I disappeared for 5 months to build a security scanner. Here is what I learned (and how you can break it).

Описание и применение

Permi – это открытый сканер безопасности, созданный для финтеха и здравоохранения в Африке, который решает проблемы локальных уязвимостей и ложных срабатываний, используя правила, ИИ и генерирует отчёты для комплаенса.

Задача

Global security scanners miss local fintech/healthtech vulnerabilities and generate many false positives, making them ineffective for regulated African ecosystems.

Результат

Permi reduces false positives by ~95% and produces compliance documentation tailored to African fintech/healthtech contexts.

Рабочий процесс

• Install Permi via pip
• Run "permi setup --api-key YOUR_API_KEY_HERE" to configure OpenRouter API
• Execute "permi scan ./your-codebase" to scan the repository
• AI filters findings and outputs a 20‑item governance checklist
• Generate Excel Readiness Workbook and PDF report

Доказательства

global scanners like Snyk or Semgrep are great—until you realize they don't know what a BVN (Bank Verification Number) or a USSD session flaw looks like.

Источник

AI Noise Reduction: Passing the raw findings to an LLM (via OpenRouter) to verify if a finding is a real vulnerability or a false positive. This cuts the noise by ~95%.

Источник

The "Evidence" Problem: Compliance officers (DPOs) can't read terminal output. So I built a system that takes the technical scan and pairs it with an automated 20-item governance checklist, generating a complete Excel Readiness Workbook and PDF report.

Источник