Back to feed
Dev.to
Dev.to
7/9/2026
I built an offline CLI that audits a legacy PHP app in one command — and shows you the fix

I built an offline CLI that audits a legacy PHP app in one command — and shows you the fix

Short summary

Observer is an offline Go CLI that audits legacy PHP, Python, JavaScript, Java, and Ruby codebases for security vulnerabilities and code health in one command. It runs locally with zero cloud overhead or telemetry, flags high-impact issues like hardcoded secrets and SQL injection with concrete before/after fixes, and exports findings to SARIF, JSON, CSV, or GitHub Actions. Free, MIT-licensed, and built for legacy app handovers, quick audits, and regulated environments where code cannot leave the machine.

  • •Offline CLI for auditing legacy code across PHP, Python, JavaScript, Java, Ruby — no cloud account required
  • •Flags high-impact security issues (hardcoded secrets, SQL injection, XSS) with concrete before/after fixes and severity ratings
  • •Free and MIT-licensed; exports to SARIF, JSON, CSV, GitHub Actions; includes optional paid add-ons for branded reports and scheduled scans

Generated with AI, which can make mistakes.

#product-launch#open-source#ai-tools#certification-education
Read full article at Dev.to

Is this a good recommendation for you?

Comments

Failed to load comments. Please try again.

Explore more

New tool audits Supabase, Firebase, Appwrite, PocketBase, Nhost security leaks
Dev.to
I Built a Dashboard to Make Security Reports Easier to Read
Dev.to
Shadowaudit: a static scanner for undocumented and unauthenticated Express.js routes
Dev.to
The original title is "I open-sourced a Solidity security scanner with 0 false positives on all of OpenZeppelin"
Dev.to