Broly

README

Broly

A berserker vulnerability scanner.

Secrets · SCA · SAST in a single binary.

AI-powered. No rule files. No rule engine.

---

What It Does

Broly runs three security scanners in parallel on your codebase and delivers results in seconds:

Scanner	Engine	AI Layer
Secrets	Titus · 487 rules · Hyperscan	--ai-filter-secrets eliminates false positives
SCA	osv-scalibr + osv.dev · 19 ecosystems	--ai-sca-reachability checks if the vuln is actually called
SAST	Together AI · Qwen/Qwen3-Coder-Next-FP8 · no rule files, no rule engine	Always-on · data flow analysis · CVSS scoring

---

Install

Go install (any platform):

go install github.com/Shasheen8/Broly/cmd/broly@latest

Linux - pre-built binary from Releases.

macOS - build from source with Hyperscan (faster secrets scanning):

brew install vectorscan
git clone https://github.com/Shasheen8/Broly.git
cd Broly && make build

go install uses pure Go regex for secrets. The source build enables Hyperscan via -tags vectorscan for significantly faster pattern matching on large codebases.

SAST / AI features require a Together AI key:

export TOGETHER_API_KEY=your_key_here

---

Usage

broly scan                                        # run all scanners on current directory
broly scan /path/to/project                       # specific path

# individual scanners
broly scan --secrets                              # secrets only
broly scan --sca                                  # SCA only
broly scan --sast                                 # SAST only (requires TOGETHER_API_KEY)

# AI enhancements
broly scan --ai-filter-secrets                    # filter secrets false positives with AI
broly scan --ai-sca-reachability                  # check if vulnerable deps are actually called
broly scan --ai-model Qwen/Qwen3-Coder-Next-FP8   # override model (default)

# output
broly scan -f json                                # JSON output
broly scan -f sarif -o results.sarif              # SARIF for GitHub Code Scanning
broly scan --min-severity high                    # only high and critical
broly scan --sca --offline                        # skip OSV API lookup

---

Output Results

SAST - AI-powered code analysis

broly vdev - scanning api/handlers.py
scanners: sast | workers: 8


  ╔══════════════════════════════════════════════════════╗
  ║                                                      ║
  ║      ⚡  BROLY  Berserker Vulnerability Scanner       ║
  ║    Secrets · SCA · SAST · Powered by Together AI     ║
  ║                                                      ║
  ╚══════════════════════════════════════════════════════╝

  ▸ SAST (4 findings)

  SEVERITY     ISSUE                            FILE                      DESCRIPTION
  ──────────────────────────────────────────────────────────────────────────────────────────────────
  CRITICAL     SQL injection via unsanitize..   api/handlers.py:10        SQL injection via unsaniti..
  CRITICAL     OS command injection via uns..   api/handlers.py:15        OS command injection via u..
  HIGH         Path traversal in read_file      api/handlers.py:20        Path traversal in read_fil..
  HIGH         Insecure deserialization via..   api/handlers.py:25        Insecure deserialization v..

  ╔══════════════════════════════════════════════════════╗
  ║                                                      ║
  ║  4  total findings                                   ║
  ║  Critical 2    High 2    Medium 0    Low 0           ║
  ║  duration: 9.592s                                    ║
  ║                                                      ║
  ╚══════════════════════════════════════════════════════╝

The SAST engine sends each file directly to Qwen/Qwen3-Coder-Next-FP8 with a structured security prompt. No rule files. No rule engine. No YAML. The model traces data flow from source to sink, infers CVSS scores, and pinpoints exact line numbers, finding what static rules miss.

---

Secrets - with AI false positive filtering

Without --ai-filter-secrets (raw regex hits):

  ▸ SECRETS (3 findings)

  SEVERITY     RULE                             FILE                      REDACTED
  ──────────────────────────────────────────────────────────────────────────────────
  HIGH         AWS API Key                      config/example.py:6       AKIA****MPLE
  HIGH         AWS API Credentials              config/example.py:6       AKIA****KEY"
  HIGH         GitHub Personal Access Token     config/example.py:9       ghp_****8B4a

With --ai-filter-secrets (AI reads surrounding context):

  ✔  No findings detected. Clean scan!

The AI recognized the file contained documented placeholder values (EXAMPLE in variable names, "Test / dummy values" comment) and filtered them all as false positives, reducing noise to zero.

---

SCA - dependency vulnerability scan

broly vdev - scanning /path/to/project
scanners: sca | workers: 8


  ▸ SCA (13 findings)

  SEVERITY     VULN ID                PACKAGE            VERSION        FIXED            ECOSYSTEM
  ──────────────────────────────────────────────────────────────────────────────────────────────────
  MEDIUM       GHSA-9hjg-9r4m-mvj7    requests           2.31.0         no fix           PyPI
  MEDIUM       GHSA-496j-2rq6-j6cc    grpcio             1.54.0         no fix           PyPI
  MEDIUM       GHSA-cfgp-2977-2fmm    grpcio             1.54.0         no fix           PyPI
  MEDIUM       GHSA-wh2j-26j7-9728    google-cloud-ai    1.25.0         no fix           PyPI
  MEDIUM       GHSA-7gcm-g887-7qv7    protobuf           3.20.3         no fix           PyPI
  ...

  ╔══════════════════════════════════════════════════════╗
  ║                                                      ║
  ║  13  total findings                                  ║
  ║  Critical 0    High 0    Medium 13   Low 0           ║
  ║  duration: 388ms                                     ║
  ║                                                      ║
  ╚══════════════════════════════════════════════════════╝

Add --ai-sca-reachability to check whether the vulnerable functions are actually called in your code. Unreachable findings are automatically downgraded one severity level and tagged [Unreachable].

---

What Gets Scanned

Secrets - 487 rules across:

AWS, GitHub, OpenAI, Anthropic, GCP, Azure, Cloudflare, Slack, Stripe, Twilio,
SendGrid, Docker, npm, SSH/PGP/RSA/EC keys, database URIs, JWTs, generic tokens

SCA - 19 ecosystems, 50+ lockfile formats:

Go, Python, JavaScript, Ruby, Rust, Java, PHP, .NET, Dart, C/C++, Haskell,
Elixir, Erlang, R, Swift, Lua, Nim, OCaml, Julia

SAST - AI analysis across 18 languages. No rule files. No rule engine. No maintenance:

Go, Python, JavaScript, TypeScript, Java, Ruby, PHP, C#, Rust, C, C++,
Kotlin, Swift, Bash, and more

---

Output Formats

Format	Flag	Use case
Table (default)	-f table	Terminal, human review
JSON	-f json	CI pipelines, tooling
SARIF 2.1.0	-f sarif	GitHub Code Scanning

---

Acknowledgments

• Titus - secrets engine
• osv-scalibr - lockfile extraction
• osv.dev - vulnerability database
• Together AI - AI inference

License

MIT