Self-hosted, enterprise-grade security and code quality scanning platform
CloudScan is a free, open-source alternative to expensive commercial security scanning tools (SonarQube Enterprise, Snyk, Checkmarx). It provides:
- ✅ Multiple scan types: SAST, SCA, Secrets Detection, License Compliance
- ✅ Beautiful web UI with real-time progress updates
- ✅ Self-hosted on your Kubernetes cluster (full data privacy)
- ✅ Multi-tenant architecture for organizations
- ✅ Easy deployment via Helm chart (5-minute setup)
- ✅ Extensible plugin architecture for custom scanners
Cost Comparison:
- SonarQube Enterprise: $150,000+/year
- Snyk Enterprise: $50,000+/year
- Checkmarx: $100,000+/year
- CloudScan: FREE ✨
CloudScan is built as a distributed microservices platform:
┌──────────────────────────────────────────────────────────────┐
│ React UI │
│ (Upload, View Results) │
└────┬─────────────────────────┬──────────────────────────┬────┘
│ │ │
│ 1. Create scan │ 2. Upload source │ 3. Watch logs
▼ ▼ ▼
┌──────────────┐ ┌─────────────────┐ ┌──────────────────┐
│ API Gateway │ │ Storage Service │ │ WebSocket Service│
│ (REST/gRPC) │ │ (gRPC) │ │ (Live updates) │
└──────┬───────┘ └────────┬────────┘ └────────┬─────────┘
│ │ │
│ CreateScan(artifact_id)│ │
▼ │ │
┌────────────────────┐ │ │
│ Orchestrator │ │ │
│ - Scan mgmt │◄────────┘ │
│ - K8s dispatcher │ GetArtifact(presigned URL) │
│ - gRPC APIs │ │
└──────┬─────────────┘ │
│ │
│ 4. Create K8s Job │
│ with SOURCE_DOWNLOAD_URL │
▼ │
┌─────────────────────┐ │
│ Kubernetes Cluster │ │
│ │ │
│ ┌───────────────┐ │ │
│ │ Runner Pod │ │ │
│ │ │ │ 5. Stream logs │
│ │ - Semgrep │──┼─────────────────────────────────┘
│ │ - Trivy │ │
│ │ - TruffleHog │ │
│ │ - ScanCode │ │
│ └───────┬───────┘ │
└──────────┼──────────┘
│
│ 6. Download source (presigned URL)
▼
┌─────────────────────┐
│ S3/MinIO/GCS │
│ Object Storage │
│ - Source code │
│ - Scan artifacts │
└─────────────────────┘
│
│ 7. CreateFindings(gRPC)
│ UpdateScan(gRPC)
▼
┌──────────────┐
│ PostgreSQL │
│ - Scans │
│ - Findings │
│ - Artifacts │
└──────────────┘
Services:
- cloudscan-ui: React frontend with real-time updates
- cloudscan-api-gateway: HTTP gateway with authentication
- cloudscan-orchestrator: Core service (job management, K8s dispatcher)
- cloudscan-storage: Multi-cloud storage abstraction (S3/GCS/Azure)
- cloudscan-websocket: Real-time log streaming
- cloudscan-runner: Scanner executors (runs in K8s Jobs)
- Kubernetes cluster (v1.28+)
- Helm 3.x
- kubectl configured
# Add Helm repository
helm repo add cloudscan https://charts.cloudscan.dev
helm repo update
# Install CloudScan
helm install cloudscan cloudscan/cloudscan \
--namespace cloudscan \
--create-namespace \
--set postgresql.enabled=true \
--set storage.type=s3 \
--set storage.s3.bucket=my-scans-bucket \
--set ingress.enabled=true \
--set ingress.hosts[0].host=cloudscan.mycompany.comNavigate to: https://cloudscan.mycompany.com
Create your account and start scanning! 🎉
cloudscan/
├── cloudscan-orchestrator/ # Core orchestration service (Go)
├── cloudscan-ui/ # React frontend
├── cloudscan-storage/ # Storage service (Go)
├── cloudscan-api-gateway/ # API gateway (Go)
├── cloudscan-websocket/ # WebSocket service (Go)
├── cloudscan-runner/ # Scanner runner (Go)
├── protobuf/ # Shared protobuf definitions
├── shared/ # Shared Go libraries
├── charts/ # Helm charts
├── docs/ # Documentation
└── scripts/ # Build and deployment scripts
See individual service READMEs for development setup:
| Type | Tool | What it Scans |
|---|---|---|
| SAST | Semgrep | Security vulnerabilities in code (SQL injection, XSS, etc.) |
| SCA | Trivy | Vulnerable dependencies (CVEs in npm, pip, maven, etc.) |
| Secrets | TruffleHog | API keys, passwords, tokens leaked in code |
| License | ScanCode | Open-source license compliance |
- Startups: Free alternative to expensive commercial tools
- Enterprises: Self-hosted solution for compliance (GDPR, HIPAA, SOC2)
- Open Source Projects: Public scanning with badges
- Educational: Teaching secure coding practices
We welcome contributions! See CONTRIBUTING.md for guidelines.
Ways to contribute:
- 🐛 Report bugs
- 💡 Suggest features
- 📝 Improve documentation
- 🔧 Submit pull requests
- 🌟 Star the repo!
Apache 2.0 - see LICENSE
CloudScan leverages these amazing open-source tools:
- Documentation: https://docs.cloudscan.dev
- Community Discord: https://discord.gg/cloudscan
- GitHub Issues: https://github.com/cloudscan/cloudscan/issues
- Email: support@cloudscan.dev
Made with ❤️ by developers, for developers