SecTester SDK for JavaScript

Table of contents

• About the SecTester SDK
• About Bright & SecTester
• Usage
  • Installation
  • Getting a Bright API key
  • Usage examples
• Documentation & Help
• Ecosystem
• Contributing
• License

About the SecTester SDK

This SDK is designed to provide all the basic tools and functions that will allow you to easily integrate the Bright security testing engine into your own project.

With the SDK you can:

• Work with the Bright scan engine, without leaving your IDE
• Build automations within your CI or local machine for security testing
• Create your own framework/project specific wrappers (you can see some examples in the Documentation section)

About Bright & SecTester

Bright is a developer-first Dynamic Application Security Testing (DAST) scanner.

SecTester is a new tool that integrates our enterprise-grade scan engine directly into your unit tests.

With SecTester you can:

• Test every function and component directly
• Run security scans at the speed of unit tests
• Find vulnerabilities with no false positives, before you finalize your Pull Request

Trying out Bright’s SecTester is free 💸, so let’s get started!

⚠️ Disclaimer

The SecTester project is currently in beta as an early-access tool. We are looking for your feedback to make it the best possible solution for developers, aimed to be used as part of your team’s SDLC. We apologize if not everything will work smoothly from the start, and hope a few bugs or missing features will be no match for you!

Thank you! We appreciate your help and feedback!

Usage

Installation

First install the module via yarn or npm and do not forget to install the peer dependencies as well:

$ npm i -s @sectester/runner \
  @sectester/bus             \
  @sectester/core            \
  @sectester/repeater        \
  @sectester/reporter        \
  @sectester/scan

or

$ yarn add @sectester/runner  \
  @sectester/bus              \
  @sectester/core             \
  @sectester/repeater         \
  @sectester/reporter         \
  @sectester/scan

Getting a Bright API key

1. Register for a free account at Bright’s signup page
2. Optional: Skip the quickstart wizard and go directly to User API key creation
3. Create a Bright API key (check out our doc on how to create a user key)
4. Save the Bright API key
   1. We recommend using your Github repository secrets feature to store the key, accessible via the Settings > Security > Secrets > Actions configuration. We use the ENV variable called BRIGHT_TOKEN in our examples
   2. If you don’t use that option, make sure you save the key in a secure location. You will need to access it later on in the project but will not be able to view it again.
   3. More info on how to use ENV vars in Github actions

⚠️ Make sure your API key is saved in a location where you can retrieve it later! You will need it in these next steps!

Usage examples

Full configuration & usage examples can be found in:

• Nest.js Demo.
• Broken Crystals Demo.
• ASP.NET Demo.

Documentation & Help

• Full documentation available at: https://docs.brightsec.com/
• A demo project can forked from: https://github.com/NeuraLegion/sectester-js-demo
• Join our Discord channel and ask anything!

Ecosystem

• SecTester JS SDK.
• SecTester NET SDK.

Contributing

Please read contributing guidelines here.

License

Copyright © 2022 Bright Security.

This project is licensed under the MIT License - see the LICENSE file for details.