Horusec: Open-Source Static Application Security Testing for Everyone

In this technical briefing at the DEF CON 30 Blue Team Village, Gilmar Esteves and Filipi Pires introduce Horusec, an open-source multi-language Static Application Security Testing (SAST) platform designed to democratize automated code security analysis. At 03:00, they demonstrate how Horusec parses source code repositories, displaying flagged vulnerabilities with precise file names, line numbers, and severity ratings.

The speakers walk through a practical demonstration environment at 06:00, scanning sample codebases to showcase detection capabilities for SQL injection, cross-site scripting, and hardcoded secrets across multiple languages at 09:00. At 12:00, they showcase the Horusec IDE plugin for Visual Studio Code, highlighting how developers receive real-time security alerts directly in their editor as they write code.

Diving into vulnerability triage at 15:00, they show how Horusec provides contextual remediation advice, CWE links, and false-positive filtering. At 18:00, they illustrate integrating Horusec into automated CI/CD deployment pipelines using lightweight CLI commands and quality gates to block insecure builds before production. They wrap up at 21:00 with project roadmap milestones and an invitation to join the open-source developer community. (AI summary — Gemini Flash)