View on Codeberg

Deep code security scanning
built for developers

One CLI that runs fast pattern matching and graph-aware analysis together. More real bugs found. Less noise. Ready for your pipeline.

Get started → Source on Codeberg
1,407 / 1,415
bugs found on OWASP Benchmark
2 engines
OpenGrep + Fraunhofer CPG
CI-ready
JSON · SARIF · HTML

Features developers actually use

No bloated platform. No mandatory server. Just a focused CLI that fits into your existing workflow.

⚡

Fast + Deep in one run

OpenGrep handles the quick pattern pass. Fraunhofer CPG builds a real program graph and follows data flow. You get both without choosing.

🧠

Graph-aware analysis

Understands how data actually moves through your code. Better at catching issues that pure grepping misses.

🎯

High signal on real benchmarks

1,407 of 1,415 real bugs found on the official OWASP Benchmark — same tests, same machine, same answer key.

📦

CI-native outputs

JSON, SARIF and HTML reports out of the box. Drop it into GitHub Actions, GitLab CI, Forgejo or any pipeline.

🔒

OWASP + CWE + privacy

Rules covering the OWASP Top 10, CWE Top 25 and personal-data flows. Toggle privacy rules when you need pure security signal.

🚀

Zero infrastructure

No server to stand up. No compile step required for most languages. Point it at your source and go.

Why developers choose BetterScan

Built for people who write and review code every day.

✓
Catch more real issues earlier Pattern matching finds the obvious ones. Graph analysis finds the ones that only appear when you follow the data. Together they cover more ground.
✓
Keep noise under control Dedupe across engines. Scope findings by file or strict matching. Focus review time on what actually matters.
✓
Fits the way you already work Single binary. Simple flags. Outputs your tools already understand. Runs locally or in CI without extra services.
✓
Transparent and inspectable Open source engines under the hood. You can see exactly what rules ran and why a finding was reported.
✓
Fast enough for every PR Parallel strategy by default. Use the fast lane for quick feedback or the full deep pass when coverage matters.

How it works

Three simple steps from install to actionable findings.

Install once

One-line installer or build from source. No global daemons or config servers.

Point at your code

Run against any directory. Choose engines, rules and output formats with clear flags.

Review unified results

Findings are merged and deduplicated. Export to SARIF for your IDE or CI annotations.

Get started in seconds

Install the CLI and scan your first project.

# Install
curl -fsSL https://codeberg.org/betterscan-io/betterscan/raw/branch/main/scripts/install.sh | sh

# Scan current directory (OpenGrep + CPG, parallel)
betterscan --code-dir . --strategy parallel --jobs 8

# Fast lane only
betterscan --tools opengrep --code-dir .

# Full outputs for CI
betterscan --code-dir . --json-out results.json --sarif-out results.sarif --html-out results.html

Full flags and engine details → CLI reference

Ready to scan deeper?

Start with the free CLI. Run it on your next pull request and see what the combined engines find.

View project & docs Install now