DEV Community: getobserver

Did anyone check with their own build web application to see how if AI generated code passes the code auditing? Try out today without uploading your project to third party server or giving access to any third party app. Share your feedback.

getobserver — Wed, 30 Sep 2026 08:18:20 +0000

getobserver

Sep 23

I Compared an Offline Security Audit With SonarQube on 4 Real Projects with Observer

#security #opensource #php #devtools

2 min read

I Compared an Offline Security Audit With SonarQube on 4 Real Projects with Observer

getobserver — Wed, 23 Sep 2026 18:52:52 +0000

I wasn't planning to compare Observer with SonarQube.

I was just curious.

I've been building Observer because I wanted a simpler first pass when looking at an unfamiliar codebase.

The problem I kept running into was not finding enough information.

It was having too much information and still not knowing where to start.

So I built a local audit workflow around a simple question:

"What should I look at first?"

Recently I decided to test that idea against SonarQube.

I used the exact same 4 projects:

Monica: Laravel
WordPress: PHP
OWASP Juice Shop: Node.js
FinDocAnalyzer: Laravel

The results from my tests

Project	Observer	SonarQube
Monica	169	2,530+
WordPress	244	2,470+
Juice Shop	226	312+
FinDocAnalyzer	32	63+

Measured on v0.6.0.

At first those numbers look strange.

But I don't think they're really a "who found more?" comparison.

The tools are doing different jobs.

SonarQube has a broad code-quality and static-analysis focus.

Observer is more focused on security triage and actionable findings.

That difference was actually the most interesting part of the experiment.

When I audit a project, I don't always want to start with a giant list.

I want to quickly understand:

Where are the risky areas?
What should I investigate first?
Where is the actual code?
What can I do about it?

That's what Observer is trying to make easier.

The basic workflow

observer analyze . --out report.html

It runs locally as a single binary and generates a self-contained HTML report. No account, no telemetry, and --assert-offline enforces that your code never leaves your machine.

What's new in v0.7.0

Running these comparisons exposed a few rough edges, and v0.7.0 fixes them:

Scans that don't hang. Deep scans on large codebases used to be killed by a fixed 5-minute budget. Timeouts now scale with file count (a WordPress-sized repo of ~4,600 files gets roughly 7–9 minutes), and you can override them with OBSERVER_SCAN_TIMEOUT=30m.
A time estimate up front. After file discovery, Observer prints an estimate so you know what you're in for.
Fairer counts. Semgrep now scans the same file set as Observer's built-in engine, with vendor, node_modules, dist, build and *.min.js excluded, so finding counts are apples-to-apples.
A more honest comparison page. The README and landing page now include a "Code leaves your machine?" row and label which engine (built-in, Semgrep, PHPStan) produced each finding.

GitHub: https://github.com/sanks205/getobserver

Release notes: https://github.com/sanks205/getobserver/releases/tag/v0.7.0

I'm curious how you handle this

When a code scan finishes, do you normally start with security findings, code quality, dependencies, runtime errors, or something else?

Same Laravel app, 582 files — Built-in: 58 issues (31 High), With Semgrep+PHPStan: 348 issues (26 High, 297 Medium). See why built-in is for CI and deep is for pre-release. Offline, 1 command. Try on your app.

getobserver — Tue, 15 Sep 2026 16:37:39 +0000

getobserver

Aug 21

I scanned a Laravel app with and without local engines — the dashboard now shows the difference

#showdev #php #security #devtools

3 min read

PersonalCleaner v1.3 — I Didn't Add More Features. I Made It Easier to Use.

getobserver — Tue, 08 Sep 2026 16:30:00 +0000

PersonalCleaner v1.3 — A Cleaner UI for a Cleaner Windows Experience 🧹

When I released PersonalCleaner v1.2, I focused on building an honest Windows cleaner — no scareware, no fake "3,000 problems found!" warnings, and no unnecessary upsells.

For v1.3, I decided to focus on something different:

Make PersonalCleaner easier and more pleasant to use.

The biggest change is the GUI/UX redesign.

✨ What's new in v1.3?
🎨 Cleaner, more modern desktop interface
🧭 Simple sidebar navigation
📊 New Dashboard with system overview and quick actions
🧹 Improved Clean page with clearer cleanup options
🪟 Smaller, centered default window
⏳ New startup splash/loading experience
📌 System tray support
💾 Tray preference is remembered between launches
🤫 Background maintenance can run silently without opening the main window
👀 See it in action

Instead of explaining the new UI with a long list of screenshots, here's a quick demo:

The goal is simple:

Open → understand → choose → clean.

