{"slug": "i-merged-5-python-security-scanners-into-one-deduped-cli", "title": "I merged 5 Python security scanners into one deduped CLI", "summary": "Velonus released an open-source CLI that merges five Python security scanners—Bandit, pip-audit, Safety, Semgrep, and detect-secrets—into a single deduplicated tool, with the core scanner and normalizer available on GitHub. The CLI runs fully locally, while AI triage and fix generation are part of the proprietary hosted platform. The tool supports terminal, JSON, and SARIF outputs and returns exit code 1 on HIGH or CRITICAL findings for CI gating.", "body_md": "AI-native application security scanner for developers. Finds real issues. Explains why they matter. Generates fixes.\n\nThis repo is the **open-source scanner core** of [Velonus](https://velonus.com):\nthe CLI, the scan pipeline (`packages/scanner`\n\n), and finding\nnormalization/deduplication (`packages/normalizer`\n\n). Running `velonus scan`\n\nlocally never sends your code anywhere — it's fully self-contained.\n\nThe AI triage/remediation engine, GitHub App integration (one-click fix PRs\nwith generated regression tests), and web dashboard are part of the hosted\nVelonus platform and are proprietary — `velonus scan --ai`\n\ntalks to that API,\neverything else in this repo runs entirely on your machine.\n\n[Installation](#installation)[Quick Start](#quick-start)[Commands](#commands)[Output Formats](#output-formats)[Severity Levels](#severity-levels)[CI/CD Integration](#cicd-integration)[What's under the hood](#whats-under-the-hood)[License](#license)\n\n- Python 3.10+\n- Windows / macOS / Linux\n\n```\npip install velonus\n```\n\nThis installs the CLI plus Bandit, pip-audit, and Safety (the core scanner tools). Two extras add more coverage:\n\n```\npip install velonus[semgrep]          # Semgrep ruleset (~200MB, optional)\npip install velonus[detect-secrets]   # detect-secrets, higher-fidelity secret scanning\npip install velonus[semgrep,detect-secrets]\n```\n\nVerify install:\n\n```\nvelonus --version\n# Scan the current directory\nvelonus scan ./\n\n# Scan a specific project\nvelonus scan ./my-python-project\n\n# Only show HIGH and CRITICAL findings\nvelonus scan ./ --severity high\n\n# Output as JSON (for piping or tooling)\nvelonus scan ./ --format json\n\n# Submit to the Velonus API for AI triage + fix suggestions (requires `velonus auth login`)\nvelonus scan ./ --ai\n```\n\nRuns the security scanner pipeline (secrets, Bandit, Semgrep, pip-audit, Safety) on a local path and prints findings to the terminal.\n\n```\nvelonus scan [PATH] [OPTIONS]\n```\n\n| Argument / Option | Default | Description |\n|---|---|---|\n`PATH` |\n`.` |\nPath to the project or file to scan |\n`--format` , `-f` |\n`terminal` |\nOutput format: `terminal` , `json` , `sarif` |\n`--severity` , `-s` |\n`info` |\nMinimum severity to show: `critical` , `high` , `medium` , `low` , `info` |\n`--verbose` , `-v` |\noff | Show per-tool timing and extra detail |\n`--sarif` |\noff | Write findings to `velonus-results.sarif` |\n`--output` , `-o` |\nCustom SARIF output path (implies `--sarif` ) |\n|\n`--exclude` , `-e` |\nGlob pattern to exclude, repeatable (e.g. `--exclude migrations/` ) |\n|\n`--detectors` , `-d` |\nall five | Restrict to specific detectors: `secrets` , `bandit` , `semgrep` , `pip-audit` , `safety` |\n`--ai` |\noff | Submit to the Velonus API for AI triage + fix generation (requires `velonus auth login` ) |\n`--help` |\nShow help and exit |\n\n```\nvelonus scan ./                                       # scan current directory\nvelonus scan ./ --severity high                        # only critical + high\nvelonus scan ./ --exclude migrations/ --exclude '*/generated_*.py'\nvelonus scan ./ --detectors bandit,semgrep              # only run these two\nvelonus scan ./ --format json > findings.json\nvelonus scan ./ --sarif                                 # for GitHub Code Scanning\n```\n\n| Code | Meaning |\n|---|---|\n`0` |\nScan completed, no HIGH or CRITICAL findings |\n`1` |\nScan completed, one or more HIGH or CRITICAL findings found |\n\nExit code `1`\n\non HIGH/CRITICAL is intentional — use it as a CI gate to block merges.\n\nManages authentication with the Velonus API (only needed for `--ai`\n\n, `pr review`\n\n).\n\n```\nvelonus auth login    # prompts for API key, verifies it, stores it in ~/.velonus/config.toml\nvelonus auth logout   # clears stored credentials\nvelonus auth status   # shows masked key + live connectivity check\n```\n\nManages local CLI configuration at `~/.velonus/config.toml`\n\n.