Universal Dev Security (UDS)

One Security System. Every Project.

UDS is an open-source, local-first security toolkit for developers. It runs industry-standard scanners on any project, normalizes their results into one schema, enforces a central security policy for Git and AI coding agents, and produces a dark, self-contained HTML security dashboard.

Status: 1.0.1 — stable. See DEVELOPMENT_STATUS.md for verified functionality, known issues and test results. UDS reports what its scanners find; a clean result is never proof that a project is secure.

What it does

Scanner states are explicit — clean, findings, not_installed, not_applicable, skipped, error — and the overall status becomes incomplete when an applicable scanner did not run. Severity is shown only when the scanner supplies it or a published scale (CVSS) defines it; everything else is unclassified. No security score is invented.

Quick start

New to UDS? The Getting started guide walks through installation, your first scan, reading the dashboard, fixing findings and turning on protection, with real example output.

Requirements: Python 3.11+, Windows, Linux or macOS. Git is recommended.

python -m pip install universal-dev-security

The package on PyPI is identical to the assets of the GitHub release (same SHA-256). Prefer an isolated install? Use pipx install universal-dev-security, or the checksum-verifying installers described in docs/installation.md.

Install at least Gitleaks; uds doctor shows the official install command for every scanner. Then, inside a project:

uds doctor                 # runtime, config and scanner availability (+ official install sources)
uds init                   # create .uds/config.toml (never overwrites)
uds scan                   # run applicable scanners, write JSON + HTML reports, record history
uds dashboard --open       # open the dark HTML dashboard
uds hooks install --apply  # block secrets at commit and push time
uds integrate claude-code --apply   # enforce the UDS policy inside Claude Code

Every command that changes files is a dry run by default and shows a diff; --apply creates a recovery checkpoint first. See docs/installation.md for scanner installation and upgrades, and docs/commands.md for all commands.

Documentation

• Getting started
• Installation and upgrades
• Commands
• Scanners, severity and privacy
• Integrations: Claude Code, GitHub, VS Code, other agents
• Architecture
• Security model and global policy
• Dashboard design system
• Release process

Safety guarantees

• No telemetry. The core never contacts the network; scanners' network use is documented and OSV-Scanner (which sends package names/versions to osv.dev) runs only with explicit approval.
• UDS never installs scanners, never commits, never pushes and never publishes.
• Existing configuration is merged, never silently overwritten; invalid files are left untouched.
• Secret values, matched text and raw scanner output never appear in output, reports or history.
• Global policies cannot be weakened by project configuration or AI tools.

Local Git hooks and AI-agent hooks are defense in depth — keep CI scanning and repository-level protections (for example GitHub push protection) enabled too.

Contributing and security

See CONTRIBUTING.md and SECURITY.md. Changes are listed in CHANGELOG.md.

License

Apache License 2.0. See LICENSE.