Scout: the self-hosted vulnerability scanner for developers

v0.3.0Reachable-CVE scanning, IDOR detection, and more coverage

The self-hosted scannerfor your apps and repos

Point Scout at a running app or a code repository. It maps the attack surface, finds the ways in — missing headers, exposed files, injection, weak auth, vulnerable dependencies — then grades the result and tells you exactly how to fix it.

Start scanningView on GitHub

go installgo runfrom sourceAI prompt

go install github.com/MUKE-coder/scout/cmd/scout@latest

go run github.com/MUKE-coder/scout/cmd/scout@latest scan --target http://localhost:3000

git clone https://github.com/MUKE-coder/scout && cd scout && go build ./cmd/scout

Paste this into Claude, Cursor, Codex or any coding agent →Copy prompt

Your first scan

scout scan --target http://localhost:3000Black-box scan of a running app

scout scan --repo .Source & supply-chain scan of a repo

scout ci --fail-on highGate a pull request on findings

scout serveDashboard + scheduled scans

Black-box & source, one tool

Scan a running URL for live weaknesses, and a repo for secrets, supply-chain CVEs and insecure code — from the same binary.

Safe by default

Modes are capped by the environment. Active scans of a public host require a published ownership token. No destructive payloads.

Built for CI

One command fails the build on findings at or above a severity, with SARIF for code scanning and a graded terminal report.

Self-hosted, no account

A single Go binary. Nothing leaves your machine. Scan history in local SQLite, an embedded dashboard, scheduled scans.

What it catches

• Missing security headers & cookie flags
• Exposed .env / .git / backups / metrics
• Reflected XSS, open redirect, CSRF forms
• SQL injection & OS command injection
• Weak JWTs, permissive CORS, IDOR
• Reachable Go CVEs in dependencies
• Hard-coded secrets & insecure Dockerfiles
• Version disclosure, directory listings, mixed content

See the full checks catalog, or try them all against the deliberately-vulnerable lab app.

Build with AI

Copy a brief that teaches your coding agent how Scout works — the modes, the CLI, how to scan an app or a repo, and how to gate CI. Paste it in and let it wire Scout into your project.

Copy prompt