Security
End-to-end application security — vulnerability scanning, secret management, access control, traffic monitoring, compliance, and threat simulation.
What's Included
TotalApp's Security module gives engineering and DevSecOps teams a unified control plane for application security. It spans two live screens — Security Hub (terminal-driven security auditing) and Security Audit (structured audit log viewer) — plus seven upcoming screens that form a comprehensive application security operations platform.
Every screen is available under the Security app mode. Individual screens can also be pinned to any other mode via Settings → App Modes → Manage Screens.
Part of the Developer / Security Mode
Security screens are grouped under the security app mode alongside Developer Tools, QA, and DevOps. Switch to Security mode from the mode switcher in the top header, or enable individual Security screens from Settings → App Modes → Manage Screens.
Feature Overview
Security Hub
Terminal-based security command center. Run static analysis, dependency audits, secret scans, and full security sweeps directly from a command-line interface with structured block output.
Security Audit
Structured audit log viewer with severity filtering, CVE detail panels, and scan history. Browse past scans, drill into individual findings, and export reports.
IAM Visualizer Soon
Interactive graph of users, roles, and permissions across your stack. Detects over-privileged principals, unused permissions, and policy drift at a glance.
Dependency Scanner Soon
Deep scan of npm, pip, cargo, and maven dependency trees. Maps CVEs to affected packages, shows fix versions, and tracks SBOM across builds.
Secret Vault Soon
Encrypted secret store with environment namespacing, rotation policies, and audit-log-per-access. Integrates with CI/CD via environment injection.
Traffic Monitor Soon
Real-time HTTP/S traffic inspection with anomaly detection. Flags unusual request patterns, payload signatures, and geo-origin outliers.
Audit Trail Soon
Immutable, tamper-evident event log for every user action, config change, and API call. Full-text search, date-range filtering, and export to SIEM.
Compliance Radar Soon
Automated control assessment against SOC 2, ISO 27001, GDPR, and PCI-DSS frameworks. Gap analysis with prioritised remediation steps.
Threat Simulator Soon
Safe red-team scenario runner for OWASP Top 10 attack vectors. Validates detections without leaving your local environment.
Typical Security Workflow
The Security module is designed around a detect → analyse → remediate → verify cycle:
- Scan & detect — Open Security Hub and run
security-analysison a target file orfull-auditfor a project-wide sweep. Dependency Scanner (coming soon) extends this to third-party packages. - Review findings — Switch to Security Audit to browse the structured finding list. Filter by severity (critical / high / medium / low), expand CVE detail panels, and tag issues for tracking.
- Remediate — Use Secret Vault (coming soon) to rotate any exposed credentials. Update dependencies to the fix versions shown by Dependency Scanner. Adjust IAM policies flagged by IAM Visualizer.
- Verify & audit — Re-run scans to confirm fixes. Audit Trail (coming soon) preserves an immutable record of every remediation action for compliance evidence.
Screens at a Glance
| Screen | Status | Primary job |
|---|---|---|
| Security Hub | Live | Terminal-driven security scanning and auditing command center |
| Security Audit | Live | Structured audit log viewer with severity filters and CVE detail |
| IAM Visualizer | Coming Soon | Interactive user / role / permission graph with privilege analysis |
| Dependency Scanner | Live | CVE mapping across npm / pip / cargo / maven dependency trees |
| Secret Vault | Live | Encrypted secret store with rotation policies and CI/CD injection |
| Traffic Monitor | Coming Soon | Real-time HTTP/S anomaly detection and payload inspection |
| Audit Trail | Coming Soon | Immutable event log for every user action and config change |
| Compliance Radar | Coming Soon | Automated control assessment against SOC 2, ISO 27001, GDPR, PCI-DSS |
| Threat Simulator | Coming Soon | Safe OWASP Top 10 red-team scenario runner |
Enabling Security Mode
Security screens are visible when the Security app mode is active. There are two ways to enable it:
- Mode switcher (header) — Click the mode pill in the top header and select Security. The sidebar immediately switches to show Security screens.
- Manage Screens modal — Open Settings → App Modes → Manage Screens (or click the + button at the bottom of the sidebar). Find the Security section and toggle on the screens you need.
Mix with Developer Tools
Security Hub and Security Audit work naturally alongside Developer Tools screens like Dev Hub Terminal and Graph View. You can pin any combination of screens from different modes — you are not locked into a single mode at a time.