> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nometria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Scanner

> Static security scanner purpose-built for AI-generated web app code — catches secrets, auth gaps, and injection patterns.

`security-scanner` is a static security scanner purpose-built for AI-generated web app code. AI builders like Lovable, Bolt, v0, and Cursor frequently produce code with hardcoded secrets, missing auth guards, SQL injection patterns, and CORS misconfigs. This scanner catches those before they hit production.

Zero dependencies — pure Python stdlib.

<CardGroup cols={2}>
  <Card title="GitHub" icon="github" href="https://github.com/nometria/security-scanner">
    nometria/security-scanner
  </Card>

  <Card title="PyPI" icon="python" href="https://pypi.org/project/security-scanner/">
    security-scanner on PyPI
  </Card>
</CardGroup>

## Install

```bash theme={null}
pip install security-scanner
```

## Usage

```bash theme={null}
# Scan your project directory
security-scan ./my-app

# JSON output (for CI/CD)
security-scan ./my-app --format json

# Scan and fail on high-severity findings
security-scan ./my-app --fail-on high

# Scan a specific file
security-scan src/api/routes.py
```

## What it detects

### Secrets and credentials

| Pattern                     | Example                             |
| --------------------------- | ----------------------------------- |
| Hardcoded API keys          | `const API_KEY = "sk-proj-..."`     |
| Hardcoded passwords         | `password: "admin123"`              |
| Database connection strings | `postgres://user:pass@host`         |
| AWS credentials             | `AWS_SECRET_ACCESS_KEY = "wJal..."` |
| Private keys                | PEM blocks in source files          |

### Authentication gaps

| Pattern                            | Risk                     |
| ---------------------------------- | ------------------------ |
| Routes without auth middleware     | Anyone can call your API |
| Admin endpoints without role check | Privilege escalation     |
| JWT verification skipped           | Token forgery            |
| Missing CSRF protection            | Cross-site attacks       |

### Injection vulnerabilities

| Pattern                             | Risk                 |
| ----------------------------------- | -------------------- |
| SQL string concatenation            | SQL injection        |
| Unvalidated `eval()` / `exec()`     | Code injection       |
| Path traversal patterns             | Directory traversal  |
| XSS via `innerHTML` with user input | Cross-site scripting |

### Configuration issues

| Pattern                  | Risk                         |
| ------------------------ | ---------------------------- |
| `CORS: *` in production  | Any origin can call your API |
| Missing security headers | Clickjacking, MIME sniffing  |
| Debug mode enabled       | Exposes stack traces         |
| Insecure cookie flags    | Session hijacking            |

## Example output

```
Scanning ./my-app...

HIGH   src/api/users.js:47      Hardcoded API key detected
HIGH   src/routes/admin.js:12   Admin route without authentication
MEDIUM src/db/queries.js:23     SQL string concatenation (potential injection)
MEDIUM src/index.js:8           CORS configured to allow all origins
LOW    src/utils/debug.js:3     Debug logging enabled

5 findings: 2 high, 2 medium, 1 low
```

## Use in CI/CD

```yaml theme={null}
# GitHub Actions example
- name: Security scan
  run: |
    pip install security-scanner
    security-scan . --format json --fail-on high > security-report.json
```

<Tip>Run this scanner before migrating a vibe-coded app to production. AI builders often leave hardcoded API keys and missing auth guards that are safe during development but critical in production.</Tip>