CLI tool to detect hardcoded secrets and sensitive data in codebases.

Guardrails for AI-assisted development - Detects IDOR, missing input validation, hardcoded secrets, and other critical bugs in AI-generated code

Open-source vulnerability scanner for your code. Detects SQL injection, XSS, hardcoded secrets, command injection, and more across 20+ languages. Fully offline with zero external API calls.

Security Scanner MCP - Detect vulnerabilities, hardcoded secrets, SQL injection, XSS, and OWASP Top 10 issues. Works with Claude Code, Cursor, Windsurf, Roo Code, and any MCP-compatible editor.

CLI tool to scan for hardcoded secrets, API keys, tokens, and passwords

Open-source, local-first privacy code scanner for PII leaks, hardcoded secrets, GDPR/CCPA compliance, SARIF, and CI/CD

Fully automated Docker containerization for AI-generated projects. One command handles container setup, dependency installation, and security fixes. 24 features addressing 82% dependency conflicts, 60-70% environment mismatches, 48% hardcoded secrets in L

Static security scanner/linter for MCP (Model Context Protocol) servers: detects tool poisoning, prompt-injection surfaces, hardcoded secrets, command injection, and excessive permissions in server source code and tool manifests. CLI + GitHub Action, SARI

Security audit for AI agent skills & MCP configs (reverse shells, exfiltration, dangerous MCP servers, hardcoded secrets) → SARIF/code-scanning; plus cross-agent skill governance for Claude Code, Cursor, Gemini CLI, Windsurf, Zed.

Security scanner for vibe-coded apps — catches hardcoded secrets, unprotected routes, weak JWT secrets, unverified webhooks, and more before you deploy

A .env file auditor for developers — detect unused vars, missing vars, hardcoded secrets, env drift, and more

Security scanner for agent skill files - detects command injection, unsafe file operations, hardcoded secrets, and code injection risks

Zero-config CLI that scans node_modules for hardcoded secrets, API keys, tokens, and passwords

NodeJS SDK for Pulumi ESC

A CLI tool to scan for hardcoded secrets

AWS SDK for JavaScript Secrets Manager Client for Node.js, Browser and React Native

Static security scanner for Model Context Protocol (MCP) servers. Detects tool-description poisoning, exfiltration cues, hidden-unicode payloads, arbitrary command execution, SSRF surface, hardcoded secrets, and rug-pull risk. Runs locally for Cursor and

A lightweight, extensible Static Application Security Testing (SAST) tool for JavaScript. Detects vulnerabilities like XSS, SQL injection, hardcoded secrets, prototype pollution, and more — with CWE references, severity ratings, and context-aware reportin

Azure Key Vault Secrets

ESLint plugin for Node.js API security — detects BOLA/IDOR, mass-assignment, SSRF, SQL injection, command injection, path traversal, open redirect, and hardcoded secrets across Express, Fastify, and NestJS.