DEV Community

Peter Nasarah Dashe
Peter Nasarah Dashe

Posted on

I disappeared for 5 months to build a security scanner. Here is what I learned (and how you can break it).

#python #security #discuss #opensource

👋 Hey dev.to community,

I haven't posted here in about 5 months. I went heads-down into the trenches of building a startup while balancing my cybersecurity degree in Nigeria.

When I first shared my project here, it was a basic Python CLI that looked for vulnerabilities. Since then, it has evolved into Permi—an open-source security and compliance scanner built specifically for the African fintech and healthtech ecosystem.

Here is what I learned building it, and why I need your help to test it.

The Engineering Challenge: Context is Everything

If you are in a regulated space (fintech, healthtech), you already know that global scanners like Snyk or Semgrep are great—until you realize they don't know what a BVN (Bank Verification Number) or a USSD session flaw looks like. They also generate so many false positives that engineering teams just tune them out.

I built Permi to solve three specific engineering problems:

  1. Localized Regex/Rule Engine: Detecting hardcoded BVNs, exposed Paystack/Flutterwave keys, and local PII in logs.
  2. AI Noise Reduction: Passing the raw findings to an LLM (via OpenRouter) to verify if a finding is a real vulnerability or a false positive. This cuts the noise by ~95%.
  3. The "Evidence" Problem: Compliance officers (DPOs) can't read terminal output. So I built a system that takes the technical scan and pairs it with an automated 20-item governance checklist, generating a complete Excel Readiness Workbook and PDF report.

(It even tracks evidence provenance—who owns the fix, the timestamp, and contradiction detection if a bug is "fixed" but still exists).

The Stack

  • Language: Python (CLI via pip install permi)
  • AI: OpenRouter API (LLM integration for false-positive filtering)
  • Output: Automated Excel generation (for compliance tracking) and PDF.
  • Architecture: Modular, focusing on local execution—your source code never leaves your machine (only anonymized snippets go to the AI).

I need your technical feedback

Permi is currently in beta. I am not looking for downloads; I am looking for testers who will break it.

How to test it:

You can install it in a Python environment and run it on a staging or demo repo:

pip install permi
permi setup --api-key YOUR_API_KEY_HERE
permi scan ./your-codebase
Enter fullscreen mode Exit fullscreen mode

(You can get a free API key from openrouter.ai for a few test calls).

What I want to know:

  • Did the setup run smoothly on your OS?
  • Did the AI filter accurately catch false positives?
  • What features are missing?

If you don't have the time to run it, but have a public GitHub repo, drop the link in the comments or DM me. I will run the scan for you and send you the PDF report and Excel workbook.

I would love to hear your thoughts on the architecture, the AI filtering approach, or the output format.

Thanks for reading, and happy building! 🚀

Top comments (0)