From Theory to Practice: Three Small Tools for Big Security Problems

In 2023 I wrote about my first steps in cybersecurity. It was a course summary: network topologies, Red Team vs Blue Team, PTES. It was useful, but it was missing something: building something.So I built three tools. None of them tries to be huge. Each one answers a simple question that every team should be able to answer, and most can't. The problem that doesn't show up in your code We write code faster than ever, often with AI help. Two problems grow right alongside that speed. The first is dependencies. A Python project has dozens of packages, and each one has its own packages inside. Nobody reads all of that. Nobody. A vulnerability can sit there for months, and you only find out when someone else finds it first. The second is secrets. Ask an AI to put together a quick integration and there's a good chance the API key lands right in the source code, instead of coming from an environment variable or a secrets manager. It works, the test passes, the commit goes up. And the secret stays in your Git history forever, even if you delete it on the next line. Spoiler: git rm is not a time machine. The AI isn't the villain here. It takes the shortest path, and the shortest path is rarely the safest one. Reviewing is our job. "The AI wrote it" is not a defense in a postmortem. sBOMBox: What do I have? The first question is: which vulnerable packages are in my project? sBOMBox reads your dependency files (poetry.lock, uv.lock, Pipfile.lock, requirements.txt), generates a CycloneDX SBOM, and checks OSV, the GitHub Advisory Database and NVD. If it finds anything HIGH or CRITICAL, it fails the CI. One decision I like: .vulnignore only accepts advisory IDs (CVE, GHSA, PYSEC). Ignoring by package name is rejected on purpose, because it would silence every future finding for that package. Ignoring a vulnerability should be a conscious decision, with a reason and a review date, not a shortcut to make the pipeline green. The Fresh Prince BMBOX By Elena Kazi - The Toy Chronicle sBOMBPath: Does it actually affect me? A list of CVEs alone creates a different problem: alert fatigue. Not every vulnerability in a dependency is exploitable in your code. If you never call the vulnerable function, your real risk is something else. sBOMBPath tries to answer that. It analyzes your Python code and follows user input until it reaches dangerous functions (sinks). You can feed it the sBOMBox report, and it tells you which findings have a real path into your code. It has limits, and I made them explicit in the README: it doesn't see reflection or getattr, and the route mapping is aimed at Django/DRF. A tool that tells you where it doesn't work is more trustworthy than one that promises everything. Be suspicious of any scanner that claims zero false negatives. A tiny bridge in a corridor full of traps : r/battlemaps KeyScan: What did I leave behind? The third question is about secrets: what has already leaked? KeyScan searches for credentials in your current files and in your Git history, with about 65 patterns (cloud, payments, CI, AI APIs, chat and more) plus an optional entropy heuristic. It can also check whether a secret is still active, because a leaked key that was already revoked and a leaked key that still works are not the same emergency. It also has a pre-commit hook and a GitHub Actions workflow, to stop the problem before it gets in. By default it skips .env files, because that is where secrets are supposed to live. The mistake it hunts is the secret showing up anywhere else. Flipper Zero : Empower Your Security Journey with The Ultimate Portable Multitool for CybersecurityWhat the three have in common All three use only the Python standard library. No pip install, no infrastructure, no account. You clone, run, and read the report. That's not a coincidence. It's the same idea behind ArtemisFlow: a security tool that needs a week of setup ends up unused. If running it is cheap, running it becomes a habit. And a habit beats a fancy dashboard that nobody opens. The three also connect: sBOMBox: which vulnerable packages do I have? sBOMBPath: of those, which can my code actually reach? KeyScan: which secrets did I leave behind? What I learned Security is not a phase at the end of the project. It's a question you ask every time the code changes, and the best way to make sure it gets asked is to automate it in CI. If it depends on someone remembering, it won't happen. I also learned that building is the best way to study. I understood far more about CVEs, SBOMs and taint analysis by writing the tools than by reading about them. And AI, in this scenario, is a great partner with one condition: review what it writes. It writes fast, but you are the one answerable for the code. None of this is rocket science. It's the basics, done consistently, and most of us skip the basics because they're boring. Security doesn't need to be complex to be useful. It needs to be simple enough to run every single time. GHOST IN THE SHELL