\n\n```\nvelonus config show\nvelonus config set scan.detectors bandit,semgrep\n```\n\nRuns an on-demand AI-assisted review of an open GitHub pull request (requires\n`velonus auth login`\n\nand a connected GitHub App installation on the hosted\nplatform).\n\n```\nvelonus pr review https://github.com/org/repo/pull/123\n```\n\nGenerates a ready-to-use CI workflow file that runs Velonus and uploads SARIF to GitHub code scanning.\n\n```\nvelonus ci --generate-workflow                        # writes .github/workflows/velonus.yml\nvelonus ci --generate-workflow --provider github-actions --output custom/path.yml\n```\n\nColored Rich table with severity badges, file paths, line numbers, rule IDs, and messages.\n\n```\n┏━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━┳━━━━━━━━━━━━━━━┳━━━━━━━┳━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓\n┃ Severity       ┃ Tool       ┃ File          ┃ Line  ┃ Rule             ┃ Message                      ┃\n┡━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━╇━━━━━━━━━━━━━━━╇━━━━━━━╇━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩\n│ 🔴 CRITICAL    │ secrets    │ config.py     │ 12    │ aws-access-key   │ Hardcoded AWS access key…    │\n│ 🟠 HIGH        │ bandit     │ auth/views.py │ 87    │ B106             │ Hardcoded password in func…  │\n│ 🟡 MEDIUM      │ semgrep    │ db/query.py   │ 43    │ python.sqli      │ Possible SQL injection…      │\n└────────────────┴────────────┴───────────────┴───────┴──────────────────┴──────────────────────────────┘\n\nTotal: 3 findings  —  1 CRITICAL  1 HIGH  1 MEDIUM\n```\n\nA JSON array of `NormalizedFinding`\n\nobjects — suitable for piping into other tools.\n\n```\nvelonus scan ./ --format json | python -m json.tool\n```\n\nStatic Analysis Results Interchange Format 2.1.0 — compatible with GitHub Code Scanning, VS Code's SARIF Viewer, and other SAST tooling.\n\n| Badge | Level | When it's used |\n|---|---|---|\n| 🔴 | `CRITICAL` |\nHardcoded secrets, RCE, auth bypass |\n| 🟠 | `HIGH` |\nSQL injection, command injection, insecure deserialization |\n| 🟡 | `MEDIUM` |\nXSS, weak crypto, path traversal |\n| 🔵 | `LOW` |\nInsecure defaults, minor misconfigurations |\n| ⚪ | `INFO` |\nStyle issues, informational notes |\n\nGenerate a workflow automatically:\n\n```\nvelonus ci --generate-workflow\n```\n\nOr add this manually to `.github/workflows/security.yml`\n\n:\n\n```\nname: Velonus Security Scan\n\non: [push, pull_request]\n\njobs:\n  scan:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - uses: actions/setup-python@v5\n        with:\n          python-version: \"3.12\"\n      - run: pip install velonus\n      - run: velonus scan ./ --severity high\n        # exits 1 on HIGH/CRITICAL findings — blocks the merge\nrepos:\n  - repo: local\n    hooks:\n      - id: velonus-scan\n        name: Velonus Security Scan\n        entry: velonus scan\n        args: [\"./\", \"--severity\", \"high\"]\n        language: system\n        pass_filenames: false\n```\n\n— Typer CLI, Rich terminal output, config management, API client for`apps/cli`\n\n`--ai`\n\n/`pr review`\n\n/`auth`\n\n.— parallel wrappers around Bandit, Semgrep, pip-audit, Safety, and secret detection (detect-secrets + entropy fallback). Nothing here is a reimplementation of these tools — Velonus orchestrates and normalizes their output.`packages/scanner`\n\n— converts every tool's raw output into one`packages/normalizer`\n\n`NormalizedFinding`\n\nshape, maps CWE/OWASP, and deduplicates (exact fingerprint + cross-tool same-location merge).\n\nThis pipeline was built to be scanner-agnostic at the finding level — Python via these five tools is the first target, with more language/tool coverage planned.\n\nMIT — this repo (CLI + scanner core) is fully open source.\nThe AI triage/remediation engine, GitHub App integration, and web dashboard\nthat power `--ai`\n\nand `pr review`\n\nare part of the proprietary hosted\nplatform at [velonus.io](https://velonus.io).", "url": "https://wpnews.pro/news/i-merged-5-python-security-scanners-into-one-deduped-cli", "canonical_source": "https://github.com/AliAmmar15/velonus-cli", "published_at": "2026-08-12 13:28:10+00:00", "updated_at": "2026-08-12 13:42:25.254481+00:00", "lang": "en", "topics": ["developer-tools", "ai-tools", "ai-products"], "entities": ["Velonus", "Bandit", "pip-audit", "Safety", "Semgrep", "detect-secrets", "GitHub"], "alternates": {"html": "https://wpnews.pro/news/i-merged-5-python-security-scanners-into-one-deduped-cli", "markdown": "https://wpnews.pro/news/i-merged-5-python-security-scanners-into-one-deduped-cli.md", "text": "https://wpnews.pro/news/i-merged-5-python-security-scanners-into-one-deduped-cli.txt", "jsonld": "https://wpnews.pro/news/i-merged-5-python-security-scanners-into-one-deduped-cli.jsonld"}}