Broly

README

Broly

Berserker product security scanner. Secrets, SCA, and SAST in a single binary.

Quick Start

Download a pre-built binary from Releases, or build from source:

brew install vectorscan   # build dependency
git clone https://github.com/Shasheen8/Broly.git
cd Broly && make build

Usage

broly scan                          # scan current directory
broly scan /path/to/project         # scan specific path

broly scan --secrets                # secrets only

broly scan --sca                    # SCA only

broly scan -f json                  # JSON output
broly scan -f sarif -o results.sarif

broly scan --min-severity high
broly scan --sca --offline          # skip OSV API

What It Finds

Secrets: 100 rules, entropy filtering, Hyperscan engine

  AWS, GitHub, OpenAI, Anthropic, GCP, Azure, Cloudflare, Slack, Stripe, Twilio, SendGrid, Docker, npm,
  SSH/PGP/RSA/EC keys, database connection strings, JWTs, generic tokens and passwords

SCA: 19 ecosystems, 50+ lockfile formats, OSV.dev database

  Go, Python, JavaScript, Ruby, Rust, Java, PHP, .NET, Dart, C/C++, Haskell, Elixir, Erlang, R, Swift,
  Lua, Nim, OCaml, Julia — including Go stdlib vulnerabilities

SAST: tree-sitter AST analysis, coming in v0.2

Output Formats

• table (default)
• json, sarif (SARIF 2.1.0)

Acknowledgments

• Poltergeist — secret scanning engine
• osv-scalibr — lockfile extraction
• osv.dev — vulnerability database
• Opengrep — rule DSL inspiration

License

MIT