Repo Security Score

Local-first CLI that scans any codebase, rates security from 0-100, and generates shields.io badges — fully offline, zero cloud dependency.

What is it?

Repo Security Score scans your code for security vulnerabilities across 7 programming languages, calculates a security score from 0 to 100, and generates a shields.io badge you can paste into your README. No cloud, no API keys, no telemetry — everything runs on your machine.

Why?

Every developer wants to know: "Is my code secure?" — but existing tools give you walls of text. We give you a number and a badge. Share your score, compete with friends, keep improving.

Features

• 0-100 Security Score with letter grades (A+ to F)
• Shields.io Badge — paste into any README
• 7 Languages: Go, JavaScript/TypeScript, Python, Java, PHP, Ruby, C/C++
• 25 Detection Rules: Hardcoded Secrets, Command Injection, SQL Injection, Path Traversal, SSRF, XSS, Weak Crypto, Insecure Random, Unsafe Deserialization, and more
• JSON Export for CI/CD integration
• Severity Filtering — only count findings above a threshold
• Fully Offline — zero network requests, your code never leaves your machine

Quick Start

Prerequisites

• Go 1.23+ installed

Install

git clone https://github.com/AetherCodeHQ/Repo-Security-Score.git
cd Repo-Security-Score
go build -o reposcore.exe .

Run

Basic scan:

.
eposcore score --path ./your-project

With JSON report:

.
eposcore score --path ./your-project --format json

Generate a badge:

.
eposcore score --path ./your-project --format badge

Filter by severity:

.
eposcore score --path ./your-project --min-severity critical

Output

Scanning: C:/Users/you/my-project

  Security Score: 87/100 [B]

  Found 3 vulnerabilities:
    CRITICAL: 1
    HIGH:     2

  C:/Users/you/my-project/main.go:15 [CRITICAL] CommandInjection
    exec.Command("sh", "-c", input)
  C:/Users/you/my-project/db.go:23 [HIGH] SQLInjection
    query := "SELECT * FROM users WHERE id=" + userId
  C:/Users/you/my-project/utils.go:8 [HIGH] HardcodedSecret
    apiKey := "sk-1234567890"

![Security Score](https://img.shields.io/badge/security-87%2F100%20B-brightgreen)

Badge

After scanning, you'll get a badge like this:

Copy the markdown line and paste it into your README:

![Security Score](https://img.shields.io/badge/security-87%2F100%20B-brightgreen)

Badge Colors

Score Range	Color	Grade
95-100	Green	A+
90-94	Green	A
80-89	Yellow	B
70-79	Orange	C
60-69	Orange	D
0-59	Red	F

Scoring System

Score starts at 100 and deductions are applied per finding:

Severity	Deduction
CRITICAL	-25 pts
HIGH	-15 pts
MEDIUM	-5 pts
LOW	-2 pts

Minimum score is 0.

CLI Flags

reposcore score [path]

Flags:
  --path string           Target directory to scan (default ".")
  --format string         Export format: json, badge
  --min-severity string   Only count findings at this level (low, medium, high, critical)
  --output string         Output filename for reports (default "reposcore-report")
  --config string         Path to configuration file

Supported Languages

Language	Extensions
Go	.go
JavaScript	.js, .jsx
TypeScript	.ts, .tsx
Python	.py
Java	.java
PHP	.php
Ruby	.rb
C/C++	.c, .h, .cpp, .hpp, .cc

How It Works

1. Scan — walks the target directory, applies 25 detection rules per language
2. Score — starts at 100, deducts points per severity level
3. Report — colored terminal output + optional JSON/badge export
4. Badge — generates shields.io markdown ready to paste

Development

# Run tests
go test ./...

# Build
go build -o reposcore .

# Self-scan (dogfooding)
./reposcore score .

License

This project is licensed under the MIT License - see the LICENSE file for details.