Bright Security (formerly NeuraLegion) is a developer-first dynamic application security testing (DAST) platform that integrates security testing directly into CI/CD pipelines.

Unlike traditional DAST tools designed for security specialists, Bright prioritizes developer workflows and enables testing from early development through production.

What is Bright Security?

Bright Security represents a modern approach to DAST that addresses the limitations of legacy scanning tools.

Traditional DAST solutions typically run after deployment, creating a disconnect between development and security teams.

Bright shifts security testing left by providing developers with tools that fit naturally into their existing workflows.

The platform uses machine learning to reduce false positives significantly, ensuring that developers spend time fixing real vulnerabilities rather than chasing phantom issues.

By validating each finding automatically, Bright delivers actionable results that developers can trust and act upon immediately.

Key Features

Developer-Centric Design

Bright was built from the ground up for developer workflows:

Clear remediation guidance with code-level recommendations
IDE integrations for real-time feedback during development
Git-aware scanning that understands branch and PR contexts
Slack and Jira integrations for seamless issue tracking
Dashboard designed for developers, not just security teams

AI-Powered Scanning Engine

The platform leverages artificial intelligence to improve scan quality:

Automatic vulnerability validation reduces false positives
Smart crawling that adapts to application behavior
Context-aware payload generation for more effective testing
Learning algorithms that improve with each scan
Automatic authentication handling for complex login flows

API Security Testing

Comprehensive support for modern API architectures:

OpenAPI/Swagger import for automatic API discovery
GraphQL introspection and testing
REST API fuzzing with intelligent parameter mutation
Authentication testing including OAuth, JWT, and API keys
Rate limiting and access control verification

Flexible Deployment Options

Run scans wherever your applications live:

SaaS platform for quick start and zero maintenance
Docker-based scanner for air-gapped or on-premises environments
CLI tool for scripted automation
Kubernetes-native deployment for cloud-native applications

Installation

Docker Scanner

The Docker-based scanner allows local scanning and CI/CD integration:

# Pull the Bright Security scanner
docker pull brightsec/cli:latest

# Run a basic scan
docker run --rm brightsec/cli:latest scan:run \
  --token $BRIGHT_API_TOKEN \
  --name "My Application Scan" \
  --crawler https://example.com

# Run with HAR file input
docker run --rm -v $(pwd):/data brightsec/cli:latest scan:run \
  --token $BRIGHT_API_TOKEN \
  --name "HAR Replay Scan" \
  --har /data/traffic.har

CLI Installation

Install the Bright CLI globally for command-line access:

# Install via npm
npm install -g @brightsec/cli

# Authenticate
bright configure --token $BRIGHT_API_TOKEN

# Run a scan
bright scan:run \
  --name "CLI Scan" \
  --crawler https://example.com \
  --smart

API Specification Scanning

Import OpenAPI specifications for comprehensive API testing:

# Scan from OpenAPI spec URL
bright scan:run \
  --token $BRIGHT_API_TOKEN \
  --name "API Security Scan" \
  --api https://example.com/api/openapi.json

# Scan from local spec file
bright scan:run \
  --token $BRIGHT_API_TOKEN \
  --name "API Security Scan" \
  --api ./openapi.yaml \
  --host https://api.example.com

Integration

GitHub Actions

name: Bright Security DAST

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  bright-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Start application
        run: |
          docker-compose up -d
          sleep 30  # Wait for app to be ready

      - name: Run Bright Security Scan
        uses: NeuraLegion/run-scan@v1
        with:
          api_token: ${{ secrets.BRIGHT_TOKEN }}
          name: "PR-${{ github.event.number }} Security Scan"
          discovery_types: |
            crawler
          crawler_urls: |
            http://localhost:3000
          wait_for: high

      - name: Stop application
        if: always()
        run: docker-compose down

GitLab CI

stages:
  - build
  - test
  - security

bright-dast:
  stage: security
  image: brightsec/cli:latest
  services:
    - name: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
      alias: app
  variables:
    BRIGHT_TOKEN: $BRIGHT_API_TOKEN
  script:
    - |
      SCAN_ID=$(bright scan:run \
        --token $BRIGHT_TOKEN \
        --name "GitLab MR !$CI_MERGE_REQUEST_IID" \
        --crawler http://app:3000 \
        --smart \
        --output scan-id)

      echo "Scan started: $SCAN_ID"

      # Wait for scan and check results
      bright scan:polling \
        --token $BRIGHT_TOKEN \
        --scan $SCAN_ID \
        --failure-on high \
        --timeout 30m
  artifacts:
    reports:
      junit: bright-results.xml
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

Jenkins Pipeline

pipeline {
    agent any

    environment {
        BRIGHT_TOKEN = credentials('bright-api-token')
    }

    stages {
        stage('Deploy Test Environment') {
            steps {
                sh 'docker-compose up -d'
                sh 'sleep 30'
            }
        }

        stage('Bright Security Scan') {
            steps {
                script {
                    def scanId = sh(
                        script: """
                            docker run --rm --network host brightsec/cli:latest scan:run \
                                --token $BRIGHT_TOKEN \
                                --name "Jenkins Build #${BUILD_NUMBER}" \
                                --crawler http://localhost:3000 \
                                --output scan-id
                        """,
                        returnStdout: true
                    ).trim()

                    sh """
                        docker run --rm brightsec/cli:latest scan:polling \
                            --token $BRIGHT_TOKEN \
                            --scan ${scanId} \
                            --failure-on high \
                            --timeout 30m
                    """
                }
            }
        }
    }

    post {
        always {
            sh 'docker-compose down'
        }
    }
}

When to Use Bright Security

Bright Security is particularly well-suited for teams that:

Practice DevSecOps and want security integrated into CI/CD pipelines
Need fast feedback loops with scans that complete in minutes, not hours
Struggle with false positives from traditional DAST tools
Build modern applications with JavaScript SPAs, APIs, and microservices
Want developer-friendly tooling that doesn’t require security expertise

Consider alternatives if you need:

Deep manual testing capabilities like Burp Suite provides
Compliance-focused reporting from enterprise solutions like Invicti
Open-source tooling such as OWASP ZAP for maximum customization

Bright Security works best as part of a comprehensive security program that includes SAST for code-level analysis and manual penetration testing for business logic vulnerabilities that automated tools cannot detect.