery phases: - **Phase 0:** Support for all horusec-cli features into [horusec-vscode](https://github.com/ZupIT/horusec-vscode-plugin) (Q1) - **Phase 1:** Support for the Theia(VsCode Web) (Q1) - **Phase 2:** Support to Flutter, Dart, Bash, Shell, Elixir, Cloujure e Scala in analysis (Q1) - **Phase 3:** New service to manager vulnerabilities founds (Q2) - **Phase 4:** Dependency analysis for all supported languages (Q3) - **Phase 5:** SAST with MVP Semantic Analysis (Q4) - **Phase 6:** DAST with MVP symbolic analysis (Q4) **Getting started** **Installing** To see more details how install go to [HERE](https://github.com/ZupIT/horusec/blob/master/horusec-cli#installing) **Check the installation** ```auto horusec version ``` **Usage** For use horusec-cli and check your vulnerabilities ```auto horusec start ``` or send with the authorization token to view the content analytically in the horusec admin panel. ```auto horusec start -a="" ``` To acquire the authorization token and you can see your vulnerabilities analytically on our panel see more details [HERE](https://github.com/ZupIT/horusec/blob/master/horusec-cli#authorization) **WARN:** When horusec starts an analysis it creates a folder called `.horusec`. This folder serves as the basis for not changing your code. So we recommend that you add the line `.horusec` into your `.gitignore` file so that this folder does not need to be sent to your git server! [![](https://1.bp.blogspot.com/--b4_PYO_Y_Y/YC8rFfrw9UI/AAAAAAAAVZE/LVph1Rxv0CQz8w8YAYGfKuFgyMqSCn2RQCNcBGAsYHQ/w640-h302/horusec_6_usage_horusec.gif)](https://1.bp.blogspot.com/--b4_PYO_Y_Y/YC8rFfrw9UI/AAAAAAAAVZE/LVph1Rxv0CQz8w8YAYGfKuFgyMqSCn2RQCNcBGAsYHQ/s1918/horusec_6_usage_horusec.gif) **Requirements for usage horusec-cli** - docker - git(Mandatory if you are using search throughout the project’s git history) **Usage locally** For usage the horusec locally clone horusec in your local machine and run ```auto make install ``` and run the [HORUSEC-CLI](https://github.com/ZupIT/horusec/blob/master/horusec-cli#horusec-cli) to start the analysis **Default Development account** For usage complete feature of the horusec you can see enter using this default user generated by horusec for you usage. **WARN:** We do dns validation for account creation, so remember to use a valid email. For tests accounts we accept […@example.com](mailto:...@example.com) as a valid dns. ```auto email: dev@example.com password: Devpass0* ``` **Requirements for use complete horusec locally** - docker - git - docker-compose/helm - golang - rabbitmq - postgres - account-of-email (optional) **Horusec manager** - Separate repositories by companies - Manage users who have access to your company (users must be pre-registered on horusec to be invited to a pre-existing company) - Manage the repositories available in your company for analysis - Manage users who have access to company repositories - Manage your access tokens for the specific repository (required to identify which repository this analysis belongs to and save to our system) - Visually view all existing vulnerabilities in your company and/or its repository **Contributing** Read our [contributing guide](https://github.com/ZupIT/horusec/blob/master/CONTRIBUTING.md) to learn about our development process, how to propose bugfixes and improvements, and how to build and test your changes to horusec. **Communication** We have a few channels for contact, feel free to reach out to us at: - [GitHub Issues](https://github.com/ZupIT/horusec/issues)  ## GitHub: > **[GitHub - ZupIT/horusec: Horusec is an open source tool that improves...](https://github.com/ZupIT/horusec)** > > Horusec is an open source tool that improves identification of vulnerabilities in your project with just one command.