No complicated menus. No confusing workflow.

🧠 Same philosophy. Better experience.

The interface changed, but the philosophy didn't.

PersonalCleaner is still:

Free • Open Source • MIT Licensed • Local • No scareware

You can see exactly what you're about to clean before taking action.

🚀 Get PersonalCleaner v1.3

PersonalCleaner v1.3 is available now.

👉 Download PersonalCleaner v1.3

It's free to try, and the source code is available on GitHub.

If you try it, I'd love to hear what you think about the new UI/UX — especially what feels intuitive and what still needs improvement.

I scanned a Laravel app with and without local engines — the dashboard now shows the difference

getobserver — Fri, 21 Aug 2026 19:38:42 +0000

You point Observer at a Laravel repo and it scans. Easy. But here's the thing I kept getting asked:

"Which engine actually found what? And what changes if I install Semgrep or PHPStan?"

Good question. In v0.6.0 the dashboard answers both, right in the scan history. Every past scan now shows an Engines column — a pill for each engine that ran (Semgrep, PHPStan, Bandit, gosec, ESLint), or a plain Built-in badge when you scanned with no local engines installed. There's a legend too, and scans are sorted newest-first so the comparison you care about is always at the top.

No flags. Observer auto-detects whatever you have installed and runs it. Install more → deeper scan. Uninstall → still works, just faster and built-in only.

The demo: one Laravel app, two scans

I scanned the same project twice — FinDocAnalyzer, a Laravel + MySQL app (582 files). First with zero local engines, then again with Semgrep and PHPStan installed. Same code, same machine, just a different toolchain.

Scan 1 — Built-in only (no engines installed)

58 issues — 31 high, 2 medium, 25 low
Security 79 / C, Health 99 / A
Took 39.9s
Dashboard shows: Built-in

This is the "no setup" path. Observer runs its own offline rules — secrets in commits, raw SQL concatenation, APP_DEBUG=true in prod, unguarded eval, that kind of thing. Fast, zero dependencies, catches the scary patterns.

Scan 2 — With Semgrep + PHPStan installed

348 issues — 26 high, 297 medium, 25 low
Security 81 / B, Health 66 / D
Took 52.3s
Dashboard shows: Semgrep · PHPStan

The moment PHPStan and Semgrep are on PATH, Observer picks them up and runs them — no config, no switches. Now the same 582 files get type-aware analysis: PHPStan's argument.type / return.type / mass-assignment findings, Semgrep's taint and framework-specific rules. The issue count jumps from 58 to 348 mostly because of medium findings that only a real type-checker can see.

So which one should you run?

Neither is "wrong." They're a speed-vs-depth tradeoff you now control:

	Built-in	With engines
Setup	none	install Semgrep + PHPStan
Issues	58	348
High	31	26
Medium	2	297
Health	99 / A	66 / D
Time	39.9s	52.3s

Notice the built-in scan flagged more "high" findings (31 vs 26). That's not because it's smarter — it's because without type context it can't downgrade a pattern that PHPStan proves is safe. Installing engines doesn't just add findings, it adds judgement: fewer false highs, way more real mediums worth fixing.

My rule of thumb:

CI on every push → built-in. Fast, no extra deps, still catches the worst stuff.
Pre-release / deep audit → install the engines once, get the type-aware pass.

And because the dashboard records the engine set per scan, you can literally watch the "Change" column flip from -290 (the built-in scan, 290 fewer than the deep one) to +291 (the deep scan, 291 more than the one before it) as you add tooling. The history tells the story.

How to try it


bash
# free, no engines needed
observer serve
# open http://127.0.0.1:7777, paste your project path, hit Scan

# want the deeper pass? just install the engines — Observer finds them:
composer global require phpstan/phpstan
pip install semgrep
# re-scan the same project — the Engines column now shows the pills

PersonalCleaner v1.2 — a free, open-source Windows cleaner with an honest Pro key

getobserver — Thu, 13 Aug 2026 15:12:06 +0000

Every "PC cleaner" shows you a scary number and asks for money. I got tired of that, so I built one that shows real numbers — and lets you verify every line.

