Find Security Vulnerabilities in Python Code. Instantly.

Fast, deterministic security scanner powered by AST analysis. 24 detection rules with framework-specific checks for Django, Flask, and FastAPI.

25+
Detection Rules
75%
Test Coverage
10/10
OWASP Coverage
100%
Detection Accuracy

View Full Transparency Report →

Get Started View on GitHub 
$ pip install mikmbr
$ mikmbr scan .

Found 3 security issue(s):

[HIGH] src/app.py:12
  Rule: DANGEROUS_EXEC
  CWE: CWE-95
  OWASP: A03:2021 - Injection
  Issue: Use of eval() allows arbitrary code execution

Why Mikmbr?

Comprehensive Detection

25+ security rules covering SQL injection, command injection, hardcoded secrets, SSRF, template injection, plus framework-specific checks for Django, Flask, and FastAPI.

Lightning Fast

Built on Python AST analysis. Scans typical repositories in seconds with zero false positives.

Fully Configurable

YAML-based configuration for custom rules, severity levels, and output formats. Perfect for CI/CD.

Smart Secret Detection

Three-layer detection: 12+ known patterns (AWS, GitHub), entropy analysis, and variable name detection.

Privacy First

Runs entirely offline. Your code never leaves your machine. No cloud required.

Learn as You Scan

Every finding includes CWE/OWASP references, detailed explanations, and fix suggestions.

Get Started in 30 Seconds

1

Install

pip install mikmbr
2

Scan

mikmbr scan .
3

Fix Issues

mikmbr scan . --verbose

Advanced Usage

JSON Output (CI/CD)

mikmbr scan . --format json

Custom Config

mikmbr scan . --config .mikmbr.yaml

25+ Detection Rules

Comprehensive coverage of OWASP Top 10 2021 + Framework-Specific Checks

CRITICAL

Template Injection

Detects SSTI vulnerabilities in Jinja2, Mako, Django templates

CWE-94
HIGH

SQL Injection

String concatenation, f-strings, unsafe ORM queries

CWE-89
HIGH

Command Injection

os.system(), subprocess with shell=True

CWE-78
HIGH

Hardcoded Secrets

Smart detection: patterns, entropy, variable names

CWE-798
HIGH

SSRF

Server-Side Request Forgery in requests, urllib

CWE-918
MEDIUM

Open Redirect

Unvalidated redirects in Flask, Django, FastAPI

CWE-601
MEDIUM

Timing Attack

Non-constant-time password/token comparisons

CWE-208
MEDIUM

Log Injection

Unsanitized user input in logging statements

CWE-117
View All 25+ Rules

What's New in v1.8

Dependency vulnerability scanning with OSV database

Dependency Scanning

Detect vulnerabilities in third-party packages with --check-deps:

mikmbr scan . --check-deps

Scans requirements.txt and pyproject.toml against OSV database for known CVEs.

Dependencies-Only Mode

Skip code analysis with --deps-only:

mikmbr scan . --deps-only

Fast dependency-only scans for CI/CD pipelines.

OSV Integration

Powered by Google's Open Source Vulnerabilities database.

Features: CVE mapping, CVSS scores, fix recommendations

Previous Release - v1.7

CI/CD control and better developer experience

Exit Code Configuration

Control when builds fail with --fail-on: Perfect for gradual security adoption.

Code Context Lines

See surrounding code with --context N: Understand issues without opening files.

CRITICAL Severity

New severity level for immediate RCE threats. 4 levels: CRITICAL, HIGH, MEDIUM, LOW

Previous Release - v1.6

Framework-specific rules and GitHub integration

Framework-Specific Rules

Django (6 rules) - Raw SQL, mark_safe(), DEBUG=True, SECRET_KEY

Flask (6 rules) - send_file(), SSTI, debug mode, cookie security

FastAPI (5 rules) - Input validation, path traversal, CORS

Inline Suppression

Mark false positives with comments:

# mikmbr: ignore[RULE_ID]

GitHub Code Scanning

SARIF output format for native GitHub integration:

mikmbr scan . --format sarif

Built For

Developers

Catch vulnerabilities before they reach production. Integrate into your IDE or pre-commit hooks.

Teams

Enforce security standards across your codebase. Configure rules per project.

CI/CD

Automated security scanning in GitHub Actions, GitLab CI, Jenkins. Fail builds on critical issues.

Learners

Learn secure coding practices. Each finding includes CWE/OWASP references and fix suggestions.

Start Scanning in 30 Seconds

Free, open source, and runs entirely offline.

pip install mikmbr && mikmbr scan .
View on GitHub Read Documentation