StaticCodeAudit — Product Summary

Standalone compliance, security and code quality audit tool. Single self-contained binary. 100% offline. Enterprise-grade reports.

By CodeFixture | Prefix: SCA

Key Highlights

• Single self-contained binary — no installation, no runtime, no dependencies on the target machine
• 100% offline — no API calls, no network access, no cloud dependency, no telemetry
• 465+ detection rules across 7 audit categories with OWASP/CWE/WCAG/ASVS mapping (Python, JS/TS, Java, C#, PHP, YAML)
• Interactive HTML reports — standalone single-file with 12+ Chart.js visualizations
• 4-language support — French, English, Spanish, German (report + console)
• Historical comparison — automatic baseline tracking across 10 audits
• CVE scanning — optional pip-audit + npm audit integration (local, offline)
• White-label branding — configurable tool name, company, logo per project
• ISO 27001 compliance matrix — maps findings to 93 Annex A controls across 4 themes
• Report retention — configurable cleanup by count, days, or both modes
• Git blame integration — resolves committer per finding for accountability
• Interactive configuration — guided init and configure modes for easy setup
• Demo mode — --demo generates anonymized reports (paths, code, solutions redacted) for prospects and public sharing
• Custom rule wizard — --create-rule unified 7-step wizard: create or edit, duplicate check (name + pattern), full DSL (risk/solution/benefit/fix), 4 languages
• Severity filter — --severity CRITICAL,HIGH filters rules before scan; amber banner in report when active
• Language badge — each finding displays its detected language (Python, JavaScript, YAML…) as a neutral badge
• Language × severity chart — stacked bar chart crossing detected language with severity level
• Custom rules architecture — custom-rules/ directory separate from the binary, never overwritten by updates
• Detailed progress — dynamic [n/N] numbering calculated after rule loading, per-language and per-taint step messages

What It Does

StaticCodeAudit (SCA) is a static analysis tool that scans project source code for security vulnerabilities, architectural anti-patterns, UI/UX accessibility issues, and maintenance debt. It produces a self-contained HTML report with severity-grouped findings, interactive charts, health scoring, and historical trend analysis.

Workflow

1. ./staticcodeaudit-<platform> /path/to/project --init   # Initialize project (generates UUID + config)
2. ./staticcodeaudit-<platform> /path/to/project          # Run full audit
3. Open SCA-REPORT-*.html                                 # Review interactive report

<platform> is one of linux-x64, macos-arm64, macos-x64, windows-x64.

Each audit generates:

• HTML Report (SCA-REPORT-{timestamp}.html) — standalone, printable, interactive
• Demo Report (SCA-REPORT-{timestamp}-demo.html) — anonymized version for sharing (opt-in via --demo)
• JSON Data (SCA-DATA-{timestamp}.json) — machine-readable, versioned (v3.4)
• Baseline — stored for next audit comparison (new/resolved/persistent issues)

Detection Rules

465+ rules across 7 categories, each with risk assessment, solution guidance, and benefit description.

Security (~430 rules) — Weight: 3

Interface / UI (5 rules) — Weight: 1

User Experience / Accessibility (18 rules) — Weight: 1

Maintenance (22 rules) — Weight: 1

Dependencies (3 rules) — Weight: 2

CI/CD (18 rules) — Weight: 2

Supported Languages

Report Features

Sections (16 in total)

1. Header — Project name, version, UUID, language flag, timestamp
2. Table of Contents — Clickable grid with emoji icons
3. Audit Parameters — Languages, scanned extensions, paths, exclude patterns, categories, mode
4. CLI Options Used — Checklist of 16 options with status and descriptions
5. Visualizations — 9 metric charts + 4 historical trend charts (incl. language × severity stacked bar)
6. Summary Statistics — Cards: HIGH/MEDIUM/LOW counts, validations, test rate, timing
7. Health Score — Logarithmic security score normalized by LOC, with severity penalties and color-coded progress bar
8. Top 10 Problematic Files — Heatmap ranking
9. Unit Tests — Pass/fail/error/skip counts with details
10. Fixtures Validation — Detection accuracy results
11. Dependencies — CVE scan results, unpinned packages (optional)
12. SLA Compliance — Resolution delays and escalation rules by severity
13. ISO 27001 Compliance Matrix — Mapping of findings to ISO/IEC 27001:2022 Annex A controls (93 controls, 4 themes)
14. Findings by Severity — Grouped CRITICAL/HIGH/MEDIUM/LOW/INFO with code snippets, category badges, glossary links
15. Validations by Category — Success messages (no issues found)
16. Glossary — 36 acronyms with definitions (OWASP, ASVS, WCAG, CVE, CVSS, CWE, CSRF, XSS, SQL, SARIF, SBOM, ISO 27001, etc.)

Interactive Features

• Resizable sidebar — Sticky TOC with drag-to-resize and localStorage persistence
• Keyboard shortcuts — j/k navigation, Ctrl+Home
• Collapsible sections — Click to expand/collapse findings
• Print mode — One-click print-friendly layout
• Chart.js visualizations — 12+ interactive charts with tooltips
• Baseline comparison — New/resolved/persistent issues highlighted
• Glossary cross-links — All acronyms throughout the report are clickable links to the glossary with tooltip preview

Report Autonomy

Every report is a single standalone HTML file:

• All CSS, JavaScript, Chart.js embedded inline
• Favicon and logo encoded as base64
• No external files, no CDN, no network needed
• Can be opened in any browser, shared as email attachment, archived

Compliance & Standards

Internationalization

Every string in the tool is localized:

• Console messages
• Report text, labels, titles
• Rule names, risk descriptions, solutions, benefits
• Category names, severity labels, chart labels
• Glossary terms, acronym definitions

CLI Reference

The CLI is organized into 3 argument groups.

Scan Options (common to all targets)

Output Options

Client Features

Configuration

All configuration lives in audit.config.json at the project root. Generated by --init.

Key Sections

White-Label Branding

{
  "brand": {
    "tool_name": "MyCompanyAudit",
    "company_name": "My Company",
    "prefix": "MCA",
    "logo": "assets/my-logo.svg"
  }
}

Customizes: report title, footer, output filenames, favicon, header logo.

UUID Project System

Each project gets a unique slug-based identifier on first --init:

• Stored in projects/<slug>/ next to the binary (slug derived from the project name, e.g. projects/my-ia/; uuid8 suffix appended on collisions)
• Decouples project location from fixture storage
• Enables project-specific rules and fixtures
• Tracks audit history (count, last audit date)

Performance

The cache is stored in .sca-cache/ inside the audited project. It can be deleted at any time to force a cold run, and is protected by HMAC-SHA256 against tampering.