AppSec Workbench

AppSec Workbench is a local-first AppSec control plane for indie developers and small teams.

This repository is a TypeScript monorepo managed with pnpm workspaces. It will contain:

• a CLI for GitHub ingestion and compliance evaluation
• a Next.js web app for inventory and findings workflows
• shared packages for database access, GitHub integration, module contracts, core types, and policy logic

Workspace Layout

apps/
  cli/
  web/
packages/
  core/
  db/
  github/
  modules/
  policies/
docs/

Getting Started

Install dependencies:

pnpm install

Start local Postgres:

docker compose up -d postgres

Run Prisma commands:

pnpm db:generate
pnpm db:migrate
pnpm db:studio

Build and start the production web container after the database schema is up to date:

docker compose up -d --build web

The web app is available at http://localhost:3000. Its database-aware health endpoint is available at http://localhost:3000/api/health. Database migrations remain an explicit host operation; the web container never applies them automatically.

For local web development without building the production container, run:

pnpm --filter @appsec-workbench/web dev

Run the real repository inventory sync:

GITHUB_TOKEN=ghp_your_token GITHUB_OWNER=your-username-or-org pnpm --filter @appsec-workbench/cli appsec run repo-inventory

For personal repositories, set GITHUB_OWNER to your GitHub username. For organization repositories, set it to the organization login. GITHUB_OWNER_TYPE can be auto, user, or org; auto tries organization repositories first, then falls back to user repositories.

Or set GITHUB_TOKEN, GITHUB_OWNER, and optionally GITHUB_OWNER_TYPE in .env before running:

pnpm --filter @appsec-workbench/cli appsec run repo-inventory

Ingest GitHub secret scanning alerts after repository inventory has been synced:

pnpm --filter @appsec-workbench/cli appsec run secret-scanning-alerts

Fine-grained tokens need read access to Secret scanning alerts for the repositories being synced. Classic personal access tokens need the repo or security_events scope (public_repo is sufficient when accessing only public repositories). Secret values are requested in hidden form and are never stored by AppSec Workbench. See GitHub's secret-scanning REST API documentation for endpoint access details.

View stored secret scanning findings in the terminal:

pnpm --filter @appsec-workbench/cli appsec findings list --source secret-scanning

Filter to open alerts or emit machine-readable JSON:

pnpm --filter @appsec-workbench/cli appsec findings list --source secret-scanning --state open
pnpm --filter @appsec-workbench/cli appsec findings list --source secret-scanning --json

Stop the local services:

docker compose down

Run workspace checks:

pnpm typecheck

Helpful Commands

pnpm --filter @appsec-workbench/web dev

• Start the local dev server

pnpm --filter @appsec-workbench/cli appsec sync scheduled

• Sets up scheduled jobs

pnpm db:studio

• Starts Prisma Studio on a local port

First Milestone

The first milestone is a working skeleton that can:

1. start Postgres with Docker Compose
2. run Prisma migrations
3. run a CLI command
4. start a Next.js web app
5. share code through local workspace packages

Business logic has not been implemented yet.

Future Modules

• repo-inventory
• branch-protection
• dependabot-alerts
• code-scanning-alerts
• secret-scanning-alerts
• license-inventory
• actions-security
• stale-repo-detection