Point SecNsight at a repository. It reads your dependencies and source, lists what is risky in order of severity, and proposes a remediation for each finding.
Free for 2 repositories. Read-only GitHub access. Private code is never stored.
[CRITICAL] Package 'fastjson-utils' does not exist on PyPI at requirements.txt propose Remove it, or replace it with the library you meant. [CRITICAL] AWS access key ID found in source at config.py:12 code AWS_KEY = "AKIA…[redacted]" propose Revoke and rotate it, then load it from the environment. [HIGH] SQL query is built from a string at db/orders.go:48 propose Use placeholders, e.g. db.Query("... WHERE id = $1", id). shop: risk score 60/100 (High risk) - 2 critical, 1 high
Sample output, abbreviated.
Each scan reads the dependency files and source files it finds, checks packages against their public registry and the OSV vulnerability database, and applies built-in code rules.
| Language | Dependency files | Registry | Code rules |
|---|---|---|---|
| Python | requirements*.txt | PyPI | Bandit + 6 for AI-written code |
| JavaScript, TypeScript | package.json, package-lock.json | npm | 14 |
| Go | go.mod | Go module proxy | 11 |
| Java, Kotlin | pom.xml, build.gradle | Maven Central | 12 |
| C#, .NET | *.csproj, Directory.Packages.props | NuGet | 11 |
| For every language: known vulnerabilities from OSV.dev, and leaked keys, tokens and passwords in any text file. | |||
A report is only useful if you can act on it. Each finding says where the problem is, why it matters and what to change.
config.py:12
AWS_KEY = "AKIA…[redacted]"
Anyone who can read this repository can use this credential. Bots scrape public repositories for keys within minutes.
Revoke and rotate the key now, remove it from the code, and load it from an environment variable or a secrets manager. Removing it from git history alone does not make it safe again.
Sign in and every scan is saved. The dashboard shows what is exposed now and whether it is going down.
Sample data.
AI assistants sometimes suggest libraries that do not exist, and an attacker can publish a package under that name. SecNsight checks every dependency against its registry and flags the ones that are not there.
When a key or password is found, the report shows the first characters only. The same masked text is what the terminal prints and what the history stores.
Every report ends with notes on what could not be checked, such as a missing lockfile or an unreachable registry. A clean report never claims more than the scan covered.
The command line tool runs on your machine, so source code never leaves it. Only package names and versions are sent to the public registries and OSV.dev.
# scan a project, fail on high severity or worse secnsight scan . --fail-on high # write a SARIF report for code scanning secnsight scan . --format sarif -o results.sarif # check one dependency file secnsight manifest package.json
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
- run: pip install secnsight
- run: secnsight scan . --fail-on highThe command line tool is included with the project today. Publishing it as a package is planned.
SecNsight is free to use. There are no paid plans.
$0
Planned and not built yet. Dates are not promised.
No. It scans any project in the supported languages. It adds checks for mistakes AI assistants make often, but it cannot tell who wrote the code, and it does not need to.
No. SecNsight does not use AI services to analyse your code. The checks are fixed rules and the Bandit analyser, and your code stays on our server during the scan.
No. SecNsight proposes a remediation for each finding and you decide whether to apply it. Automated pull requests are on the roadmap.
Yes. You install a read-only GitHub App and pick exactly which repositories it can see. The code exists only briefly during the scan and is deleted right after.
The Free plan covers up to 2 repositories. You can scan those as often as you like, up to a daily limit. There are no paid plans at the moment.
No. It means these checks found nothing. Logic flaws, misconfigured infrastructure and business-rule bugs need human review and testing.