Milens scans your codebase for secrets, injections, hidden unicode, dangerous patterns, and more — all in a single security_scan() call. OWASP Top 10 mapped.
A single command replaces multiple manual greps and hours of code review. Every finding includes the exact line and a fix suggestion.
Nine risk surfaces, 190+ rules. Every scan runs them all — no configuration required.
AWS keys, GitHub tokens, OpenAI API keys, private keys, hardcoded passwords, Stripe keys, Slack webhooks, JWT secrets, database credentials, certificate files
SQL injection, XSS, command injection, eval(), exec(), dangerouslySetInnerHTML, document.write(), innerHTML assignment, template injection
Zero-width characters, bidi override attacks (U+202E), homoglyph attacks, invisible character injection in identifiers and strings
os.system(), subprocess with shell=True, unsafe deserialization (pickle, yaml.load), spawn shell, arbitrary code execution, disable security warnings
CORS wildcards, insecure cookies (no HttpOnly/Secure), debug mode enabled in production, --skip-permissions, exposed .env files
console.log with secrets, hardcoded URLs with credentials, debug output in production, stack traces exposed, sensitive data in error messages
MD5 hashing, SHA1 hashing, Math.random() for cryptographic purposes, hardcoded salt, weak key generation, ECB mode encryption
String comparison for tokens, missing auth middleware, JWT with no expiry, hardcoded session secrets, weak password validation
Path traversal (../ attacks), unsafe file reads (fs.readFile with user input), directory listing enabled, ZIP slip vulnerability
Also checks your dependencies against 34 known CVEs across all major ecosystems. Offline, fast, built-in.
Milens rules cover common vulnerability categories mapped to OWASP Top 10. Pass your audit with a single command.
| OWASP | Category | Rules |
|---|---|---|
| A01 | Broken Access Control | SEC-045 to SEC-048 |
| A02 | Cryptographic Failures | SEC-001 to SEC-010 & SEC-041 to SEC-044 |
| A03 | Injection | SEC-011 to SEC-019 |
| A05 | Security Misconfiguration | SEC-031 to SEC-035 |
| A07 | Identification & Authentication Failures | SEC-045 to SEC-048 |
| A08 | Software & Data Integrity Failures | SEC-028, SEC-029 |
| A09 | Security Logging & Monitoring Failures | SEC-036 to SEC-040 |
The core security scanner is free forever. Pro adds automation, custom rules, and CI integration.
| Feature | Free | Pro |
|---|---|---|
| 50 built-in rules | ✓ | ✓ |
| OWASP Top 10 mapping | ✓ | ✓ |
| CLI security scan | ✓ | ✓ |
| MCP security_scan tool | ✓ | ✓ |
| Dependency audit (offline) | ✓ | ✓ |
| Custom security rules | — | ✓ |
| GitHub App PR scanning | — | ✓ |
| Scheduled auto-scan | — | ✓ |
| Security annotations → auto-promote | — | ✓ |
| Priority fixes | — | ✓ |