A security scanner that ships as one Python file with zero dependencies — built in the open, under the MIT licence, by one maintainer.
Loophole is an open-source static security scanner for JavaScript/TypeScript, Python, Go and PHP. It runs 50 security checks — hardcoded secrets, SQL/NoSQL/LDAP injection, XSS, command injection, unsafe uploads, broken JWT and TLS settings, weak crypto and more — and explains every finding in plain language with a concrete fix.
Unlike a simple pattern matcher, Loophole performs lightweight taint tracking: it follows user input from where it enters the app (request parameters, form fields, superglobals) to the dangerous places it can end up (database queries, shell commands, HTML output), so findings are real, reachable problems — not keyword noise.
Most scanners are either heavyweight SaaS platforms with accounts and onboarding, or noisy grep scripts. Loophole sits in the middle: a single readable file you can drop into any project or CI pipeline in seconds. No install, no config file, no telemetry — and because it is built only on the Python standard library, the security tool itself adds no supply-chain risk.
It also ships as an official GitHub Action (rootsiemen/loophole@v1) that runs on every push and pull request and uploads SARIF results to your repository's Security tab. And yes — Loophole scans its own codebase clean on every change.
Loophole is created and maintained by Muhamad Raza Haider, a web developer who builds with Next.js, React and Python. You can follow the work — issues, releases and the roadmap — on GitHub at @rootsiemen. Contributions are welcome: a new rule is one focused function plus test fixtures, and the contributing guide walks through it.
Loophole on GitHub See all 50 checks Other tools by Raza