One command tells you whether your codebase would survive an enterprise buyer's security questionnaire.
Secrets · dependency CVEs · 38 misconfiguration rules · license risk · git-history leaks · live TLS & headers · SBOM · security-readiness score
Every scanner free forever · pipx install, no signup · PyPI and npm coming
$ dira scan . -t yourapp.com SECURITY GRADE F risk 72/100 STARTUP READINESS 38% Early-stage gaps (30/80 pts) CRITICAL 2 HIGH 5 MEDIUM 11 LOW 6 ─── CRITICAL ───────────────────────────────────── ● Stripe secret/restricted key src/lib/billing.ts:14 sk_l************XwEr → Revoke the key at the provider, issue a new one, move it to a secret manager, and purge it from git history. ● GitHub token found in git history (commit 8f21ac3) git history @ 8f21ac3 → Deleting the file does not remove it from history — rotate now. ─── HIGH ───────────────────────────────────────── ● lodash 4.17.11 — CVE-2021-23337: command injection package-lock.json npm:lodash@4.17.11 → Upgrade lodash to 4.17.21 or later. ● Secret exposed through a public build-time env var .env.production:7 NEXT_PUBLIC_STRIPE_SECRET_KEY → Compiled into the JS bundle and readable by every visitor. Licenses MIT ×29 BSD-3-Clause ×14 Apache-2.0 ×6 MPL-2.0 ×2 418 files · 402 cached · 87 deps · 0.9s
Startup security tooling is either a platform that costs more than your runway or five separate CLIs nobody ever wires up. So the leaked Stripe key sits in the repo until a security questionnaire, an acquirer's diligence checklist, or somebody else finds it.
DIRA is one command that answers the question founders actually get asked — is this codebase safe enough to sell to an enterprise? — and prints the exact fix beside every finding.
Want to walk the same ground by hand first? The free guide 18 things to fix before your first real user covers the checklist DIRA automates, with the why behind each item.
23 provider patterns — AWS, Stripe, OpenAI, Anthropic, GitHub, GCP, Slack, npm, database DSNs, private keys — plus an entropy-gated generic rule. Every value is redacted before it reaches a report.
Every package in your lockfiles resolved against OSV.dev — npm, PyPI, Go, crates.io, RubyGems. Free, batched, no API key, with the exact fixed version to upgrade to.
Docker, Kubernetes, Terraform, GitHub Actions, cloud IAM, frontend code
(NEXT_PUBLIC_ secrets, tokens in localStorage, XSS sinks) and LLM
apps (browser-side provider keys, prompt concatenation, model output piped to an executor).
Each dependency's license resolved and classified — permissive, file-level copyleft, GPL, AGPL/SSPL. The finding that kills acquisitions, with an inventory for your diligence folder.
Deleting the file does not rotate the key. DIRA reads commit diffs for secrets that were
removed from the working tree but still live in history, plus tracked
.env files and credentials in the remote URL.
TLS validity and expiry, HSTS/CSP/nosniff/frame-options, cookie flags, HTTP→HTTPS
redirect, and whether /.env or /.git/config
is being served to the internet.
Eighteen weighted checks modelled on SOC 2 and enterprise security questionnaires — CI, tests, secret scanning, SAST, CODEOWNERS, IaC, backups, incident response — rolled up into a percentage and a tier.
Answered up front, the same way every other number on this site is sourced instead of asserted.
The audit trail is the whole pitch: 208 passing tests, and zero dependencies means there is nothing to audit but the source itself. It's MIT licensed on GitHub — read every rule yourself instead of taking my word for it.
DIRA is one zero-dependency tool covering seven scanner classes plus SBOM output and PR gating; each of those does one job well. It isn't a replacement for a funded commercial platform like Snyk if you need an org-wide dashboard — it's a fast local pass you can run long before you'd need one. Full comparison below.
Scanning costs nothing, and no. MIT licensed, runs entirely on your machine. The only network
calls are anonymous package-name lookups to OSV.dev, npm and PyPI, plus a domain you name
yourself with --target — and --offline
turns even those off.
| Capability | DIRA | gitleaks | trufflehog | npm audit | Snyk (free tier) |
|---|---|---|---|---|---|
| What it scans for | 7 classes: secrets, dep CVEs, config/IaC, license risk, git history, live TLS | Secrets only | Secrets only, with live credential verification | npm dependency CVEs only | Dependency CVEs; deeper config/IaC on paid tiers |
| SBOM + PR diff gating | Built in — CycloneDX/SPDX, --diff | PR gating via Action, no SBOM | PR gating via Action, no SBOM | Neither | Both, paid tiers |
| Dependencies to install it | Zero | Zero (Go binary) | Zero (Go binary) | Bundled with npm | CLI + hosted account |
| Runs fully offline, no account | Yes | Yes | Yes | Yes | No — account required |
| Cost | Free, MIT | Free, MIT | Free core, paid enterprise tier | Free | Free tier limited; paid for full scope |
Scope described from each project's public docs as of this writing — verify current features before relying on this for a security decision.
Eighteen weighted checks modelled on what SOC 2 auditors and enterprise security questionnaires actually ask for: lock-pinned dependencies, automated updates, CI, tests, secret scanning, SAST, CODEOWNERS, a disclosure policy, infrastructure as code, error tracking, an incident-response plan, backups, privacy documentation.
