SmartSecureAnalyzer 1.0.4

🛡️ SmartSecureAnalyzer

SmartSecureAnalyzer is a powerful static code analysis tool built in C# (.NET) and PowerShell designed to detect insecure coding patterns, hardcoded credentials, and common security vulnerabilities in source code across multiple languages.

It’s designed for DevSecOps pipelines, CI/CD integrations, and local developer validation — providing actionable insights before your code reaches production.

🚀 Features

• 🔍 Detects common insecure patterns (e.g., eval(), weak hashing, hardcoded secrets, insecure file paths).
• 🧩 Supports multi-language scanning (C#, JavaScript, Python, PHP, etc.).
• 🧠 Regex-based pattern scanning + Roslyn analysis for .NET projects.
• ⚙️ Integration-friendly PowerShell script for CI/CD (Jenkins, GitHub Actions, Azure DevOps).
• 📊 Generates summary reports with counts, severity, and recommendations.
• 🧾 Optional build failure flag for critical vulnerabilities.

🏗️ Architecture Overview

SmartSecureAnalyzer/
│
├── analyzer/
│   ├── SmartSecureAnalyzer.csproj        # Core analyzer library
│   ├── Analyzers/
│   │   ├── HardcodedSecretAnalyzer.cs
│   │   ├── InsecureHashAnalyzer.cs
│   │   ├── UnsafeEvalAnalyzer.cs
│   │   └── FilePermissionAnalyzer.cs
│   └── Reports/
│       ├── SecurityReportGenerator.cs
│       └── ReportTemplates/
│
├── scripts/
│   └── RunSmartSecureAnalyzer.ps1        # PowerShell runner for CI/CD
│
├── SmartSecureAnalyzer.nuspec            # NuGet metadata (optional)
└── README.md

💡 Installation

Option 1: Local Development

git clone https://github.com/your-org/SmartSecureAnalyzer.git
cd SmartSecureAnalyzer
dotnet build

Option 2: NuGet (when published)

dotnet add package SmartSecureAnalyzer

Option 3: PowerShell Script Execution

Set-ExecutionPolicy RemoteSigned -Scope Process
.\scripts\RunSmartSecureAnalyzer.ps1 -Path "D:\MyProject" -Output "D:\Reports"

⚙️ PowerShell Script Parameters

📄 Example Output

Console Output

[INFO] Scanning D:\MyApp ...
[WARN] Hardcoded password found in Config.cs:42
[CRITICAL] Insecure MD5 usage in HashHelper.cs:17
[INFO] Scan completed: 5 issues found (2 High, 2 Medium, 1 Low)

Generated Report (JSON & HTML)

{
  "Summary": {
    "FilesScanned": 120,
    "IssuesFound": 5,
    "Critical": 2,
    "Medium": 2,
    "Low": 1
  },
  "Findings": [
    {
      "Type": "Hardcoded Secret",
      "File": "Config.cs",
      "Line": 42,
      "Severity": "High",
      "Recommendation": "Use environment variables or secure vaults."
    }
  ]
}

🔐 OWASP A1–A10 Detection (Next Release)

SmartSecureAnalyzer roadmap includes detecting vulnerabilities based on the OWASP Top 10:

🧩 Planned Enhancements

✅ Detect OWASP A1–A10 patterns — SQL Injection, hardcoded secrets, insecure deserialization, etc.
✅ Integrate SonarQube or Semgrep CLI inside build hooks for hybrid scanning.
✅ Add Roslyn Code Fix Providers — automatically suggest secure alternatives in Visual Studio.
✅ Generate Security Reports at Build Time in HTML, CSV, and JSON formats.
✅ Git Pre-Commit Hook Support — prevent insecure commits.
✅ Central Dashboard — visualize vulnerabilities across projects.

🧰 Example: Integrating in Jenkins

stage('Security Scan') {
    steps {
        powershell '''
        Set-ExecutionPolicy RemoteSigned -Scope Process
        .\scripts\RunSmartSecureAnalyzer.ps1 -Path "D:\MyProject" -Output "D:\Reports" -FailOnCritical $true
        '''
    }
}

📦 Output Reports

🧑‍💻 Contributing

1. Fork this repository
2. Create your feature branch (git checkout -b feature/owasp-scan)
3. Commit your changes (git commit -m 'Add OWASP pattern detection')
4. Push to the branch (git push origin feature/owasp-scan)
5. Open a Pull Request 🚀

🧾 License

This project is licensed under the MIT License — feel free to use and modify.

📧 Contact

Author: Rejith Kumar
Email: rejithsham296@outlook.com
NuGet ID: SmartSecureAnalyzer
Website: https://hashtagtrnd.com

💬 SmartSecureAnalyzer — because secure code is smart code.