View on GitLab

Deep code security scanning
built for developers

One CLI combining lightning-fast pattern matching with graph-aware analysis. Surface high-signal vulnerabilities with minimal noise, ready for any CI pipeline.

Get started → Source on GitLab
1,407 / 1,415
Bugs found on OWASP Benchmark
2 Engines
OpenGrep + Fraunhofer CPG
CI-Ready
JSON · SARIF · HTML reports

Features developers actually use

No bloated enterprise platforms or mandatory servers. Just a high-performance CLI built to fit seamlessly into your existing workflow.

⚡

Fast + Deep in One Run

OpenGrep executes rapid pattern matching while Fraunhofer CPG builds program graphs to trace complete data flows. Get both capabilities simultaneously.

🧠

Graph-Aware Analysis

Comprehends how data propagates throughout your codebase, identifying complex vulnerabilities that surface-level text grepping completely misses.

🎯

High Signal Accuracy

Successfully detects 1,407 out of 1,415 real bugs on the official OWASP Benchmark — matching the exact test parameters and answer keys.

📦

CI-Native Exports

Generate JSON, SARIF, and HTML reports out of the box. Drop it directly into GitLab CI, GitHub Actions, or Forgejo pipelines.

🔒

OWASP, CWE & Privacy

Comprehensive rule sets covering the OWASP Top 10, CWE Top 25, and sensitive data flow paths. Toggle privacy filters when strict security is required.

🚀

Zero Infrastructure

No remote servers to configure or maintain. No complex compilation steps required for most languages. Point it at your source code and execute.

Why developers choose BetterScan

Engineered specifically for engineers who write and review code daily.

✓
Catch critical issues earlier in the cycle Pattern matching finds surface flaws, while graph execution follows data lineage. Combined, they ensure complete coverage.
✓
Keep alert fatigue under control Intelligent deduplication across engines. Filter findings by file paths or strict matching to focus review time on actual threats.
✓
Fits your existing toolchain Distributed as a single lightweight binary with simple intuitive flags. Runs seamlessly locally or inside containerized CI runners.
✓
Fully transparent and inspectable Powered by trusted open-source engines under the hood. You can audit precisely which rules executed and why vulnerabilities were flagged.
✓
Optimized for speed on every PR Leverages parallel execution strategies by default. Choose fast feedback loops or deep comprehensive scans when deep security audits matter.

How it works

Three straightforward steps from installation to actionable vulnerability reports.

Install Instantly

Run the single-line installer or compile directly from source. No persistent daemons or centralized license servers required.

Scan Your Codebase

Target any local directory. Customize engines, rulesets, and report formats using clear command-line options.

Review Unified Findings

Results are automatically merged and deduplicated. Export standard SARIF to integrate feedback directly into your IDE or CI runner.

Get started in seconds

Install the CLI tool and execute your first security scan.

terminal
# Install BetterScan CLI curl -fsSL https://gitlab.com/marcinboi/betterscan/-/raw/main/scripts/install.sh | sh # Scan current directory (OpenGrep + CPG, parallel execution) betterscan --code-dir . --strategy parallel --jobs 8 # Run fast pattern-matching lane only betterscan --tools opengrep --code-dir . # Generate multi-format reports for CI/CD pipelines betterscan --code-dir . --json-out results.json --sarif-out results.sarif --html-out results.html

Explore complete flags and configuration guides → CLI Reference

Ready to scan deeper?

Start with the open-source CLI. Execute it on your next pull request and experience combined multi-engine security analysis.

View project on GitLab Install now