Horusec
What it is
Horusec is a free static code analysis tool for finding security flaws during development. It can scan project files and Git history for leaked keys and other security issues. The project describes analysis across 18 languages using 20 security tools; listed coverage includes C#, Java, Kotlin, Python, Ruby, Golang, Terraform, JavaScript, TypeScript, Kubernetes, PHP, C, HTML, JSON, Dart, Elixir, Shell and Nginx. Analysis can be configured through CLI resources. Developers can use its command-line interface, and DevSecOps teams can incorporate it into CI/CD pipelines. A Visual Studio Code extension is also available. Horusec-Web provides vulnerability metrics dashboards, false-positive controls, authorization tokens and vulnerability updates. Horusec Platform works with the CLI to visualize and manage vulnerabilities and supports native Horusec, LDAP and Keycloak authentication. Running Horusec with all of its tools requires Docker; disabling Docker reduces its analysis capabilities. The platform has additional RabbitMQ and PostgreSQL dependencies, and its repository was archived by its owner on March 19, 2025 and is read-only. The open-source plan costs nothing under Apache License 2.0.
For and against
For
- Scans project files and Git history for security issues.
- Supports a broad listed set of languages.
- Can run in CI/CD pipelines.
- Includes a Visual Studio Code extension.
- Configurable analysis is available through CLI resources.
Against
- Full tool operation requires Docker.
- Disabling Docker reduces analysis capabilities.
- Platform requires RabbitMQ and PostgreSQL.
- Horusec Platform repository is archived and read-only.
The verdict
Horusec provides configurable static analysis through CLI and editor workflows, with web components for viewing and managing vulnerabilities. Docker is needed to run all tools, and the platform repository is archived and read-only.
Who it suits
Horusec suits developers seeking source analysis through a CLI or Visual Studio Code extension, and DevSecOps teams using CI/CD pipelines. Teams considering its web platform should note its dependencies and archived repository status.
Plans and prices
Open source
Apache License 2.0 · CLI and platform components
Read 1 Oct 2026 · github.com
On the record
- Configurable analysis
- The analysis is fully configurable through CLI resources.github.com · read 1 Oct 2026
- Developer workflow
- Developers can use Horusec through its CLI, while DevSecOps teams can use it in CI/CD pipelines.github.com · read 1 Oct 2026
- Docker requirement
- Docker is required to run Horusec with all its tools; disabling Docker loses much of the analysis power.github.com · read 1 Oct 2026
- Editor integration
- The project provides a Visual Studio Code extension for analyzing projects.github.com · read 1 Oct 2026
- Languages
- It analyzes C#, Java, Kotlin, Python, Ruby, Golang, Terraform, JavaScript, TypeScript, Kubernetes, PHP, C, HTML, JSON, Dart, Elixir, Shell and Nginx.github.com · read 1 Oct 2026
- Platform authentication
- Horusec Platform supports native Horusec, LDAP and Keycloak authentication.github.com · read 1 Oct 2026
- Platform dependencies
- Horusec Platform requires RabbitMQ and PostgreSQL.github.com · read 1 Oct 2026
- Platform integration
- Horusec Platform is a set of web services integrating with Horusec CLI to visualize and manage vulnerabilities.github.com · read 1 Oct 2026
- Platform status
- The Horusec Platform repository was archived by its owner on March 19, 2025 and is read-only.github.com · read 1 Oct 2026
- Purpose
- Horusec performs static code analysis to identify security flaws during development.github.com · read 1 Oct 2026
- Secret detection
- It searches project files and Git history for key leaks and other security flaws.github.com · read 1 Oct 2026
- Security policy
- Zup's open-source projects adopt OpenSSF Security Scorecard and OpenSSF Best Practices Badge recommendations.github.com · read 1 Oct 2026
- Security tools
- Horusec analyzes 18 languages with 20 different security tools simultaneously.github.com · read 1 Oct 2026
- Support
- Questions and ideas are handled through GitHub Issues and the Zup Open Source Forum.github.com · read 1 Oct 2026
- Web application
- Horusec-Web provides vulnerability metrics dashboards, false-positive control, authorization tokens and vulnerability updates.github.com · read 1 Oct 2026
