Alternatives
Products that do what nukon-pi-detect does
Tiny, offline prompt-injection scanner for CI pipelines
- 1
- 2AM
I made an open source, MIT license Typescript library based on some of the latest research that generates prompt injection attacks. It is a super minimal/lightweight and designed to be super easy to use. Keen to hear your thoughts and please be responsible and only pen test systems where you have permission to pen test!
2025 · prompt-injector.blueprintlab.io
- 3SL
I made a free tool that stuns LLMs with invisible Unicode characters. *Use cases:* Anti-plagiarism, text obfuscation against LLM scrapers, or just for fun! Even just one word's worth of “gibberified” text is enough to block most LLMs from responding coherently.
Nov 2025 · gibberifier.com
- 4IM
2024 · github.com
- 5PP
Hey HN, I've been working on an intercepting proxy for penetration testing over the last few years in my spare time. Some points of difference from the existing tools: * The UIs are built using the native platform frameworks, meaning they look and behave like other applications on the desktop. * It has a fully embedded and integrated Python scripting engine. * It’s fully native meaning it’s nicer on system resources. * It has a number of built in scripts to automate reconnaissance, content discovery, authorisation checks, etc. * The core of it is open source. I'm really keen to get any…
2023 · pakikiproxy.com
- 6AL
Hi HN, I’m one of the maintainers of Bridge Anonymization. We built this because the existing solutions for translating sensitive user content are insufficient for many of our privacy-concious clients (Governments, Banks, Healthcare, etc.). We couldn't send PII to third-party APIs, but standard redaction destroyed the translation quality. If you scrub "John" to "[PERSON]", the translation engine loses gender context (often defaulting to masculine), which breaks grammatical agreement in languages like French or German. So we built a reversible, local-first pipeline for Node.js/Bun. Here…
Dec 2025 · medium.com
- 7
Proves vulnerabilities before reporting them.
9d ago · dashboard-seven-self-13.vercel.app
- 8IB
I built a GitHub app that detects it in pull requests, notifies or blocks them. Alongside it, I published a Semgrep ruleset for any stage of the CI/CD. I started this after getting frustrated by all the FUD around malicious code - lots of noise, little effort to solve it. Having said that, it's still a major attack vector - a stored RCE, with the codebase itself as the sink. Feedback is appreciated. The app, PRevent - https://github.com/apiiro/PRevent The ruleset: https://github.com/apiiro/malicious-code-ruleset The research:…
2025 · github.com
- 9KD
I built this after seeing multiple teams accidentally ship API keys in their frontend code. The problem: Modern web development moves fast. You're vibe-coding, shipping features, and suddenly your AWS keys are sitting in a tag visible to anyone who opens DevTools. I've personally witnessed this happen to at least 3-4 production apps in the past year alone. KeyLeak Detector runs through your site (headless browser + network interception) and checks for 50+ types of leaked secrets: AWS/Google keys, Stripe tokens, database connection strings, LLM API keys (OpenAI, Claude, etc.), JWT…
Nov 2025 · github.com
- 10LC
2023 · github.com
- 11
- 12RR
I wanted a safer alternative to RegExp for TypeScript that uses a linear-time engine, so I built Regolith. Why: Many CVEs happen because TypeScript libraries are vulnerable to Regular Expression Denial of Service attacks. I learned about this problem while doing undergraduate research and found that languages like Rust have built-in protection but languages like JavaScript, TypeScript, and Python do not. This library attempts to mitigate these vulnerabilities for TypeScript and JavaScript. How: Regolith uses Rust's Regex library under the hood to prevent ReDoS attacks. The Rust Regex library…
2025 · github.com
- 13PS
What PII-Shield does: It's a K8s sidecar (or CLI tool) that pipes application logs, detects secrets using Shannon entropy (catching unknown keys like "sk-live-..." without predefined patterns), and redacts them deterministically using HMAC. Why deterministic? So that "pass123" always hashes to the same "[HIDDEN:a1b2c]", allowing QA/Devs to correlate errors without seeing the raw data. Key features: 1. JSON Integrity: It parses JSON, sanitizes values, and rebuilds it. It guarantees valid JSON output for your SIEM (ELK/Datadog). 2. Entropy Detection: Uses context-aware entropy…
Feb 2026 · github.com
- 14KL
LLM agents often place raw JSON tool outputs directly in the prompt. After a few tool calls, earlier results get compacted or truncated and answers become incorrect or inconsistent. I built Sift, a drop-in MCP gateway that stores tool outputs as local artifacts (filesystem blobs indexed in SQLite) and returns an `artifact_id` plus compact schema hints when responses are large or paginated. Instead of reasoning over full JSON in the prompt, the model runs a small Python query: def run(data, schema, params): return max(data, key=lambda x: x["magnitude"])["place"] Query code runs in a…
Mar 2026 · github.com
- 15
Just stop jailbreaks & prompt hacks with one API call.
Sep 2025
- 16
- 17CS
Hi everyone, GitHub's CodeQL is a powerful semantic code analysis engine for identifying vulnerabilities across codebases. We've extended CodeQL to support Solidity, the most popular programming language for smart contracts. CodeQL enables you to query code as though it were data, and it's open-source (OSS). You can check it out here: . The product page is available at . CodeQL has its own licensing model, which you can find at https://codeql.github.com/. TL;DR: CodeQL is free for research and open-source projects.
2024 · github.com
- 18
- 19
Anonymize prompts privately and securely
Apr 2026 · ergesmema.github.io
- 20CL
With the right technique, I was able to break the so-called secure models like Claude and OpenAI. So, I built an open-source tool to automate this and find security holes in any hosted model. I got claude-sonnet-4 to demonstrate the following harmful behavior: - steal data from downstream tool calls using sql injection, code injection and template injection attacks - install spyware or malware using prompt obfuscation to send data to a third-party server Try it yourself with this simple command: pip install compliant-llm && compliant-llm dashboard
2025 · github.com
- 21
- 22
Hello HN! I built a pre-commit code scanner that checks your staged changes for security vulnerabilities every time you run 'git commit'. I am an inexperienced programmer and this is my first personal project. Any feedback, positive or negative, big or small, relevant or not, would be greatly helpful and appreciated! The tool requires Gitleaks and Python to run, you will also need to use your own AI API key, which I understand is a big setup friction. You can check out my demo video instead if that is more convenient: https://youtu.be/ZYe5vWFRTus?si=9Fv8DhTHktwDK4mV Thank you…
Jun 2026 · github.com
- 23
- 24
Ranked by how close each launch is in meaning, then by votes. Refine with a description →