PersonalCleaner is free and open source. v1.2 is out, and it adds an optional Pro key for people who want automation. Here's the whole story.

What it is

Portable, no installer, no account.
100% local — it makes zero network calls.
Open source (MIT) — one readable Python file. Audit it yourself.
No fake "3,000 problems!" — every number is a real Windows measurement (temp files, RAM, startup entries).

Free, always

The free build does the maintenance that matters:

🧊 Catch frozen apps and close them safely
🧠 Free up RAM (real before/after numbers)
🧹 Clean junk (temp files older than 24h, known folders only)
🚀 Startup manager
🪟 Restart Explorer / close a stuck app

v1.2: the honest Pro split

One thing I care about: not lying to users. So v1.2 ships a single build. Free features work with no key. Four power-user features are locked until you enter a Pro key:

🌙 Background automation — silent upkeep on idle + daily
🔁 Weekly idle restart — only when you're away
⚙️ Defender exclusions — stop AV slowing your dev builds
🔧 Service tuning — cut background load, reversible

You unlock them in-app: type L1, paste your key. Done. No account, no cloud.

Why a key at all?

Hosting, code-signing, and time cost money — and I'd rather be upfront than hide it. The license is an offline HMAC-signed key, machine-locked, valid 1 year. A one-time payment. No subscription, no auto-renew, no phone-home. It's honor-based, not DRM — the validation code is public so you can verify it.

Trust

Scanned on VirusTotal: v1.2 = 0/67 clean. (An earlier build showed 1/71 — the one hit was Microsoft Defender, a known false positive for unsigned PyInstaller apps. Not malware.)
Not code-signed yet → one-time SmartScreen "Run anyway" on first launch. Expected.
The free app is fully open source. Read it before you run it.

Get it

🆓 Free (GitHub): https://github.com/sanks205/PersonalCleaner
🔑 Pro key (1-year license, one-time payment): https://observerly1.gumroad.com/l/ialzp

Don't trust your PC cleaner. Verify it.

I built an offline Windows cleanup CLI in Python+Tkinter - MIT, no Electron, no phone-home

getobserver — Sat, 08 Aug 2026 09:54:00 +0000

Most "PC cleaners" are scareware: fake error counts, upsell popups, background
services you never asked for. I got tired of that, so I built my own - as a proper
dev tool, not a consumer product.

It's Python + Tkinter, packaged with PyInstaller (no Electron bloat, no
background services in the free build), and it runs 100% offline. Every number
it shows comes straight from real Windows APIs (temp files, RAM, startup entries) -
not a fabricated counter.

Why developers care

No Electron, no background processes - the free build is a single portable exe.
Real Windows APIs - the numbers are actual temp-file sizes, RAM usage, startup entries. Audit the code yourself.
Offline Pro key - the optional Pro license is HMAC-signed and machine-locked. No phone-home licensing, no cloud.
MIT-licensed - read exactly what it touches before you run it.

What it does (free, open source)

Scan & fix now - real junk, cached RAM, health check
Free RAM now - one-click memory release
Startup manager - see & control what runs at boot
Close a stuck app - mini task manager
Restart Explorer - fix a hung taskbar instantly
Activity log & history - see everything it did

Never touches critical Windows system files. No "you have 3,000 problems!" alerts.

The Pro version

Basic maintenance stays free on GitHub. Pro adds background auto-clean, weekly idle
restart, antivirus exclusions (stop Defender slowing your builds), and service tuning.

One-time fee, 1-year per-PC key (tied to your machine, works 100% offline)
One key, one computer - no subscriptions, no cloud
Unlocks via an in-app L1 menu

v1.2 is out and scanned clean on VirusTotal (0/67).

GitHub: https://github.com/sanks205/PersonalCleaner
Pro: https://observerly1.gumroad.com/l/ialzp

If you've ever wondered whether a "PC cleaner" actually does anything - this one's
code is right there to check.

Auditing a Laravel App's Security in One Command (No Terminal Required)

getobserver — Sun, 19 Jul 2026 21:26:07 +0000

Most security tools ask a lot of you before they tell you anything: create a cloud account, wire up CI, install a scanner and its dependencies, maybe send your code to a server. Sometimes you just want an honest snapshot of where a Laravel app stands — locally, right now, before a launch or a client handover.

