Zero-dependency security scanner: secrets, OSV CVEs, IaC rules, git-history leaks, SBOM,...

2026-07-29 · Yusuf Gadelrab

I got annoyed that scanning for supply chain risk usually means installing a large dependency tree first, so I wrote one with no dependencies at all. Pure stdlib Python, MIT.

What it does

What it does:

- Secret detection, 23 provider patterns plus an entropy-gated generic rule - Dependency CVEs via OSV.dev (free, no API key, no account) - 38 rules for config / IaC / frontend / LLM integration / cloud misconfig - Dependency license risk (the copyleft-in-a-commercial-product problem) - Git history scanning, because removing a secret from HEAD leaves it in the objects - Live checks on the deployed host: TLS and security headers

Outputs for an existing codebase

Outputs terminal, HTML, JSON, SARIF, Markdown. SARIF means it drops straight into GitHub code scanning. There's a --diff mode for gating PRs on newly introduced findings only, which in my experience is the only way scanning survives contact with an existing codebase that has 400 pre-existing warnings.

Also does CycloneDX and SPDX SBOM export and a conservative auto-fix pass.

208 tests. Built it as a student project and then kept going because I actually wanted to use it.

Adversarial feedback on the rule set

Genuinely want adversarial feedback on the rule set, especially the LLM-integration rules, which are the newest and least battle-tested part.