Horusec is an open-source SAST orchestration tool that coordinates 20+ security engines into a unified vulnerability report. Created by ZupIT, it supports 18+ languages and includes a web dashboard for vulnerability management.
With over 1,200 GitHub stars, Horusec provides multi-language scanning by orchestrating established tools like Bandit, Brakeman, GoSec, and SpotBugs rather than building its own analysis engine.
What is Horusec?
Rather than implementing its own analysis engine, Horusec runs established security tools and consolidates their findings. OWASP recommends using multiple static analysis tools for broader coverage, since each tool has different strengths and detection capabilities. Horusec automates this by detecting languages in your repository and selecting the appropriate scanners. Results merge into a single report with deduplication and unified severity ratings.
Key features
Multi-tool orchestration
| Language | Tools used |
|---|---|
| Python | Bandit, Safety |
| Go | GoSec, Nancy |
| JavaScript/TypeScript | npm-audit, ESLint security |
| Java/Kotlin | SpotBugs, Dependency-Check |
| Ruby | Brakeman, Bundler-audit |
| C# | Security Code Scan |
| Infrastructure | Checkov, TFSec, Trivy |
Getting started
brew install horusec on macOS, or the install script for Linux: curl -fsSL https://raw.githubusercontent.com/ZupIT/horusec/main/deployments/scripts/install.sh | bashhorusec start in your project directory. Horusec auto-detects languages and runs appropriate scanners.-o json for JSON output or -o sarif for SARIF format.horusec-operator repository.When to use Horusec
Horusec is a good fit for teams with multi-language codebases that want a single scanning command instead of managing multiple tools individually. The Apache 2.0 license makes it suitable for any organization.
For single-language projects, the specialized underlying tools (Bandit, Brakeman, etc.) may be more appropriate run directly. For commercial support and deeper analysis, consider Checkmarx or Semgrep.
