jmogaming/jmo-security repository overview

⁠JMo Security Audit Tool Suite

A terminal-first, cross-platform security audit toolkit that orchestrates multiple scanners (secrets, SAST, SBOM, IaC, Dockerfile, DAST) with a unified Python CLI, normalized outputs, and an HTML dashboard.

⁠Quick Start

# Run full security scan on current directory
docker run --rm -v "$(pwd):/scan" ghcr.io/jimmy058910/jmo-security:latest \
  scan --repo /scan --results-dir /scan/results

# Interactive wizard (easiest for beginners)
docker run --rm -it -v "$(pwd):/scan" ghcr.io/jimmy058910/jmo-security:latest \
  wizard

# View results
open results/summaries/dashboard.html

⁠Image Variants

⁠Features

• 🎯 Multi-Target Scanning: Repos, containers, IaC, URLs, Kubernetes, GitLab
• 🔐 28 Security Tools (25 Docker-ready + 3 manual): Secrets (TruffleHog, Nosey Parker, Semgrep-Secrets), SAST (Semgrep, Bandit, Gosec, Horusec), SBOM (Syft, CDXgen, ScanCode), SCA (Trivy, Grype, Dependency-Check), IaC (Checkov, Checkov-CICD), Cloud (Prowler, Kubescape), DAST (ZAP, Nuclei, Akto*), Dockerfile (Hadolint), OPA (Policy), Mobile (MobSF*), Malware (YARA), System (Lynis), Runtime (Trivy-RBAC, Falco), Fuzzing (AFL++*) |*Manual install required
• 📊 Unified Reporting: JSON, Markdown, HTML dashboard, SARIF, YAML, compliance reports
• ⚡ Parallel Execution: Scan multiple targets simultaneously with auto-detected CPU threads
• 🎨 4 Docker Variants: Fast (9 tools, 5-10 min), Balanced (17 tools, 18-25 min), Slim (13 tools, cloud-focused), Deep (28 tools, 40-70 min)
• 📈 Real-Time Progress: Live scan progress with ETA estimation

⁠What's New in v1.0.0 (February 2026)

• Unified Profile System: 4 profiles (fast/slim/balanced/deep) with matching Docker variants
• SQLite Historical Storage: Track findings over time with jmo history and jmo trends
• Machine-Readable Diffs: Compare scans with jmo diff for CI/CD integration
• 28 Security Tools: Expanded from 11 to 28 tools across all profiles
• Tool Management: jmo tools install/check/update/outdated commands
• Enhanced Deduplication: 30-40% noise reduction with cross-tool similarity clustering

⁠Multi-Target Scanning

Scan repositories AND infrastructure in one unified workflow:

# Comprehensive security audit in one command
docker run --rm -v "$(pwd):/scan" ghcr.io/jimmy058910/jmo-security:latest \
  scan \
    --repo /scan/myapp \
    --image myapp:latest \
    --url https://myapp.com \
    --k8s-context prod \
    --results-dir /scan/results

⁠Documentation

• 📚 Full Documentation: GitHub Repository⁠
• 🚀 Quick Start Guide: QUICKSTART.md⁠
• 📖 User Guide: USER_GUIDE.md⁠
• 🐳 Docker Guide: DOCKER_README.md⁠
• 🌐 Project Homepage: jmotools.com⁠

⁠Newsletter & Support

📬 Subscribe to Newsletter⁠ - Get security tips and updates:

• 🚀 New feature announcements
• 💡 Real-world security case studies & exclusive guides

💚 Support Full-Time Development⁠ - Help build security tools accessible to everyone

⁠CI/CD Integration

# GitHub Actions example
- name: Security Scan
  run: |
    docker run --rm -v "${{ github.workspace }}:/scan" \
      ghcr.io/jimmy058910/jmo-security:slim \
      scan --repo /scan --fail-on HIGH --results-dir /scan/results

⁠License

MIT OR Apache-2.0 - See LICENSE⁠

⁠Links

• GitHub: jimmy058910/jmo-security-repo⁠
• PyPI: jmo-security⁠
• Website: jmotools.com⁠
• Issues: GitHub Issues⁠
• Changelog: CHANGELOG.md⁠