hackmenot 1.1.0

AI-Era Code Security Scanner - catches vulnerabilities AI coding assistants introduce

🛡️ hackmenot

AI-Era Code Security Scanner

Catches the vulnerabilities AI coding assistants introduce—and fixes them.

---

The Problem

Over 50% of AI-generated code contains security vulnerabilities. Copilot, Cursor, and Claude Code are transforming how we write software—but they're also introducing patterns that traditional SAST tools weren't built to catch.

hackmenot is purpose-built for the AI era: it detects these vulnerabilities, provides auto-fix suggestions, and explains why AI makes these mistakes so you learn as you secure.

---

Quick Start

Get scanning in 30 seconds:

# Install via pip
pip install hackmenot

# Or with Docker
docker pull ghcr.io/b0rd3aux/hackmenot:latest

# Scan your code
hackmenot scan .

# Scan with auto-fix
hackmenot scan . --fix

# Scan dependencies for hallucinated packages
hackmenot deps .

That's it. No config files, no setup, no API keys.

---

Features

Scan & Detect

120+ security rules purpose-built for AI-generated code patterns across Python, JavaScript/TypeScript, Go, Rust, Java, and Terraform.

Auto-Fix

Don't just find problems—fix them. Interactive mode lets you review and apply fixes one by one.

hackmenot scan . --fix-interactive

Dependency Scanning

Detect hallucinated packages (dependencies that don't exist), typosquats, and known CVEs powered by Google's OSV database.

hackmenot deps . --check-vulns

CI/CD & GitHub Security

Native GitHub Action with SARIF support. Findings appear directly in GitHub's Security tab.

- uses: hackmenot/hackmenot@v1
  with:
    sarif-upload: 'true'

---

What It Catches

Category	Examples	Languages
Injection	SQL injection, command injection, XSS, path traversal	All
Authentication	Missing auth decorators, weak sessions, hardcoded credentials	Python, JS, Java
Cryptography	Weak algorithms, hardcoded keys, insecure random	All
Unsafe Operations	Unsafe blocks, raw pointers, transmute, reflection	Rust, Java
Deserialization	Insecure object deserialization, XXE attacks	Java, Rust
Data Exposure	Logging secrets, verbose errors, debug mode in prod	All
Infrastructure	Open security groups, missing encryption, public S3 buckets	Terraform
Dependencies	Hallucinated packages, typosquats, CVEs via OSV	Python, JS

---

Installation

pip (recommended)

pip install hackmenot

Docker

# Pull image
docker pull ghcr.io/b0rd3aux/hackmenot:latest

# Scan current directory
docker run --rm -v $(pwd):/workspace ghcr.io/b0rd3aux/hackmenot scan .

From source

pip install git+https://github.com/b0rd3aux/hackmenot.git@v1.0.0

Requires Python 3.10+

Usage

# Basic scan
hackmenot scan .

# Scan specific path
hackmenot scan src/

# Set minimum severity (critical, high, medium, low)
hackmenot scan . --severity medium

# Fail CI on high+ findings
hackmenot scan . --fail-on high

# Output as JSON or SARIF
hackmenot scan . --format json
hackmenot scan . --format sarif

# Auto-fix all issues
hackmenot scan . --fix

# Interactive fix mode
hackmenot scan . --fix-interactive

# Preview fixes without applying
hackmenot scan . --fix --dry-run --diff

# Scan only changed files (great for CI)
hackmenot scan . --changed-since origin/main

# Dependency scanning
hackmenot deps .
hackmenot deps . --check-vulns

---

Documentation

Guide	Description
Getting Started	First-time setup and basic usage
CLI Reference	All commands and options
Rules Reference	Complete list of 100+ security rules
Configuration	.hackmenot.yml options
CI Integration	GitHub Actions, GitLab, Jenkins, and more
Custom Rules	Write your own security rules
Contributing	How to contribute

Support

If hackmenot is useful to you, consider supporting its development:

---

Contributing

Contributions are welcome! See Contributing Guide for details.

License

Apache 2.0 - see LICENSE for details.