🔱 Trident

Automated web application security scanner with compliance mapping, policy gates, and CI/CD integration.

Trident scans websites for vulnerabilities aligned with OWASP Top 10 2025, OWASP API Security Top 10, and maps findings to PCI DSS 4.0, SOC 2, and NIST CSF — out of the box.

pip install trident-scanner
trident scan https://your-app.com

Why Trident?

Most security scanners dump findings. Trident tells you what to fix, how to fix it, and which compliance frameworks are affected — with framework-specific code snippets for nginx, Apache, Express, Django, Rails, and more.

Quick Start

# Install
pip install trident-scanner

# Basic scan (passive — safe for any target)
trident scan https://example.com

# Active mode (sends test payloads — use on targets you own)
trident scan https://example.com --active

# Scan a React/Vue/Angular SPA
trident scan https://spa-app.com --js-crawl

# Generate all report formats
trident scan https://example.com \
  -o results.json \
  --html report.html \
  --sarif results.sarif \
  --compliance compliance.json

# Check against a security policy (CI/CD gate)
trident scan https://example.com -o results.json --policy policy.yaml

# Start the web dashboard
trident serve

# Continuous monitoring with Slack alerts
trident monitor https://example.com --interval 30 --webhook https://hooks.slack.com/...

19 Security Scanners

Compliance Mapping

Every finding is automatically mapped to:

• OWASP Top 10 2025
• OWASP API Security Top 10 2023
• PCI DSS 4.0
• SOC 2 Trust Services Criteria
• NIST Cybersecurity Framework

trident scan https://example.com --compliance report.json

Output includes compliance percentage per framework:

OWASP Top 10 2025: 70.0% compliant
PCI DSS 4.0: 87.5% compliant
SOC 2: 83.3% compliant

Policy-as-Code

Define security policies in YAML and use them as CI/CD gates:

# policy.yaml
name: Production Security Policy
rules:
  - name: no-critical-findings
    type: max_severity
    max: high

  - name: max-high-findings
    type: max_count
    severity: high
    max: 3

  - name: required-scanners
    type: required_scanner
    scanners: [headers, tls, xss, sqli, secrets]

  - name: no-leaked-secrets
    type: forbidden_finding
    titles: ["Secret Detected", "AWS Access Key"]

# Exits with code 1 on violations — perfect for CI
trident scan https://app.com -o results.json --policy policy.yaml

Community Templates

Add custom vulnerability checks as YAML files — no code needed:

# templates/my-check.yaml
id: exposed-admin-panel
name: "Admin Panel Exposed"
severity: high
author: your-name
tags: [exposure, admin]
remediation: "Restrict admin panel access by IP or require VPN."

request:
  method: GET
  path: /admin/login

matchers:
  - type: word
    words: ["Admin Login", "Sign In"]
    condition: or
  - type: status
    status: [200]
matchers_condition: and

Drop .yaml files in ./templates/ or ~/.trident/templates/ and they're automatically loaded.

GitHub Actions

# .github/workflows/security.yml
name: Security Scan
on: [push]
jobs:
  scan:
    uses: your-org/trident/.github/workflows/trident-scan.yaml@main
    with:
      target_url: https://staging.your-app.com
      fail_on_severity: high

Findings appear in the GitHub Security tab via SARIF upload.

Web Dashboard

trident serve
# Open http://127.0.0.1:8000

Dark-themed dashboard with:

• Scan configuration (URL, scanners, active mode)
• Live progress tracking
• Severity breakdown and compliance posture
• Expandable vulnerability details
• HTML/JSON/SARIF report downloads

Output Formats

Architecture

src/trident/
├── cli/          # Typer CLI (scan, serve, monitor, policy-check)
├── core/         # Engine, models, templates, policy, compliance, SBOM
├── crawlers/     # HTML crawler + Playwright JS crawler
├── scanners/     # 19 plugin scanners + YAML template engine
├── reporters/    # Console, JSON, HTML, SARIF output
├── api/          # FastAPI dashboard + REST API
└── templates/    # Built-in YAML vulnerability templates

Adding a new scanner:

from trident.core.scanner_base import BaseScanner
from trident.scanners import register_scanner

@register_scanner
class MyScanner(BaseScanner):
    name = "my-scanner"
    description = "Checks for something specific"

    async def scan(self, urls: list[str]) -> list[Vulnerability]:
        # Your detection logic here
        return []

Development

git clone https://github.com/your-org/trident.git
cd trident
pip install -e ".[dev,api]"
pytest

License

MIT