Quantum key distribution (QKD) promises information-theoretic security based on quantum mechanics and idealized device models. Practical implementations, however, deviate from these models due to unavoidable device imperfections, and existing security proofs fall short of capturing the complexity of real-world systems. Here we introduce a versatile numerical finite-key security framework valid against general coherent attacks and applicable to a broad class of practical QKD setups. It accommodates most relevant imperfections at both transmitter and receiver, including non-independent-and-identically-distributed (non-IID) signals arising in high-speed QKD systems due to the limited bandwidth of optical modulators, while requiring only partial characterization of the apparatuses. We demonstrate the power of our framework by proving the security of a realistic decoy-state QKD implementation with laser sources, providing a practical route towards rigorous security certification of real-world QKD setups.