OWASP/DockSec

AI-powered Docker security scanner that explains vulnerabilities in plain English. An OWASP Lab Project.

What it solves

DockSec is an AI-powered security scanner for Docker environments that simplifies the process of fixing vulnerabilities. It bridges the gap between raw, complex security scan results (which often contain hundreds of CVEs) and actionable developer fixes by providing context-aware analysis and plain-English explanations.

How it works

DockSec uses a four-stage pipeline to secure containers:

  1. Scan: It orchestrates local industry-standard scanners including Trivy, Hadolint, and Docker Scout.
  2. Analyze: AI correlates the findings across these scanners to remove noise and assess the actual real-world impact on the specific container setup.
  3. Recommend: The AI generates human-readable explanations and specific remediation steps for the Dockerfile.
  4. Report: Results are exported into various formats including HTML, PDF, JSON, CSV, SARIF, and CycloneDX SBOMs.

Who it’s for

Developers and security teams who need to secure their Docker images and Compose files without being overwhelmed by security jargon or massive lists of vulnerabilities.

Highlights

  • Multi-LLM Support: Compatible with OpenAI, Anthropic Claude, Google Gemini, and local models via Ollama.
  • Privacy-Centric: Scans run locally; only redacted file content is sent to AI providers, with a fully offline mode available.
  • CI/CD Integration: Includes exit codes for build gating, SARIF output for GitHub Code Scanning, and a baseline/ratchet mode to prevent new vulnerabilities from entering a project.
  • AI-Assistant Integration: The install-skill command provides usage instructions for AI coding assistants like Claude Code, Cursor, and GitHub Copilot.
  • Detailed Reporting: Generates interactive HTML reports and spec-compliant CycloneDX SBOMs.

Related

  • Project
    vercel-labs/deepsec

    An agent-powered vulnerability scanner for large-scale repositories that uses AI to find and verify deep-seated security issues.

  • Project
    Unclecheng-li/DeepSec

    An AI security platform combining a three-layer code auditing system (Shield) and an automated, authorized penetration testing engine (Spear).

  • Project
    openai/codex-security

    A CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in code using LLM-powered scanning.

  • Project
    asamassekou10/ship-safe

    An AI security scanner that detects vulnerabilities in application code, AI agents, and supply chains, specifically targeting risks like prompt injection and agent hijacking.

  • Project
    openhackai/OpenHack

    OpenHack is an open‑source, LLM‑driven security scanner that analyses a codebase through a recon‑→‑hunter‑→‑validator‑→‑verifier pipeline, presenting findings in an interactive terminal UI and optionally verifying exploits in Docker.