ASH v3.7.0

Automated Security Helper

Scan code, infrastructure, secrets, and dependencies.

Start scanning Documentation

$ash --mode container

Open source · Apache 2.0

Scan example

Reports ready

All files Replay

Files 01

Codeapp.py Infrastructuretemplate.yaml Secrets.env Dependenciespackage-lock.json

Scanners 02

BanditSemgrep

CheckovCFN-Nag

detect-secrets

npm auditSyft + Grype

Findings 03

High Shell command

High Public ingress

High Embedded credential

Medium Package vulnerability

Coverage recorded

Aggregated results

01Files 02Scanners 03Findings 04Reports

Reports

HTML SARIF Markdown JSON

Example data · Scanner coverage depends on configuration.

AWS Labs Scan workflow ASH v3.7.0

Built-in scanners

Bandit Semgrep Checkov detect-secrets Grype Syft All scanners

Scan workflow

Scanning

Built-in scanners

Enabled scanners run through one command.

Code Infrastructure Secrets Dependencies

Results

Report formats

Filter findings by severity, scanner, or suppression status.

SARIFHTMLJSONCSV

Settings

Configuration and plugins

Set thresholds, ignore paths, and suppression rules.

.ash/.ash.yaml

Install and scan

01

Install ASH

Use pipx, uvx, or pip with Python 3.10+.

02

Select a mode

Container, local, or pre-commit.

03

Review results

Open the HTML report or run ash inspect findings.

Full installation guide

Install ASH

pipx recommended uvx pip

# Install in an isolated environment.

$pipx install git+https://github.com/awslabs/automated-security-helper.git@v3.7.0

# From your project directory

$ash --mode container

Container Local Pre-commit

Run enabled scanners in an isolated container. Requires an OCI-compatible runtime.

Example output Replay

✓Discovering project filescomplete

✓Running security scannerscomplete

✓Aggregating findingscomplete

Reports ready in .ash/ash_output/

Scanners

Scanner reference

All tools 10 Code Infrastructure Secrets Dependencies

SAST

Bandit

Python security checks

Python

SAST

Semgrep

Pattern-based code checks

Multiple languages

SAST

Opengrep

Pattern-based code checks

Multiple languages

IaC

Checkov

Infrastructure policy checks

Terraform, Kubernetes, CloudFormation

IaC

CDK-Nag

NagPack policy checks

CloudFormation

IaC

CFN-Nag

Template security checks

CloudFormation

Secrets

detect-secrets

Secret detection

Text files

SCA

Grype

Vulnerability matching

Packages and container images

SCA

npm audit

Dependency vulnerability checks

Node.js

SBOM

Syft

Software inventory

SBOM generation

Showing all 10 scanners.

Add a scanner plugin

Integrations

$ ash --mode local

Local development

Terminal findings explorer and offline reports.

Scan

CI/CD

Exit codes, pull request comments, and report artifacts.

MCP

MCP clients

Scan tools and result access for coding assistants.

FAQ

All questions

Do I need an AWS account?

No. Core ASH scanning runs locally or in a container. An AWS account is needed only for optional integrations with services such as Security Hub or S3.

Which scan mode should I use?

Use container for a consistent environment with all scanner dependencies, local for your development machine, and precommit for a faster subset before commits. Compare execution modes.

Can I customize the rules and reports?

Set scanners, thresholds, ignore paths, and suppressions in .ash.yaml. Configuration reference.

Does ASH replace a security review?

No. Coverage depends on enabled scanners, language, file type, and configuration.

Run a scan

Install ASH Source on GitHub