DEV Community: Prince

I built a CVE scanner for Python/Node with zero dependencies. Here's why that matters.

Prince — Wed, 01 Jul 2026 10:21:41 +0000

Most dependency scanners are themselves a dependency problem.
You install safety or pip-audit and suddenly you're pulling in 12 packages just to check if your 3 packages are safe. That always bothered me.
So I built Depheal. It scans your requirements.txt and package.json for known CVEs and abandoned packages — and it has zero dependencies. Pure Python stdlib. Nothing else.

pip install depheal
depwise scan .

What it actually does
Hits the OSV.dev API for real CVE data
Detects abandoned packages (no updates in 3+ years, deprecated, etc.)
Works on Python and Node projects
--strict flag exits with code 1 — great for CI pipelines
depwise why explains what's wrong with a specific package
Sample output from scanning my own project today:

"python-dotenv@1.0 medium 1 CVE fix: 1.1.2
python-dotenv: Symlink following in set_key allows arbitrary file overwrite

1 vulnerable, 1 ok

to fix:
pip install python-dotenv==1.1.2"

Found a real CVE in my own codebase while testing. Caught in 3 seconds.

The bug I fixed today
Version 0.1.0 had an embarrassing flaw.
If the network check failed — firewall blocking osv.dev, timeout, rate limit, anything — the tool silently reported every package as ok. No warning. Nothing.
For a security tool that's the worst possible failure mode. You'd think you're safe when you're actually just unchecked.
0.1.1 fixes this. Now it shows unknown (check failed) with an explicit message not to trust the result.
Honest output matters more than clean output.

Why zero dependencies?
A scanner that introduces attack surface is a bad scanner. Every dependency you add is something that could have its own CVE tomorrow.
Also I built this entirely from my laptop

What's next
GitHub Actions support
Lock file support (poetry.lock, package-lock.json)
More ecosystems (Go, Rust)
If something's broken or missing, open an issue.
GitHub: https://github.com/hunzo1/depheal

Thanks for reading the full post.

I build my own coding language specifically for bug bounty hunters. You will find it on GitHub with setup guide inside README.md GitHub: GitHub.com/InterviewCopilot350/Vroxscript I will upgrade it as per user's request and as well looking for developers

Prince — Sun, 22 Mar 2026 09:53:10 +0000

I built my own programming language on Android with no laptop. Meet VroxScript.

Prince — Sun, 22 Mar 2026 09:47:05 +0000

The Problem

I started learning bug bounty hunting with nothing
but an Android phone and Termux.

Every time I needed to do recon I had to write
50+ lines of Python just to scan subdomains and
check alive hosts. It was frustrating.

So I built my own language.

Meet VroxScript

VroxScript is a security scripting language where
full recon takes 7 lines instead of 200.


vs
scan subdomains target.com >> subs.txt
alive scan_results >> alive.txt
ports target.com >> ports.txt
headers https://target.com >> headers.txt
fuzz https://target.com >> fuzz.txt
secrets fetch_body
report target.com >> report.txt
Built on Android
No laptop. No fancy setup. Just:
Android phone
Termux
Go compiler
Determination
How it works
VroxScript is interpreted by Go which makes it:
Fast — concurrent scanning with goroutines
Portable — single binary
Simple — no dependencies
Features
Subdomain scanning
Port scanning
Directory fuzzing
Security header checking
Secret detection
DNS lookup
Wayback Machine integration
Full report generation
Get it
GitHub: github.com/InterviewCopilot350/vroxscript
What I learned
Building a programming language taught me more
about networking, compilers and Go than any
tutorial ever could.
— Prince, India