If Burp, Wireshark, and Dependabot had a kid

I got sick of spinning up Burp plus a browser plus some SCA tool just to poke at my own stuff. So I shoved it in one box and made it free for personal use

docker compose up -d
You get a proxy, a Chromium already sitting on that proxy, and a request history. Paste a GitHub repo you own and it checks lockfiles (OSV / GHSA / NVD), secrets, dumb API calls. Click a finding, it tells you why it yelled.

It stays on your machine. Personal use only. Don’t point it at shit you don’t have permission to touch. Not a payload pack.

https://kerf.software
https://github.com/ExecutiveKoder/kerf

If you run it and something breaks, tell me.