codesentry

A lightweight, local-first SAST + code-review toolkit for teams shipping Angular, .NET Core (API/MVC + Syncfusion), Python services, and MS SQL/EF Core — including code generated by AI assistants, which benefits from a second, mechanical pass before it merges.

What this is: a pre-configured wrapper around excellent existing open-source scanners, tuned for this specific stack, packaged to run entirely on a laptop with no server, no database, and no Docker required for the core workflow.

What this is not: a novel scanning engine. If you want the broader, more general-purpose version of this idea, look at MegaLinter or GitLab SAST — both do a more complete job of "orchestrate many linters/scanners into one report" than this project attempts to. codesentry exists because those tools are heavier to set up (CI infra, Docker) than a solo developer or small team wants for local, pre-commit scanning on a machine with limited disk space. If your team already runs MegaLinter or GitLab SAST in CI, you probably don't need this.

Credit where it's due

codesentry doesn't implement any scanning logic itself. It configures and orchestrates:

• Semgrep — cross-language SAST
• Bandit — Python security linting
• ESLint + typescript-eslint + eslint-plugin-security + eslint-plugin-sonarjs — Angular/TypeScript security and maintainability rules
• Gitleaks — secrets detection
• npm audit / dotnet list package --vulnerable — dependency vulnerability checks (built into their respective toolchains)
• SonarQube Community Edition — optional, for a persistent maintainability/quality-gate dashboard
• OWASP ZAP — optional, for DAST against a running instance
• Trivy — optional, for deeper SCA

All credit for actual detection capability belongs to those projects and their maintainers. codesentry's contribution is the specific rule tuning for this stack (see configs/semgrep-rules.yml for EF Core/Syncfusion/MS SQL-specific patterns not covered by generic rulesets), the baseline suppression mechanism, and the single-command local workflow.

What it actually does — and doesn't

Does:

• Pattern-matches known-bad code shapes: SQL injection via string concatenation, hardcoded secrets, weak crypto, unsafe Angular sanitizer bypasses, vulnerable dependency versions.
• Flags maintainability signals: cognitive complexity, function length, duplicated code, naming conventions (via SonarJS rules and .NET analyzers).
• Produces one shareable report.html per scan, with a baseline file so re-scans only surface new findings.

Does not:

• Judge whether code logic is correct for the business requirement.
• Catch novel architectural problems ("wrong abstraction," inappropriate coupling) that don't match a pre-written pattern — no static tool does this reliably, at any price point. That still requires human review, or a separate LLM-based reasoning step reading the diff against a written standard (not included here).
• Review pull requests automatically. This is a CLI tool you point at a folder; it does not integrate with GitHub/GitLab out of the box (see Roadmap).

Setup (macOS)

git clone https://github.com/<your-username>/codesentry.git
cd codesentry
bash install-mac.sh

Setup (Windows)

git clone https://github.com/<your-username>/codesentry.git
cd codesentry
.\install-windows.ps1

Run scans from Git Bash, not PowerShell — scan.sh is a bash script.

Usage

alias codescan="bash /path/to/codesentry/scan.sh"   # add to ~/.zshrc or ~/.bashrc once
codescan /path/to/any/project

Reports are written to codesentry/reports/<project>-<timestamp>/report.html — nothing is written into the scanned project.

First scan on an existing project

codescan /path/to/legacy-project
python3 accept_baseline.py <reports-folder-just-printed> /path/to/legacy-project

Commit the resulting .codesentry-baseline.json into that project's repo (not into codesentry) so the whole team shares the same accepted-findings list. Future scans only show new issues.

What's in the box

Layer	Tool	Config
Cross-language SAST	Semgrep	configs/semgrep-rules.yml
Python SAST	Bandit	configs/bandit.yaml
Angular/TS SAST + maintainability	ESLint	configs/.eslintrc.json
Secrets	Gitleaks	defaults
npm dependency CVEs	npm audit	n/a
NuGet dependency CVEs	dotnet list package --vulnerable	n/a
.NET maintainability/naming	Roslyn analyzers + StyleCop	templates/Directory.Build.props
Pre-commit gating	pre-commit framework	templates/.pre-commit-config.yaml
Quality-gate dashboard (optional)	SonarQube CE	sonarqube/docker-compose.yml

Roadmap (not built yet)

• Diff-scoped scanning (scan only PR changes, not the whole repo)
• GitHub Actions workflow to post scan results as PR comments
• OWASP ZAP wrapper script for DAST
• Trivy integration for deeper SCA
• Baseline suppression for npm/NuGet dependency findings (currently only secrets/SAST findings are baseline-aware)

Adding Security Code Scan (.NET, per-project)

This one can't be run from outside a project since it's a Roslyn build-time analyzer, not a CLI tool:

cd your-dotnet-project
dotnet add package SecurityCodeScan.VS2019

Tuning for less noise

Edit configs/bandit.yaml, configs/.eslintrc.json, or configs/semgrep-rules.yml directly and commit changes so the whole team's scans stay in sync.

License

MIT — see LICENSE. Note this project bundles configuration only; the underlying tools listed above retain their own licenses (mostly MIT/Apache-2.0/GPL — check each project if you plan to redistribute).

Contributing

Issues and PRs welcome, especially additional Semgrep rules for EF Core/Syncfusion/Angular patterns not yet covered, or fixes to the baseline-matching logic in generate_report.py.