Why i built karnak, a stdlib-only code scanner that tells you what it skipped

A scanner that misses a bug is annoying. a scanner that crashes halfway, prints nothing and exits green is dangerous, because now you believe something false. i built karnak around that second fear.

it scans a codebase for hardcoded credentials, dangerous code patterns and dependencies with known vulnerabilities, then reports to your terminal, to JSON, or to SARIF so GitHub can show the results in code scanning. it runs on the python standard library alone, so you can drop it onto a locked-down machine and it works.

it is alpha. i will be exact about what works and what does not.

try it

git clone https://github.com/celestial-zenny/karnak.git cd karnak pip install .

karnak code . karnak code .…