Security scanner for Capacitor apps - detect vulnerabilities, hardcoded secrets, and security misconfigurations
npm install @capgo/capacitor-sec
Zero-config security scanner for Capacitor and Ionic apps. Detect vulnerabilities, hardcoded secrets, and security misconfigurations with a single command.
š Website: capacitor-sec.dev
- š Zero Configuration - Works out of the box with any Capacitor/Ionic project
- š Local Processing - Your code never leaves your machine
- š± Platform-Specific - Android and iOS security checks
- š Secret Detection - Detects 30+ types of API keys and secrets
- ā” Fast - Scans 1000+ files in seconds
- š Multiple Outputs - CLI, JSON, and HTML reports
- š CI/CD Ready - GitHub Actions, GitLab CI support
``bashRun directly with bunx (no installation needed)
bunx capsec scan
Security Rules
Capsec includes 63+ security rules across 13 categories:
| Category | Rules | Description |
|----------|-------|-------------|
| š Secrets | 2 | API keys, tokens, credentials |
| š¾ Storage | 6 | Preferences, localStorage, SQLite |
| š Network | 8 | HTTP, SSL/TLS, WebSocket |
| ā” Capacitor | 10 | Config, plugins, native bridge |
| š¤ Android | 8 | Manifest, WebView, permissions |
| š iOS | 8 | ATS, Keychain, entitlements |
| š Authentication | 6 | JWT, OAuth, biometrics |
| š¼ļø WebView | 5 | XSS, CSP, iframe security |
| š Cryptography | 4 | Algorithms, keys, IV generation |
| š Logging | 2 | Sensitive data in logs |
| š Debug | 3 | Test credentials, dev URLs |
Usage
$3
bash
Scan current directory
capsec scanScan specific path
capsec scan ./my-capacitor-app
`$3
bash
CLI output (default)
capsec scanJSON output
capsec scan --output json --output-file report.jsonHTML report
capsec scan --output html --output-file report.html
`$3
bash
Only critical and high severity
capsec scan --severity highOnly specific categories
capsec scan --categories storage,secrets,networkExclude patterns
capsec scan --exclude "/test/,/demo/"
`$3
bash
Exit with code 1 if high/critical issues found
capsec scan --ci
`$3
bash
List all rules
capsec rulesFilter by category
capsec rules --category androidFilter by severity
capsec rules --severity critical
`CI/CD Integration
$3
yaml
name: Security Scanon: [push, pull_request]
jobs:
security:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Setup Bun
uses: oven-sh/setup-bun@v1
- name: Run Security Scan
run: bunx capsec scan --ci
`$3
yaml
security-scan:
image: oven/bun:latest
script:
- bunx capsec scan --ci
only:
- merge_requests
- main
`Configuration
Create a
file:`json
{
"exclude": [
"/node_modules/",
"/dist/"
],
"severity": "low",
"categories": [],
"rules": {}
}
`Or initialize with:
bash
capsec init
`Programmatic Usage
typescript
import { SecurityScanner } from 'capsec';const scanner = new SecurityScanner({
path: './my-app',
severity: 'medium',
categories: ['secrets', 'network']
});
const result = await scanner.scan();
console.log(result.summary);
``Contributions are welcome! Please read our Contributing Guide for details.
MIT License - see LICENSE for details.
- Capgo - Live updates for Capacitor apps
- Capacitor - Build cross-platform apps
- Ionic - Mobile UI framework
---
Built with ā¤ļø by the Capgo team
| Plugin version | Capacitor compatibility | Maintained |
| -------------- | ----------------------- | ---------- |
| v8.\.\ | v8.\.\ | ā
|
| v7.\.\ | v7.\.\ | On demand |
| v6.\.\ | v6.\.\ | ā |
| v5.\.\ | v5.\.\ | ā |
> Note: The major version of this plugin follows the major version of Capacitor. Use the version that matches your Capacitor installation (e.g., plugin v8 for Capacitor 8). Only the latest major version is actively maintained.