A free review of your source code that runs on your own machine. Point it at a project folder and it checks 55 rules for committed secrets, injection and unsafe constructs, and risky infrastructure code. One file. No installer, no account, no network access, so the code never moves.
Double-click to run. Works on Intel and Apple silicon.
Download · 81 KBSHA-256 b92ee376a207bfb2c281f80acad996426f8084ceb130e9847badd870fe19c053
Double-click to run. Windows 10 and 11.
Download · 81 KBSHA-256 b1067d8324b1f7a9559684d1264904ec126785e6df017102a43ce2b77398fcf1
The bare file, for a shell or a CI job.
Download · 79 KBSHA-256 90424b6ff2671c074cbab0f2b32f19c3e2a79dbed193bae5abed2157eb7e649d
It needs Python 3.9 or later.
Most Linux distributions have it. On a Mac it comes with the Command Line Tools, which macOS offers to
install the first time you run python3. On Windows, install it from python.org and tick
“Add python.exe to PATH”. The launcher tells you if it is missing.
Unzip, then double-click Run code review. It asks you to drag in the project folder (or a zip of it), writes an HTML report beside the folder, never inside it, and opens it.
xattr -dr com.apple.quarantine ~/Downloads/securexcel-code-review-macos
Or open System Settings → Privacy & Security and press Open Anyway. It is a one-time step, and the command line below is the same engine if you would rather not run an unsigned launcher.From a shell, or a CI job:
python3 securexcel-code-review.pyz ./my-project --format html
python3 securexcel-code-review.pyz ./my-project --format sarif --fail-on high
python3 securexcel-code-review.pyz --rules
| Secrets and keys committed to source | 11 rules. Private keys, cloud and service tokens, hard-coded passwords, credentials in connection strings. |
|---|---|
| Dangerous code constructs | 23 rules. Injection, unsafe deserialisation, weak cryptography, disabled certificate checks, XSS sinks. |
| Risky infrastructure code | 16 rules. Terraform, Kubernetes, Dockerfiles and GitHub Actions workflows. |
| How dependencies are declared | 3 rules. Unlocked, unpinned or insecurely sourced dependencies, and install scripts that run remote code. |
| Review hygiene | 2 rules. Security TODOs left in code and security linters switched off. |
Every finding gives the rule, the files and line numbers, why it matters and
how to fix it, with CWE and OWASP references. The same code always produces the same findings. Run
--rules to list all 55.
node_modules and virtual environments are counted and
skipped.It is a pattern-based review. It does not build or run your code, or follow data through it, so it cannot find logic flaws, broken access control, or most injection that depends on where a value came from. It does not match dependency versions against vulnerability databases. A clean report is not a security assessment. For that, talk to us about a penetration test.
No. The tool contains no networking code, and the build refuses to produce a file if any can be reached. It reads the folder you point it at, writes one report file beside it, and runs nothing from the project.
It is the same engine and the same rules. The online review takes a zip of up to 8 MB from a signed-in user and keeps an encrypted copy of the report. The offline tool reads a folder directly, needs no account, writes SARIF for CI, and can fail a build on findings.
Yes. Use --format sarif for GitHub code scanning and other tools, and --fail-on to set the severity at which it exits with an error.
20 programming languages, including Python, JavaScript, TypeScript, Java, Go, C#, PHP, Ruby, Kotlin and Rust, and configuration formats such as Terraform, Kubernetes YAML, Dockerfiles and JSON.
No. It checks how dependencies are declared, such as lockfiles and pinning, but matching versions against vulnerability databases needs an advisory feed and an internet connection, which this tool deliberately does not have.
No. It is a pattern-based review: it does not build or run your code or trace data through it, so it cannot find logic flaws or broken access control. Use it to catch the common, avoidable problems early.
Prefer not to install anything? The online source code review takes a zip from a signed-in user. For firewalls, there is the offline firewall configuration review.