Fluid Attacks' scanners

Last updated: Oct 27, 2026

---

Fluid Attacks has scanners for different types of security analysis. You can get them in these formats: Docker containers, GitHub Actions, and distributed binaries.

You can add these scanners to your development workflow. Thus, you can do security scans on your computer and in your continuous integration and continuous delivery (CI/CD) pipeline.

Each scanner can authenticate each run to your Fluid Attacks group with a Group token, if you want. The Group token can be a short-lived token from OIDC or a long-lived secret. For more information, read Authentication.

Fluid Attacks also has GitHub Actions that add security scans directly to your GitHub workflows. Each action does the installation, execution, and result reporting automatically. Most actions can upload findings to the GitHub Security tab in SARIF format. These GitHub Actions are available:

• SAST action — runs static application security testing on your source code. It automatically selects the full or the differential scan mode from the workflow trigger.
• SCA action — detects known vulnerabilities in your third-party dependencies. It compares the package manifests with the vulnerability database of Fluid Attacks.
• Secret Scanning action — detects hardcoded secrets and credentials (API keys, passwords, tokens, and similar sensitive data) in your repository.
• CI Gate action — connects to the Fluid Attacks platform to find if your repository has open vulnerabilities. It is a security gate that can block merges when there are findings that break your policies.
• DAST action — runs dynamic application security testing on your live web application. It sends requests to the URLs that you configure.

MAST scanner

fluidattacks/mast is the tool that does mobile application security testing (available as a Docker container). The primary function of this scanner is to decompile APK files and search them for vulnerabilities.

CSPM scanner

fluidattacks/cspm is the tool that does cloud security posture management (available as a Docker container). This scanner analyzes AWS cloud environments for vulnerable configurations.

For more information about CSPM, read "What is CSPM?".

DAST scanner

fluidattacks/dast is the tool that does dynamic application security testing on web applications (available as a Docker container).

A different tool, dast_api, analyzes API endpoints (available as a distributed binary).

For more information about DAST, read "What is DAST?".

SAST scanner

fluidattacks/sast is the tool that does static application security testing (available as a Docker container).

For more information about SAST, read "What is SAST?".

SCA scanner

fluidattacks/sca is the tool that does software composition analysis on directories (available as a Docker container).

For more information about SCA, read "What is SCA?".

Secret Scanning scanner

ss is the tool that detects hardcoded secrets and credentials (available as a distributed binary). This scanner searches for API keys, passwords, tokens, and similar sensitive data in your repository.

Container scanner

cs is the tool that does software composition analysis on containers (available as a distributed binary).

For more information about SCA, read "What is SCA?".

Resource requirements

This table shows the download locations and resource requirements of the CLI scanners that use Docker:

The Secret Scanning (ss), Container (cs) and API (dast_api) scanners are distributed binaries, not Docker images. For their installers and platform requirements, read that page.