🔒 Capsec - Capacitor Security Scanner

➡️ Get Instant updates for your App with Capgo

Missing a feature? We’ll build the plugin for you

Formerly published as @capgo/capacitor-sec (and Cap-go/capacitor-sec). Links and redirects should continue to work.

Zero-config security scanner for Capacitor and Ionic apps. Detect vulnerabilities, hardcoded secrets, and security misconfigurations with a single command.

🌐 Website: capacitor-sec.dev

Features

• 🚀 Zero Configuration - Works out of the box with any Capacitor/Ionic project
• 🔐 Local Processing - Your code never leaves your machine
• 📱 Platform-Specific - Android and iOS security checks
• 🔑 Secret Detection - Detects 40+ types of API keys and secrets (OpenAI, Anthropic, GitHub, Stripe, …)
• ⚡ Fast - Scans 1000+ files in seconds
• 📊 Multiple Outputs - CLI, JSON, and HTML reports
• 🔄 CI/CD Ready - GitHub Actions, GitLab CI support

Quick Start

# Run directly with npx (no installation needed)
npx @capgo/capgo-sec scan

# Or with bunx
bunx @capgo/capgo-sec scan

# Or install globally
bun add -g @capgo/capgo-sec
capsec scan

Security Rules

Capsec includes 68+ security rules across 13 categories:

Category	Rules	Description
🔑 Secrets	2	API keys, tokens, credentials (40+ patterns)
💾 Storage	6	Preferences, localStorage, SQLite
🌐 Network	8	HTTP, SSL/TLS, WebSocket
⚡ Capacitor	11	Config, plugins, native bridge
🤖 Android	10	Manifest, WebView, network security
🍎 iOS	9	ATS, Keychain, entitlements, file sharing
🔐 Authentication	7	JWT, OAuth, PKCE, biometrics
🖼️ WebView	6	XSS, CSP, iframe, injection
🔒 Cryptography	4	Algorithms, keys, IV generation
📝 Logging	2	Sensitive data in logs
🐛 Debug	3	Test credentials, dev URLs

Usage

Basic Scan

# Scan current directory
capsec scan

# Scan specific path
capsec scan ./my-capacitor-app

Output Formats

# CLI output (default)
capsec scan

# JSON output
capsec scan --output json --output-file report.json

# HTML report
capsec scan --output html --output-file report.html

Filtering

# Only critical and high severity
capsec scan --severity high

# Only specific categories
capsec scan --categories storage,secrets,network

# Exclude patterns
capsec scan --exclude "**/test/**,**/demo/**"

CI/CD Mode

# Exit with code 1 if high/critical issues found
capsec scan --ci

List Rules

# List all rules
capsec rules

# Filter by category
capsec rules --category android

# Filter by severity
capsec rules --severity critical

CI/CD Integration

GitHub Actions

name: Security Scan

on: [push, pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run Security Scan
        run: npx @capgo/capgo-sec scan --ci

GitLab CI

security-scan:
  image: node:24
  script:
    - npx @capgo/capgo-sec scan --ci
  only:
    - merge_requests
    - main

Configuration

Create a capsec.config.json file:

{
  "exclude": [
    "**/node_modules/**",
    "**/dist/**"
  ],
  "severity": "low",
  "categories": [],
  "rules": {}
}

Or initialize with:

capsec init

Programmatic Usage

import { SecurityScanner } from '@capgo/capgo-sec';

const scanner = new SecurityScanner({
  path: './my-app',
  severity: 'medium',
  categories: ['secrets', 'network']
});

const result = await scanner.scan();
console.log(result.summary);

Rule Categories

Secrets (SEC)

• SEC001 - Hardcoded API Keys & Secrets
• SEC002 - Exposed .env File

Storage (STO)

• STO001 - Unencrypted Sensitive Data in Preferences
• STO002 - localStorage Usage for Sensitive Data
• STO003 - SQLite Database Without Encryption
• STO004 - Filesystem Storage of Sensitive Data
• STO005 - Insecure Data Caching
• STO006 - Keychain/Keystore Not Used for Credentials

