GitLab

Finds credentials, code weaknesses and vulnerable packages across every
repository and branch of a GitHub, GitLab or Bitbucket account, and gives the
people who have to act on the results somewhere to work.

The scanner is bash. Three engines look for credentials, semgrep reads the
code, syft builds the SBOM, and the package findings are matched against the
vulnerability feeds. Everything goes through triage before anybody reads it, so
a placeholder in a README does not arrive looking like a leak. Credentials are
hashed and redacted on the way out; cleartext never leaves the scan.

The web app is FastAPI over MariaDB or SQLite. Local accounts with two step, or
an identity provider over OIDC. Three roles, and a developer only ever sees the
repositories they were given, enforced in the query rather than the template. A
finding somebody else owns returns a 404, not a 403, so probing ids tells you
nothing.

Findings a team has accepted get an exception with a reason, a reviewer and an
expiry. Approved ones become exclusions the scanner honors on the next run, so
the decision holds where the work happens instead of being made again every
night. Setting a whole rule aside needs a second person to agree.

Triage rules are editable from the settings pages, with the rules the tool
ships listed beside anything an installation adds, and one button to put the
defaults back.

Reports are written as JSON and CSV after every scan and after every exception
decision, so the files on disk always agree with the app.

MIT licensed. README.md to install it, documentation/ for the rest.