Horusec review
A free, self-hosted SAST tool for multilingual code and secret scanning.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Horusec is an open-source static application security testing tool from ZupIT for developers and DevSecOps teams. It analyzes source code across 18 listed programming languages and configuration formats, identifies security flaws and exposed secrets, and can inspect Git history. Its free model and Apache License 2.0 distribution make it a fit for open-source teams that want self-hosted scanning rather than a paid hosted service. Horusec supports macOS, Linux, Windows, and a Chrome extension, with source analysis as its primary target.
The feature set covers several stages of a development workflow. Teams can run analysis through the command-line interface, adjust scans with CLI options, execute the tool through Docker, and use the Visual Studio Code extension during development. CI/CD pipeline usage supports automated checks, while the optional web application provides vulnerability dashboards and management. The published capabilities also include SCA, alongside static source analysis, giving teams broader application security coverage than a code-only workflow. These options make Horusec more suitable for teams comfortable integrating security checks into existing development processes than for buyers seeking a fully managed setup.
Horusec’s main trade-off is operational and long-term certainty. Self-hosted deployment provides control but places environment management on the adopting team, and verified third-party integration coverage is limited. The public repository has recent releases, while an official issue titled “horusec is DEPRECATED!” raises uncertainty around future maintenance. Teams choosing Horusec should value open-source access, multilingual scanning, secret detection, and configurable execution enough to accept that uncertainty. Organizations prioritizing a broader integration ecosystem or clearer maintenance direction should consider an alternative.
Horusec pros and cons
- Where it wins
- Free, open-source scanning across 18 languages and configuration formats
- Detects exposed secrets and analyzes Git history
- Supports CLI, Docker, VS Code, CI/CD, and a vulnerability dashboard
- Where it doesn't
- Self-hosted deployment requires teams to manage the environment
- Third-party integration coverage is limited
- An official deprecation issue creates long-term maintenance uncertainty
Horusec fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update