Network (NET)

• NET001 - HTTP Cleartext Traffic
• NET002 - SSL/TLS Certificate Pinning Missing
• NET003 - Capacitor Server Cleartext Enabled
• NET004 - Insecure WebSocket Connection
• NET005 - CORS Wildcard Configuration
• NET006 - Insecure Deep Link Validation
• NET007 - Capacitor HTTP Plugin Misuse
• NET008 - Sensitive Data in URL Parameters

Capacitor (CAP)

• CAP001 - WebView Debug Mode Enabled
• CAP002 - Insecure Plugin Configuration
• CAP003 - Verbose Logging in Production
• CAP004 - Insecure allowNavigation
• CAP005 - Native Bridge Exposure
• CAP006 - Eval Usage with User Input
• CAP007 - Missing Root/Jailbreak Detection
• CAP008 - Insecure Plugin Import
• CAP009 - Live Update Security
• CAP010 - Insecure postMessage Handler
• CAP011 - Insecure Capacitor Server URL

Android (AND)

• AND001 - Android Cleartext Traffic Allowed
• AND002 - Android Debug Mode Enabled
• AND003 - Insecure Android Permissions
• AND004 - Android Backup Allowed
• AND005 - Exported Components Without Permission
• AND006 - WebView JavaScript Enabled Without Safeguards
• AND007 - Insecure WebView addJavascriptInterface
• AND008 - Hardcoded Signing Key
• AND009 - Insecure WebView File URL Access
• AND010 - Network Security Config Cleartext Permitted

iOS (IOS)

• IOS001 - App Transport Security Disabled
• IOS002 - Insecure Keychain Access
• IOS003 - URL Scheme Without Validation
• IOS004 - iOS Pasteboard Sensitive Data
• IOS005 - Insecure iOS Entitlements
• IOS006 - Background App Refresh Data Exposure
• IOS007 - Missing iOS Jailbreak Detection
• IOS008 - Screenshots Not Disabled for Sensitive Screens
• IOS009 - iOS File Sharing Exposes App Documents

Authentication (AUTH)

• AUTH001 - Weak JWT Validation
• AUTH002 - Insecure Biometric Implementation
• AUTH003 - Weak Random Number Generation
• AUTH004 - Missing Session Timeout
• AUTH005 - OAuth State Parameter Missing
• AUTH006 - Hardcoded Credentials in Auth
• AUTH007 - OAuth PKCE Missing

WebView (WEB)

• WEB001 - WebView JavaScript Injection
• WEB002 - Unsafe iframe Configuration
• WEB003 - External Script Loading
• WEB004 - Content Security Policy Missing
• WEB005 - Target _blank Without noopener
• WEB006 - Dynamic WebView Script or HTML Injection

Cryptography (CRY)

• CRY001 - Weak Cryptographic Algorithm
• CRY002 - Hardcoded Encryption Key
• CRY003 - Insecure Random IV Generation
• CRY004 - Weak Password Hashing

Logging (LOG)

• LOG001 - Sensitive Data in Console Logs
• LOG002 - Console Logs in Production

Debug (DBG)

• DBG001 - Debugger Statement
• DBG002 - Test Credentials in Code
• DBG003 - Development URL in Production

Contributing

Contributions are welcome! Please read our Contributing Guide for details.

License

MIT License - see LICENSE for details.

Related

• Capgo - Live updates for Capacitor apps
• Capacitor - Build cross-platform apps
• Ionic - Mobile UI framework

---

Built with ❤️ by the Capgo team

Compatibility

Plugin version	Capacitor compatibility	Maintained
v8.*.*	v8.*.*	✅
v7.*.*	v7.*.*	On demand
v6.*.*	v6.*.*	❌
v5.*.*	v5.*.*	❌

Note: The major version of this plugin follows the major version of Capacitor. Use the version that matches your Capacitor installation (e.g., plugin v8 for Capacitor 8). Only the latest major version is actively maintained.