You get a percentage, a tier, and the specific missing artifact — plus the manual
attestations no scanner can verify for you (MFA enforcement, branch protection,
least-privilege IAM, same-day offboarding). Then dira fix --apply
writes the boring ones for you.
Every scanner, every rule and every scan output format is in the free MIT release. Two Pro-marked code paths — the client-ready report renderer and policy-as-code overrides — exist in the source and are not on sale yet. The two items below buy the part a scanner cannot do: a person reading every finding, throwing out the noise, and typesetting what is left into a document you can hand to an enterprise buyer's security team. Neither is open for sale yet.
The entire open-source scanner. Not a trial, not a crippled tier — the same engine that generates the paid reports.
-f html,
-f sarif, -f json, plus
CycloneDX/SPDX SBOM output.dira init writes the workflow
and pre-commit hook; --diff scans only what changed.dira fix --apply writes the
boring missing files for you.Installs from source today with pipx.
PyPI and npm are on the way.
The scan output, reviewed by a human and rebuilt as a client-ready document — the thing you actually send when a prospect asks for your security posture.
Not selling yet — join the list and you'll hear the day it opens. Want it sooner? the Shield Audit is open now through DHAHAB Studio — or Email me directly.
For when the report has to survive questions — a diligence process, a security review, an investor who forwards it to someone technical.
Need more than a report? The bespoke 15-hour engagement is quoted on a call through DHAHAB Studio — email me.
Not a screenshot of a terminal. A six-section report, in the same black-and-gold house style as everything else here — here is a real one, generated end to end by the same command that would generate yours.
Sample uses a fictional client and a synthetic repository. Every tier is automated analysis plus human review — not a penetration test, not a SOC 2 audit, and not a guarantee that your product is secure. Read-only repo access, local clone only, deleted within 14 days of delivery. Full refund before work starts; nothing is billed until scope is agreed in writing.
pipx install git+https://github.com/Yusuf-Gadelrab/dira,
then dira scan . — PyPI and npm packages are on the way.
-f html -o report.html produces a client-shareable audit.
-f sarif lands findings in GitHub's Security tab.
dira init installs the CI workflow and pre-commit hook.
PRs scan only what changed; exit code 1 fails the build.
dira fix --apply writes the missing policy files and
.gitignore rules, then prints the rotations only you can do.
DIRA is automated pattern analysis. It does not replace a penetration test, a threat model, or a real SOC 2 audit, and it cannot see your cloud IAM, your MFA posture, or your access reviews — those are listed as manual attestations in the report.
A clean run means "no known bad patterns in this repository". It does not mean "secure".
Scanning a domain you do not own or have permission to test may be unlawful. The
--target flag makes unauthenticated requests to a handful of
well-known paths — point it at your own infrastructure only.
Your code never leaves your machine. The only network calls are anonymous package-name
lookups to OSV.dev, npm and PyPI, and requests to a domain you name yourself.
--offline disables all of them.
Seven scanners: leaked credentials (23 provider patterns plus an entropy-gated generic rule), dependency vulnerabilities resolved against OSV.dev, 38 misconfiguration rules across Docker, Kubernetes, Terraform, GitHub Actions, cloud IAM, frontend code and LLM applications, dependency license risk, secrets buried in git history, the live domain's TLS and security headers, and an 18-point startup security-readiness score.
No. Scanning happens entirely on your machine. The only network calls are anonymous
package-name lookups to OSV.dev and the public npm and PyPI registries, plus requests to a
domain you explicitly pass with --target. The
--offline flag disables all of them. Detected secrets are
redacted before they reach any report or cache.
Nothing to scan and fix a codebase. All seven scanners, all 62 detection rules,
SBOM output, dira fix, baseline and
--diff PR gating ship free in the MIT-licensed open-source
release. Two code paths — the client-ready report renderer
(dira report) and policy-as-code overrides
(--policy) — are marked Pro in the source and are not on sale
yet. Install it with
pipx install git+https://github.com/Yusuf-Gadelrab/dira; PyPI
and npm are on the way. Two optional human-review
services exist for founders who want the raw output turned into a document they can
hand a buyer — neither is required to find or fix anything.
No. DIRA is automated pattern analysis. It can't see your cloud IAM, your MFA enforcement, or your access reviews — those appear in the report as manual attestations. A clean run means no known bad patterns in the repository, not that the product is secure.
Not yet. It installs from source on GitHub today with
pipx install git+https://github.com/Yusuf-Gadelrab/dira,
then dira scan . PyPI and npm packages are on the way — the
email list below pings the day either lands.
Snyk vs Trivy vs DIRA — where each tool actually wins, written without pretending DIRA replaces a funded platform.
18 things to fix before your first real user — the checklist DIRA automates, with the why behind each item.
A full sample readiness report — six sections, generated end to end by the same command.
The Shield Audit — the same scan, reviewed by hand and rebuilt as a client-ready report with a fix plan, inside 48 hours.
MIT licensed. Every scanner free. No account, no telemetry.
Ask me to run it for you Read the FAQ The manual checklist
Not on GitHub yet?
Leave your email and you'll hear the day DIRA lands on PyPI and npm. One message, nothing else.
Used for this one announcement. Legal · Privacy · all waitlists