free CLI scanner by SolidDark
Shinobi is a free local-first CLI security scanner for repositories. It detects exposed secrets, dangerous defaults, vulnerable dependencies, missing security basics, and AI-specific risks before they ship.
Point it at a repo. Get a fast, local security pass with actionable findings.
Shinobi inspects the working tree for secrets, unsafe settings, vulnerable packages, and missing security guardrails.
The scan runs on your machine. No code upload. No hosted dashboard. No telemetry pipeline between your repo and your result.
Findings are grouped into clear threat categories so you can triage by severity instead of reading a wall of noise.
Built for modern repos, not just static secret matching.
API keys, tokens, private keys, passwords, leaked env files, and high-risk credentials embedded in source.
Debug mode, wildcard CORS, weak secret keys, public binds, and unsafe starter settings left on in real deployments.
Known vulnerable packages and weak version pinning patterns that quietly turn supply chain risk into production risk.
No rate limiting, no CSRF protection, missing auth checks, missing headers, and absent input validation where it should exist.
Prompt injection markers, exposed system prompts, model artifacts in repos, and LLM credentials shipped into client-side code.
Optional deep scans catch secrets that were committed before and later removed from the working tree.
No service signup. No hosted agent. Just a CLI.
pip install shinobi-scan
PyPI is the install source. GitHub stays the source code reference.
shinobi
shinobi /path/to/project
shinobi --deep
shinobi --output report.json
Fast enough for local use. Clear enough for triage.
{ "tool": "shinobi", "version": "1.0.1", "repo": "payments-api", "threat_level": "HIGH", "categories": ["secrets", "dependencies", "defaults"], "findings": 6, "critical": 2, "high": 2, "medium": 2, "local_only": true, "duration_ms": 2137 }
Shinobi is part of the SolidDark security stack: local-first tooling, clear audit surfaces, and direct operator control.