isitsecure
A command-line security scanner for web applications that combines static analysis, dynamic testing against a running app, and LLM-based code review in one scan, aimed at developers who are not security specialists.
isitsecure runs 42 rule-based scanners by default, up to 45 at its deepest setting, against a web application's source code and, optionally, its running instance. It combines static analysis of the source, dynamic testing that sends real HTTP requests to a live app, and an LLM code review pass that looks for business-logic flaws pattern-based scanners miss.
A finding from the static scan can generate a targeted dynamic test automatically; for example, code with no visible auth check triggers an unauthenticated request that confirms whether the gap is exploitable. Cross-referenced findings feed an LLM triage step, and the tool can generate unified-diff patches for each finding.
It supports TypeScript/JavaScript, Python, Java/Kotlin and Go web frameworks, and any HTTP API for the dynamic scanner. Output includes a graded report, a browsable HTML page, and a suppression mechanism for false positives; an LSP-based check also validates findings before they are reported.