latio 1.1.0

Latio Application Security Tester - Uses OpenAPI to scan for security issues in code changes

Latio Application Security Tester

Use OpenAI or Gemini to scan your code for security and health issues from the CLI. Bring your own tokens. Options to scan full code, code changes, or in pipeline.

About Latio
Find Security Tools

• Install
• How to Run Locally
• How to Run in Pipeline
• Command Line Options

Install

pip install latio

export OPENAI_API_KEY=xxx

latio partial ./ 

How to Run Locally

1. Get your OpenAI key from here, and/or your Google API key here
2. export OPENAI_API_KEY=<OpenAPI Key> and/or export GEMINI_API_KEY=<Gemini API Key>
3. Scan only your changed files before merging with latio partial /path/to/directory. This uses the GPT-3.5-turbo model by default. For Google, use python latio partial /path/to/directory --model=gemini-pro
4. Scan your full application with latio full /path/to/directory. This uses the beta model of gpt-4 by default. Scanning this application once for example took about $1. Due to the context window, you may need to pass specific folders. For google, use latio full /path/to/directory --model=gemini-pro
5. You can specify --model with the model name from open ai to experiment

How to Run in Pipeline

This will run OpenAI in pipeline against only your changed files. Here's an example of what it looks like, it uses GPT-3.5 to scan only changed files, so it's relatively cheap.

1. Get your OpenAI token from here
2. In your repository, go to github.com/org/repo/settings/secrets/actions and add a new Repository Secret called OPENAI_API_KEY with the value from OpenAI
3. Copy and paste the .github/workflows/actions-template-security.yml (or -health for health scan) into your own .github/workflows/ folder.

Command Line Options

latio partial <directory> [--model <model_name>] [--health]

Scans only the files that have been changed in the specified directory.

• <directory>: Path to the directory where your project is located.
• --model <model_name>: (Optional) Specifies the name of the OpenAI model to use for the scan. Defaults to gpt-3.5-turbo
• --health: (Optional) Runs a prompt focused on code optimization

Example:

latio partial /path/to/your/project --model gpt-3.5-turbo --health

latio full <directory> [--model <model_name>] [--health]

Scans only the files that have been changed in the specified directory.

• <directory>: Path to the directory where your project is located.
• --model <model_name>: (Optional) Specifies the name of the OpenAI model to use for the scan. Defaults to gpt-4-1106-preview
• --health: (Optional) Runs a prompt focused on code optimization

Example:

latio full /path/to/your/project --model gpt-4-1106-preview --health