TL;DR — Observer is a free, MIT, single-binary tool that audits a Laravel app for security & production-health issues — offline, no account. Point it at your project (or just double-click it) and get one HTML report. ⬇️ Download it →

That's the gap Observer fills. It's a single offline binary (free and MIT) that scans a codebase for security and production-health issues and writes one self-contained HTML report — no account, no telemetry, nothing installed on your system. Point it at a project, open the report. This post walks through auditing a Laravel app with it end to end.

Install

No runtime, no dependencies, no account.

Easiest — download & double-click. Grab the binary for your OS from the releases page and double-click it: Observer opens a dashboard in your browser, you paste a folder, hit Scan, done. No command line.

Prefer the terminal?

# macOS / Linux
brew install https://raw.githubusercontent.com/sanks205/getobserver/main/packaging/homebrew/observer.rb
# Windows
scoop install https://raw.githubusercontent.com/sanks205/getobserver/main/packaging/scoop/observer.json
# Go
go install github.com/sanks205/getobserver/cmd/cli@latest

## The one command

From the root of your Laravel project:

bash
observer analyze . --out report.html


That's the whole audit. Observer detects the stack (Laravel, the PHP version, your database), scans the code, inspects your config and dependencies, scores the project, and writes `report.html`. Open it in a browser — or print it to PDF to hand to a client.

## Reading the report

The report leads with a **Security Rating (A–E)** — the same worst-severity-present model tools like SonarQube use, grounded in CVSS/CWE/OWASP — alongside 0–100 Security and Code Health scores. Below that, a **"Fix These First"** list surfaces the highest-impact issues, and findings are **grouped by rule** so a large app collapses into a few dozen scannable groups instead of an endless wall. Every finding carries a severity, a file/line, and a **before → after fix** you can act on immediately.

## What it flags on a Laravel app

Out of the box, the free core catches the things that most often bite Laravel apps in production:

- **Secrets and config** — Observer inspects your `.env` and config files for committed secrets, `APP_DEBUG=true` shipped to production, and hardcoded API keys in code.
- **Injection-prone queries** — raw SQL built with string concatenation (`DB::select("... " . $id)`) instead of bindings.
- **Dependency CVEs** — add `--cve` and it checks your `composer.json` against [OSV.dev](https://osv.dev) for known-vulnerable packages.
- **Infrastructure & config** — Dockerfiles, `docker-compose`, Kubernetes manifests, and nginx/Apache configs for misconfigurations (running as root, `:latest`, exposed DB ports, obsolete TLS).

For deeper, framework-aware rules — unescaped Blade (`{!! !!}`), mass-assignment, `APP_KEY` handling, Eloquent raw expressions, and packs for CodeIgniter, WordPress, Symfony, Django, Rails and Spring — there's an optional one-time [Observer Pro](https://observerly1.gumroad.com) add-on. The free core stands on its own for a solid audit; Pro layers Laravel-specific depth on top.

## No command line? Double-click it

The latest release (v0.4.0) added a zero-CLI path for teammates who don't live in a terminal: **double-click the binary** and Observer opens a local dashboard in your browser. Paste a folder, click **Scan**, and read the report — past scans, stack, and "new since last scan" all live on one page. Same engine, no typing.

## In CI

The same binary drops into a pipeline. Fail the build on new high-severity issues and emit SARIF for GitHub code scanning:

bash
observer analyze . --sarif observer.sarif --fail-on High


Adopting it on an existing app? Record a baseline first, then report only *new* issues so you're not drowning in pre-existing debt:

bash
observer analyze . --write-baseline .observer-baseline.json
observer analyze . --baseline .observer-baseline.json --fail-on Medium


## Offline and auditable

By default nothing leaves your machine — no account, no phone-home. For regulated or client-confidential work you can make that guarantee enforceable:

bash
observer analyze . --assert-offline




It refuses to run if any network-requiring flag was passed and prints `Offline mode: no network I/O.` so you can evidence it in an audit — useful for finance, healthcare, or reviewing a client's code under NDA.

## Wrap-up

Observer won't replace a continuous platform like SonarQube or an always-on monitor like Sentry — it's a different shape of tool: a fast, offline, one-command snapshot that unifies code, dependencies, config and infra into a single report you can read or share. For a pre-launch check, a legacy handover, or just seeing where a Laravel app really stands, it's about as low-friction as a security audit gets.

