OWASP/DockSec

AI-powered Docker security scanner that explains vulnerabilities in plain English. An OWASP Lab Project.

What it solves

DockSec is an AI-powered security scanner for Docker environments that simplifies the process of fixing vulnerabilities. It bridges the gap between raw security scan results (which often contain hundreds of CVEs) and actionable developer fixes by prioritizing findings, explaining them in plain English, and suggesting concrete code changes.

How it works

DockSec orchestrates a five-stage pipeline using local scanners and optional AI analysis:

  1. Scan: It runs industry-standard tools like Trivy, Hadolint, and Docker Scout locally to find image vulnerabilities and Dockerfile misconfigurations.
  2. Prioritize: Findings are ranked by severity and the Exploit Prediction Scoring System (EPSS) to identify what needs fixing first.
  3. Correlate: It detects "exploit chains" where multiple separate findings combine into a single attack path.
  4. Recommend: It generates copy-and-run fix commands and specific Dockerfile or compose changes.
  5. Report: Results are exported in various formats including HTML, PDF, JSON, CSV, Markdown, and SARIF.

AI analysis (via OpenAI, Anthropic, Google, or local Ollama models) can be enabled to provide deeper reasoning, plain-English explanations, and extended ranking of findings.

Who it’s for

Developers and security teams who need to secure their Docker containers and Docker Compose setups without being overwhelmed by security jargon or massive lists of vulnerabilities.

Highlights

  • AI-Powered Explanations: Translates complex CVEs into plain English and suggests specific fixes.
  • Context-Aware Prioritization: Uses EPSS to rank vulnerabilities by actual exploitation likelihood.
  • Exploit Chain Detection: Identifies combined attack paths rather than treating findings in isolation.
  • Privacy-First: Scans locally; secrets are automatically redacted before being sent to AI providers, and fully offline modes are available.
  • C-I/CD Ready: Provides GitHub Actions, containerized execution, and CI-friendly exit codes for build gating.

Related

  • Project
    vercel-labs/deepsec

    An agent-powered vulnerability scanner for large-scale repositories that uses AI to find and verify deep-seated security issues.

  • Project
    Unclecheng-li/DeepSec

    An AI security platform combining a three-layer code auditing system (Shield) and an automated, authorized penetration testing engine (Spear).

  • Project
    openai/codex-security

    Codex Security is an OpenAI‑backed CLI and TypeScript SDK that scans codebases for security issues, validates findings, generates patches, drafts SECURITY.md policies, and integrates with CI/CD (GitHub Actions, Docker). It supports deep parallel scans, multi‑provider LLM back‑ends, and exports results in SARIF/JSON/CSV.

  • Project
    lintsinghua/DeepAudit

    DeepAudit is an open‑source, multi‑agent AI security auditor that analyses code, generates and sandbox‑executes PoC exploits, and outputs professional reports. It runs via Docker, supports local LLMs, and aims to reduce false positives and verify vulnerabilities automatically.

  • Project
    openhackai/OpenHack

    OpenHack is an open‑source, LLM‑driven security scanner that analyses a codebase through a recon‑→‑hunter‑→‑validator‑→‑verifier pipeline, presenting findings in an interactive terminal UI and optionally verifying exploits in Docker.