Case study
Segrep
A developer security platform that bundles six core vulnerability scanners (Trivy, Semgrep, Gitleaks, Checkov, Syft, and OSV/GHSA dependency scanning) into a single Docker image — with SARIF export, policy-as-code, and CI gating.
Problem
Shipping secure software usually means wiring half a dozen scanners — each with its own CLI, output format, and CI recipe. Teams burn time on glue code instead of triage, and findings never land in one place that GitHub or the pipeline can act on.
Approach
Built Segrep as a unified developer security stack: one Docker image (`ghcr.io/szaranger/security-scanner`) that runs six core repo scanners — deps-cves (OSV/GHSA), Trivy, Semgrep, Gitleaks, Checkov, and Syft — with SARIF export, policy-as-code, and `--fail-on` CI gating. Opt-in paths cover DAST, Kubernetes manifests, and AWS accounts. A Next.js marketing/docs site plus a hosted dashboard at app.segrep.com support local, CI, and team workflows.
Outcome
Live at segrep.com with a one-command Docker scan path, documentation for CI integration, and a dashboard for teams who want trends beyond a single SARIF file. A product showcase of packaging security tooling for developers instead of security specialists alone.
- Single image, six scanners: dependencies, SAST, secrets, IaC, SBOM, and OSV/GHSA in one `docker run`
- SARIF + policy-as-code + fail-on severity so results plug into existing GitHub/CI review loops
- Split surface: CLI/Docker for individuals, app.segrep.com for team dashboards and trends