Find Security Vulnerabilities in Python Code. Instantly.

Fast, deterministic security scanner powered by AST analysis. 17 detection rules covering OWASP Top 10.

17
Detection Rules
9/10
OWASP Coverage
1000+
Files/Second
FREE
Open Source
Get Started View on GitHub 
$ pip install mikmbr
$ mikmbr scan .

Found 3 security issue(s):

[HIGH] src/app.py:12
  Rule: DANGEROUS_EXEC
  CWE: CWE-95
  OWASP: A03:2021 - Injection
  Issue: Use of eval() allows arbitrary code execution

Why Mikmbr?

🔍

Comprehensive Detection

17 security rules covering SQL injection, command injection, hardcoded secrets, SSRF, template injection, and more.

⚡

Lightning Fast

Built on Python AST analysis. Scans typical repositories in seconds with zero false positives.

🎛️

Fully Configurable

YAML-based configuration for custom rules, severity levels, and output formats. Perfect for CI/CD.

🧠

Smart Secret Detection

Three-layer detection: 12+ known patterns (AWS, GitHub), entropy analysis, and variable name detection.

🔒

Privacy First

Runs entirely offline. Your code never leaves your machine. No cloud required.

📚

Learn as You Scan

Every finding includes CWE/OWASP references, detailed explanations, and fix suggestions.

Get Started in 30 Seconds

1

Install

pip install mikmbr
2

Scan

mikmbr scan .
3

Fix Issues

mikmbr scan . --verbose

Advanced Usage

JSON Output (CI/CD)

mikmbr scan . --format json

Custom Config

mikmbr scan . --config .mikmbr.yaml

17 Detection Rules

Comprehensive coverage of OWASP Top 10 2021

CRITICAL

Template Injection

Detects SSTI vulnerabilities in Jinja2, Mako, Django templates

CWE-94
HIGH

SQL Injection

String concatenation, f-strings, unsafe ORM queries

CWE-89
HIGH

Command Injection

os.system(), subprocess with shell=True

CWE-78
HIGH

Hardcoded Secrets

Smart detection: patterns, entropy, variable names

CWE-798
HIGH

SSRF

Server-Side Request Forgery in requests, urllib

CWE-918
MEDIUM

Open Redirect

Unvalidated redirects in Flask, Django, FastAPI

CWE-601
MEDIUM

Timing Attack

Non-constant-time password/token comparisons

CWE-208
MEDIUM

Log Injection

Unsanitized user input in logging statements

CWE-117
View All 17 Rules

Built For

👨‍💻 Developers

Catch vulnerabilities before they reach production. Integrate into your IDE or pre-commit hooks.

🏢 Teams

Enforce security standards across your codebase. Configure rules per project.

🤖 CI/CD

Automated security scanning in GitHub Actions, GitLab CI, Jenkins. Fail builds on critical issues.

📚 Learners

Learn secure coding practices. Each finding includes CWE/OWASP references and fix suggestions.

Start Scanning in 30 Seconds

Free, open source, and runs entirely offline.

pip install mikmbr && mikmbr scan .
View on GitHub Read Documentation