Broly

README

Broly — Berserker product security scanner.

Secrets, SCA, and SAST in a single binary.

Install

Linux - download a pre-built binary from Releases.

macOS - build from source (requires Vectorscan):

brew install vectorscan
git clone https://github.com/Shasheen8/Broly.git
cd Broly && make build

Usage

broly scan                           # scan current directory
broly scan /path/to/project          # scan specific path

broly scan --secrets                 # secrets only
broly scan --sca                     # SCA only

broly scan -f json                   # JSON output
broly scan -f sarif -o results.sarif

broly scan --min-severity high
broly scan --sca --offline           # skip OSV API

What It Finds

Secrets - 487 rules, entropy filtering, Hyperscan engine

AWS, GitHub, OpenAI, Anthropic, GCP, Azure, Cloudflare, Slack, Stripe, Twilio,
SendGrid, Docker, npm, SSH/PGP/RSA/EC keys, database URIs, JWTs, generic tokens

SCA - 19 ecosystems, 50+ lockfile formats

Go, Python, JavaScript, Ruby, Rust, Java, PHP, .NET, Dart, C/C++, Haskell,
Elixir, Erlang, R, Swift, Lua, Nim, OCaml, Julia, including Go stdlib vulns

SAST - AST-based analysis, coming in v0.2

Output Formats

Format	Flag
Table (default)	-f table
JSON	-f json
SARIF 2.1.0	-f sarif

Acknowledgments

• Titus - secrets engine
• osv-scalibr - lockfile extraction
• osv.dev - vulnerability database

License

MIT