🐱 HISSLOCK CLI

A fast, dependency-free Static Application Security Testing (SAST) scanner written in pure Python.

HISSLOCK CLI scans source code for exposed secrets, insecure coding practices, and common security misconfigurations before they reach production.

🏆 Hackathon

This project was submitted to the HackTheKitty Hackathon.

Participation Certificate: docs/hackthekitty-certificate.pdf

✨ Features

• 🔒 Detects 34+ security vulnerabilities
• 🚀 Pure Python (Zero external dependencies)
• ⚡ Multi-process scanning (2 CPU workers)
• 📁 Scan a single file or an entire project
• 🎨 Beautiful colored terminal output
• 📊 Severity classification
  • HIGH
  • MEDIUM
  • LOW
• 📝 JSON report export
• 🚫 Supports # nosec and // nosec ignore comments
• 🐍 Works on Windows, Linux and macOS
• 📦 Lightweight and easy to use

---

🔍 Detected Security Issues

HISSLOCK can detect many common security problems including:

Secrets & Credentials

• AWS Access Key
• AWS Secret Access Key
• Google API Key
• OpenAI API Key
• GitHub Personal Access Token
• Stripe Secret Key
• Twilio API Key
• Mailgun API Key
• SendGrid API Key
• Square Access Token
• Azure Storage Account Key
• Private Enterprise API Keys
• Authorization Bearer Tokens
• X-API-Key Headers
• Hardcoded Passwords
• High Entropy Secrets
• Database Credentials
• RSA/OpenSSH Private Keys
• JWT Tokens
• Discord Webhooks
• Slack Tokens
• UPI IDs

---

Insecure Code Detection

• eval()
• exec()
• os.system()
• subprocess(shell=True)
• pickle deserialization
• Weak Hash Algorithms (MD5/SHA1)
• SSL Verification Disabled
• FTP Usage
• Debug Mode Enabled
• Binding to 0.0.0.0
• Hardcoded Public IP Addresses
• Internal API Endpoints
• Localhost/Test URLs
• Assert Used for Security Checks

---

📦 Installation

Clone the repository

git clone https://github.com/RohanCodx/HISSLOCK-CLI.git
cd HISSLOCK-CLI

No installation is required.

Simply run

python hisslock.py

---

🚀 Usage

Scan a directory

python hisslock.py --path ./project

Scan a single file

python hisslock.py --path app.py

Generate JSON report

python hisslock.py --path ./project --json

Display help

python hisslock.py --help

---

📄 JSON Output

Using the --json flag generates

hisslock_report.json

The report contains

• Scan time
• Target path
• Total scanned files
• Total issues
• Severity
• Line number
• Code snippet
• Security recommendation

---

🚨 Severity Levels

Severity	Meaning
🔴 HIGH	Critical vulnerabilities that should be fixed immediately
🟡 MEDIUM	Potential security risks requiring attention
🔵 LOW	Security best-practice recommendations

---

🚀demo

Video.Project.mp4

---

🚫 Ignore Rules

To ignore a specific finding, append one of the following comments to the line.

Python

password = "example"  # nosec

Other languages

const password = "example"; // nosec

---

⚙️ Supported File Types

• Python
• JavaScript
• TypeScript
• Java
• Go
• PHP
• Ruby
• C#
• Shell Scripts
• JSON
• XML
• YAML
• TOML
• INI
• ENV
• CFG
• Terraform
• HCL
• Properties
• Conf files

---

💡 Why HISSLOCK CLI?

Modern software development moves fast, but security mistakes are expensive. A single leaked API key, hardcoded password, or unsafe function can lead to compromised systems, data breaches, or financial loss.

HISSLOCK CLI is designed to catch these issues early—before your code reaches production.

Unlike many security scanners that require large installations, cloud services, or complex configuration, HISSLOCK focuses on simplicity, speed, and portability. It runs entirely in pure Python with zero third-party dependencies, making it easy to integrate into any development workflow.

🚀 What Makes HISSLOCK Different?

• Zero Dependencies
  No external libraries or packages are required. Clone the repository and start scanning immediately.

• Fast Static Analysis
  Uses parallel processing with multiple CPU workers to scan projects efficiently while maintaining low resource usage.

• Developer-Friendly Output
  Every finding includes the affected file, line number, severity, code snippet, and a practical remediation tip—making vulnerabilities easy to understand and fix.

• Actionable Reports
  Generate machine-readable JSON reports for automation, CI/CD pipelines, dashboards, or further analysis.

• Low False Positives
  Supports # nosec and // nosec comments, allowing developers to intentionally suppress findings where appropriate without disabling entire rules.

• Cross-Platform
  Works consistently on Windows, Linux, and macOS.

• Security-First Rule Set
  Detects exposed secrets, insecure coding practices, weak cryptography, dangerous function usage, misconfigurations, and many other common security risks.

• Lightweight by Design
  No background services, databases, Docker containers, or internet connection are required.

🎯 Ideal Use Cases

HISSLOCK CLI is suitable for:

• Individual developers
• Open-source projects
• Security researchers
• Development teams
• Code reviews
• CI/CD pipelines
• Pre-commit security checks
• Educational environments
• Internal security auditing

By identifying vulnerabilities during development, HISSLOCK helps reduce security risks, improve code quality, and encourage secure coding practices with minimal setup and maximum portability.

---

👨‍💻 Author

RohanCodx

If you found HISSLOCK useful, consider giving the repository a ⭐.