Universal Dev Security (UDS)

One Security System. Every Project.

UDS is an open-source, local-first security toolkit for developers. It runs industry-standard scanners on any project, normalizes their results into one schema, enforces a central security policy for Git and AI coding agents, and produces a dark, self-contained HTML security dashboard.

Status: 1.0.0 — first stable release. See DEVELOPMENT_STATUS.md for verified functionality, known issues and test results. UDS reports what its scanners find; a clean result is never proof that a project is secure.

What it does

Scanner states are explicit — clean, findings, not_installed, not_applicable, skipped, error — and the overall status becomes incomplete when an applicable scanner did not run. Severity is shown only when the scanner supplies it or a published scale (CVSS) defines it; everything else is unclassified. No security score is invented.

Quick start

Requirements: Python 3.11+, Windows, Linux or macOS. Git is recommended.

# Windows (from a release folder containing the wheel and SHA256SUMS)
.\scripts\install.ps1 -Wheel .\dist\1.0.0\universal_dev_security-1.0.0-py3-none-any.whl

# Linux / macOS
sh scripts/install.sh --wheel dist/1.0.0/universal_dev_security-1.0.0-py3-none-any.whl

Then, inside a project:

uds doctor                 # runtime, config and scanner availability (+ official install sources)
uds init                   # create .uds/config.toml (never overwrites)
uds scan                   # run applicable scanners, write JSON + HTML reports, record history
uds dashboard --open       # open the dark HTML dashboard
uds hooks install --apply  # block secrets at commit and push time
uds integrate claude-code --apply   # enforce the UDS policy inside Claude Code

Every command that changes files is a dry run by default and shows a diff; --apply creates a recovery checkpoint first. See docs/installation.md for scanner installation and upgrades, and docs/commands.md for all commands.

Documentation

• Installation and upgrades
• Commands
• Scanners, severity and privacy
• Integrations: Claude Code, GitHub, VS Code, other agents
• Architecture
• Security model and global policy
• Dashboard design system
• Release process

Safety guarantees

• No telemetry. The core never contacts the network; scanners' network use is documented and OSV-Scanner (which sends package names/versions to osv.dev) runs only with explicit approval.
• UDS never installs scanners, never commits, never pushes and never publishes.
• Existing configuration is merged, never silently overwritten; invalid files are left untouched.
• Secret values, matched text and raw scanner output never appear in output, reports or history.
• Global policies cannot be weakened by project configuration or AI tools.

Local Git hooks and AI-agent hooks are defense in depth — keep CI scanning and repository-level protections (for example GitHub push protection) enabled too.

Contributing and security

See CONTRIBUTING.md and SECURITY.md. Changes are listed in CHANGELOG.md.

License

Apache License 2.0. See LICENSE.