shersec 0.1.0

AI-ready security audit agent for mobile, web, and backend projects, starting with mobile apps.

SherSec

SherSec is an AI-ready security audit agent for modern application projects.

Short purpose:

SherSec is a security scanner and AI audit agent for modern application projects.

The first milestone focuses on mobile application security. It detects common mobile project types, runs static checks against Android and cross-platform app files, and produces actionable reports that can later be enriched by an AI agent.

Current scope

• Detect Android, iOS, Flutter, and React Native project signals.
• Scan Android manifests for dangerous permissions and insecure configuration.
• Scan source and configuration files for hardcoded secrets and risky patterns.
• Generate terminal, JSON, Markdown, and HTML reports.
• Keep the core scanner independent from any single UI or AI provider.

Quick start

Install directly from GitHub:

python -m pip install "shersec @ git+https://github.com/isshort/shersec.git"
shersec scan /path/to/mobile/project --format markdown --output report.md

Or install from a local checkout:

python -m venv .venv
source .venv/bin/activate
pip install -e .
shersec scan ../todo --format markdown --output report.md

You can also run the CLI without installing the package:

PYTHONPATH=src python -m shersec scan ../todo

Python API

from pathlib import Path

from shersec import scan_project

report = scan_project(Path("/path/to/mobile/project"))
print(report.finding_count)

Build package

python -m pip install build
python -m build

The build creates a source distribution and wheel in dist/.

Development checks

PYTHONPATH=src python -m unittest discover -s tests
PYTHONPYCACHEPREFIX=/tmp/shersec-pycache python -m compileall src tests

Example

shersec scan /path/to/mobile/project --format json --output shersec-report.json

shersec scan /path/to/mobile/project --format html --output shersec-report.html

Roadmap

1. Android static checks.
2. iOS static checks.
3. OWASP MASVS mapping and richer remediation guidance.
4. AI agent planner for project-specific scan strategy.
5. CI integrations and package releases.

Development documentation

• Agent handoff
• Architecture
• Product vision
• Roadmap
• Rule authoring