I disappeared for 5 months to build a security scanner. Here is what I learned (and how you can break it).

说明与用途

Permi 是为非洲金融科技和医疗科技量身定制的开源安全扫描器，解决本地漏洞、降低误报，并生成合规报告。

问题

Global security scanners miss local fintech/healthtech vulnerabilities and generate many false positives, making them ineffective for regulated African ecosystems.

结果

Permi reduces false positives by ~95% and produces compliance documentation tailored to African fintech/healthtech contexts.

工作流

• Install Permi via pip
• Run "permi setup --api-key YOUR_API_KEY_HERE" to configure OpenRouter API
• Execute "permi scan ./your-codebase" to scan the repository
• AI filters findings and outputs a 20‑item governance checklist
• Generate Excel Readiness Workbook and PDF report

证据

global scanners like Snyk or Semgrep are great—until you realize they don't know what a BVN (Bank Verification Number) or a USSD session flaw looks like.

来源

AI Noise Reduction: Passing the raw findings to an LLM (via OpenRouter) to verify if a finding is a real vulnerability or a false positive. This cuts the noise by ~95%.

来源

The "Evidence" Problem: Compliance officers (DPOs) can't read terminal output. So I built a system that takes the technical scan and pairs it with an automated 20-item governance checklist, generating a complete Excel Readiness Workbook and PDF report.

来源