The core is free and MIT. Here's a 60-second challenge: **download it, double-click it, and scan your app** — then drop your **Security Rating (A–E)** in the comments. Most Laravel apps land on a C or D on the first scan. What does yours get?

👉 **[Download Observer](https://github.com/sanks205/getobserver/releases/latest)** — Windows / macOS / Linux, no install.
⭐ **[Star it on GitHub](https://github.com/sanks205/getobserver)** to grab it later when you need it.

If it catches something useful, a ⭐ on the repo genuinely helps other devs find it — and I'd love to hear what it flags on your project, good or bad, in the comments.

I built an offline CLI that audits a legacy PHP app in one command — and shows you the fix

getobserver — Thu, 09 Jul 2026 18:04:00 +0000

Every time I inherit a legacy PHP app — a CodeIgniter admin panel, an old Laravel service, a WordPress site someone's cousin built — day one is the same ritual: grep for password, squint at config.php, wonder if display_errors is on in prod, and hope there isn't a hardcoded API key waiting to ruin my week.

So I built a tool to do that first pass for me, in one command, offline. It's called Observer, it's a single Go binary, and it's free and MIT.

observer analyze ./your-app --out report.html

Point it at a folder, get one self-contained HTML report. No server, no account, no instrumentation, nothing sent anywhere.

What it actually found

I ran it against a real CodeIgniter 3 admin app I'd picked up. A few seconds later:

Project:   admin-panel
Language:  PHP
Framework: CodeIgniter 3 [High]
Database:  MySQL [High]

Security score: 81/100 (B)   Code health: 100/100 (A)
Static analysis: issues across secrets, config & dependencies

  [High]  application/config/firebase.php   Hardcoded Google API key
  [High]  index.php                         display_errors enabled
  [Med ]  composer.json                     End-of-life PHP version

None of these are exotic. That's the point — the boring, high-impact stuff is exactly what gets missed on a handover, and it's what an attacker finds first. A hardcoded key in a config file that's sitting in the repo is a bad afternoon waiting to happen.

It doesn't just flag — it shows the fix

This is the part I care about most. Most free scanners hand you a wall of findings and leave you to Google each one. Every Observer finding carries a concrete before → after fix, right in the report — no AI key required, fully offline:

// Before
$db->query("SELECT * FROM users WHERE id = " . $id);

// After
$db->query("SELECT * FROM users WHERE id = ?", [$id]);

Each finding also gets a severity, a file:line, and a CWE/OWASP tag, so you can triage instead of just staring.

What it checks

Security rules across PHP, JS/TS, Python, Java & Ruby — hardcoded secrets, SQL injection, XSS, command execution, insecure deserialization, weak crypto, dangerous config
Dependency CVEs via OSV.dev (--cve) — Composer, npm, PyPI, Go
A Security score and a Code-Health score (A–F) plus an estimated fix effort
SARIF / JSON / CSV output + a GitHub Action, so it drops into CI
It also auto-detects Semgrep / PHPStan / Bandit / gosec if you already have them, and folds their findings into the same report

Offline by default (and provably so)

No telemetry, no phone-home. The only things that touch the network are explicitly opt-in (--cve, or --ai with your own OpenAI key). For regulated or client-confidential work there's a flag that makes it enforceable:

observer analyze ./client-app --assert-offline
# Offline mode: no network I/O.

It refuses any network-touching option and keeps the AI on a local heuristic. Handy when you're auditing someone else's code under NDA and the code genuinely cannot leave the machine.

What it's not

It's not trying to replace SonarQube, Snyk, or Sentry. Those go deep in one dimension and want a server, a cloud account, or instrumentation. Observer is the opposite shape: a zero-setup, offline snapshot for the moments those are too heavy — a legacy handover, a quick client audit, an air-gapped scan, or just "what's wrong with this thing I just cloned?" Run both; they answer different questions.

Try it / tell me what it misses

It's genuinely free and MIT — grab a binary and point it at any repo:

👉 https://github.com/sanks205/getobserver

There are a few optional one-time paid add-ons (branded PDF reports, scheduled scans, deeper framework rule packs), but the whole core scanner is free with no account.

This is early, and I'd really value feedback from people who work on older codebases: what did it flag that was noise? What rule would've actually saved you an afternoon? Drop a comment — that's what I'm building from next.