hackmenot 2.1.1

AI-Era Code Security Scanner - catches vulnerabilities AI coding assistants introduce

🛡️ hackmenot

AI-Era Code Security Scanner

Catches the vulnerabilities AI coding assistants introduce—and fixes them.

---

The Problem

Over 50% of AI-generated code contains security vulnerabilities. Copilot, Cursor, and Claude Code are transforming how we write software—but they're also introducing patterns that traditional SAST tools weren't built to catch.

hackmenot is purpose-built for the AI era: it detects these vulnerabilities, provides auto-fix suggestions, and explains why AI makes these mistakes so you learn as you secure.

---

Quick Start

Get scanning in 30 seconds:

# Install via pip
pip install hackmenot

# Or with Docker
docker pull ghcr.io/b0rd3aux/hackmenot:latest

# Scan your code
hackmenot scan .

# Scan with auto-fix
hackmenot scan . --fix

# Scan dependencies for hallucinated packages
hackmenot deps .

That's it. No config files, no setup, no API keys.

---

Features

Scan & Detect

120+ security rules purpose-built for AI-generated code patterns across Python, JavaScript/TypeScript, Go, Rust, Java, and Terraform.

Auto-Fix

Don't just find problems—fix them. Interactive mode lets you review and apply fixes one by one.

hackmenot scan . --fix-interactive

Dependency Scanning

Detect hallucinated packages (dependencies that don't exist), typosquats, and known CVEs powered by Google's OSV database.

hackmenot deps . --check-vulns

🎯 Security Graph Visualization (v2.1)

Visualize your application's attack surface with interactive security graphs. Trace data flows from entry points to security sinks, identify vulnerable paths, and understand your security posture at a glance.

# Generate security graph
hackmenot graph . -o security.dot
dot -Tpng security.dot -o security.png

# Or use the interactive HTML viewer
hackmenot graph . --interactive -o security.html

Features:

• 🔍 Attack Surface Mapping - Identify all entry points (API endpoints, CLI commands, webhooks)
• 🌊 Data Flow Analysis - Trace untrusted data from sources to sinks
• 📊 Risk Scoring - Calculate exploit likelihood (0-100) based on authentication, sink type, and sanitization
• 🎨 Interactive Visualization - Search, filter, and explore your security graph in the browser
• 🎯 Exploit Chain Detection - Find compound vulnerabilities through single entry points

Try the interactive demo →

CI/CD & GitHub Security

Native GitHub Action with SARIF support. Findings appear directly in GitHub's Security tab.

- uses: hackmenot/hackmenot@v1
  with:
    sarif-upload: 'true'

⚡ Enterprise-Scale Performance (v2.0)

Parallel scanning architecture built for large codebases:

• 10k files in <10 seconds on 8-core machines
• Memory-efficient: <2GB for 50k file scans
• Zero external dependencies: Pure Python multiprocessing

# Parallel scanning (default in v2.0)
hackmenot scan .

# Control worker count
hackmenot scan . --workers 16

# Sequential mode (v1.x behavior)
hackmenot scan . --no-parallel

Performance Targets:

• Small repos (100 files): <1s
• Medium repos (1k files): <3s
• Large repos (10k files): <10s
• Enterprise (50k files): <60s

---

What It Catches

Category	Examples	Languages
Injection	SQL injection, command injection, XSS, path traversal	All
Authentication	Missing auth decorators, weak sessions, hardcoded credentials	Python, JS, Java
Cryptography	Weak algorithms, hardcoded keys, insecure random	All
Unsafe Operations	Unsafe blocks, raw pointers, transmute, reflection	Rust, Java
Deserialization	Insecure object deserialization, XXE attacks	Java, Rust
Data Exposure	Logging secrets, verbose errors, debug mode in prod	All
Infrastructure	Open security groups, missing encryption, public S3 buckets	Terraform
Dependencies	Hallucinated packages, typosquats, CVEs via OSV	Python, JS

---

Installation

pip (recommended)

pip install hackmenot

Docker

# Pull image
docker pull ghcr.io/b0rd3aux/hackmenot:latest

# Scan current directory
docker run --rm -v $(pwd):/workspace ghcr.io/b0rd3aux/hackmenot scan .

From source

pip install git+https://github.com/b0rd3aux/hackmenot.git@v1.0.0

Requires Python 3.10+

Usage

# Basic scan
hackmenot scan .

# Scan specific path
hackmenot scan src/

# Set minimum severity (critical, high, medium, low)
hackmenot scan . --severity medium

# Fail CI on high+ findings
hackmenot scan . --fail-on high

# Output as JSON or SARIF
hackmenot scan . --format json
hackmenot scan . --format sarif

# Auto-fix all issues
hackmenot scan . --fix

# Interactive fix mode
hackmenot scan . --fix-interactive

# Preview fixes without applying
hackmenot scan . --fix --dry-run --diff

# Scan only changed files (great for CI)
hackmenot scan . --changed-since origin/main

# Dependency scanning
hackmenot deps .
hackmenot deps . --check-vulns

# Security graph visualization
hackmenot graph . -o security.dot
hackmenot graph . --interactive -o security.html

---

Documentation

Guide	Description
Getting Started	First-time setup and basic usage
CLI Reference	All commands and options
Rules Reference	Complete list of 100+ security rules
Configuration	.hackmenot.yml options
CI Integration	GitHub Actions, GitLab, Jenkins, and more
Custom Rules	Write your own security rules
Contributing	How to contribute

Support

If hackmenot is useful to you, consider supporting its development:

---

Contributing

Contributions are welcome! See Contributing Guide for details.

License

Apache 2.0 - see LICENSE for details.