I wrote a security scanner with zero dependencies, on purpose

2026-07-29 · Yusuf Gadelrab

Every security tool I looked at wanted me to install a hundred packages to go looking for supply chain risk. That struck me as funny in a way that isn't funny.

So DIRA has no dependencies. Pure Python, MIT licensed, runs anywhere Python runs.

Seven scanners

Seven scanners:

Secrets, across 23 provider patterns plus an entropy-gated generic rule. Not just the obvious AWS key shapes, the boring ones too.

Dependency CVEs, resolved through OSV.dev, which is free and public and doesn't require an account.

38 rules across config, infrastructure as code, frontend, LLM integrations and cloud. The LLM rules are the ones I'd argue about, because prompt injection surface is a real category now and most scanners have nothing to say about it.

Dependency license risk, because a GPL transitive dep in a product you plan to sell is a business problem disguised as a technical one.

Git history leaks. This is the one people don't expect. Deleting a secret from a file does not delete it from the repository. It's still in the objects, and it is still findable.

Live TLS and header checks against the deployed thing, since half of real exposure is config, not code.

What it outputs

It outputs SARIF, so it drops into GitHub code scanning. There's a diff mode for pull request gating, an SBOM exporter in CycloneDX and SPDX, a safe auto-remediation pass, and an 18 point readiness score for the moment an enterprise customer sends you a security questionnaire and you realize you have no idea what the answers are.

208 tests. Free forever.

https://yusuf-gadelrab.github.io/dira.html

What it misses

If you run it on something real and it misses something it should have caught, that's the feedback I want most.