Insider is a CLI-based Static Application Security Testing (SAST) engine that analyzes source code to detect vulnerabilities aligned with the OWASP Top 10, seamlessly integrating into DevOps pipelines.
Static Application Security Testing (SAST) engine focused on covering the OWASP Top 10, to make source code analysis to find vulnerabilities right in the source code, focused on a agile and easy to implement software inside your DevOps pipeline. Support the following technologies: Java (Maven and Android), Kotlin (Android), Swift (iOS), .NET Full Framework, C#, and Javascript (Node.js).
This tool is designed for developers and security teams who want to automate vulnerability detection directly within their source code during the development lifecycle. It is especially useful for organizations aiming to embed security checks into their DevOps pipelines for technologies like Java, Kotlin, Swift, .NET, C#, and JavaScript. Insider helps identify security issues early to reduce risks before deployment.
For best results, integrate Insider into your CI/CD pipeline using the provided GitHub Action for automated, frictionless security scanning. Adjust the security threshold parameter to fit your project's risk tolerance. Excluding irrelevant directories like node_modules or test files can improve scan performance and reduce noise in reports.
Download precompiled binaries for your OS from the GitHub releases page
Extract the downloaded archive (e.g., tar -xf insider_2.1.0_linux_x86_64.tar.gz)
Make the binary executable (chmod +x insider)
Optionally, build from source if preferred
Use Docker by running the insidersec/insider container and mounting your project directoryinsider -tech javascript -target <directory>
Run JavaScript code analysis on the specified directory
insider -tech android -target <directory> -no-html -no-json
Run Android analysis on the specified directory without generating HTML or JSON reports
insider -tech java -target <directory> -security 20
Run Java analysis with a base security threshold of 20 to fail the scan if vulnerabilities exceed this level
insider -tech javascript -target <directory> -exclude tests/* -exclude node_modules/*
Run JavaScript analysis excluding the tests and node_modules directories
docker run --rm -v $(pwd):/target-project insidersec/insider -tech <tech> -target /target-project
Run Insider inside a Docker container analyzing the mounted project directory