pip install torlyx

To enable the dependency vulnerability audit, install with the audit extra:

pip install 'torlyx[audit]'

cd my-app
torlyx scan .

No configuration file, no account, no API key. Analysis runs locally — the only optional network call is the dependency audit. Every finding includes a plain-English explanation of the risk and a concrete fix:

  ⚡ TORLYX SECURITY SCAN
  Scanned 47 files in 1.2s

  🔴 CRITICAL  TLX-S003 · Stripe live key exposed
     app/config.py:12
     → Anyone who sees this code can charge cards on your Stripe account.
     Fix: STRIPE_KEY = os.getenv("STRIPE_KEY")

  🔴 CRITICAL  TLX-F001 · Unprotected DELETE endpoint
     app/routes/users.py:34 → DELETE /users/{id}
     → Anyone on the internet can call this endpoint and change your data.
     Fix: def delete_user(id: int, user=Depends(get_current_user)):

  ─────────────────────────────────────────────
  Security Score: 38/100
  2 critical · 1 warning · 28 checks passed

• Zero configuration. A single command with sensible defaults.
• Fast. Pure-Python AST analysis; a typical project scans in seconds.
• Framework-aware. Understands FastAPI auth in all its forms — router-level dependencies, Annotated[..., Depends(...)], and include_router dependencies — so it reports real gaps rather than false positives.
• Readable. Findings are written for developers, not security auditors. No jargon; every finding ships with a fix.
• Private. Code never leaves the machine.

Torlyx CLI v0.1 ships 31 rules across five categories.

False positives are treated as bugs. Test and fixture directories are skipped by the secrets rules, common placeholder values are recognized, and login, signup, and webhook routes are exempt from the authentication rule. Any individual line can be suppressed with a trailing comment:

STRIPE_TEST_KEY = "sk_test_example"  # torlyx:ignore

Add a workflow such as .github/workflows/security.yml:

name: security
on: [push, pull_request]
jobs:
  torlyx:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - run: pip install 'torlyx[audit]'
      - run: torlyx scan . --fail-on critical

v0.2: Next.js/React support (npx torlyx), plus --ai-fix export and YAML custom rules · v0.3: Laravel + Inertia support (composer require torlyx/laravel → php artisan torlyx:scan)

The core — findings, scoring, and reporting — is language-agnostic. New stacks plug in as parser backends via tree-sitter, distributed through npm and Composer wrappers around a compiled binary.

git clone https://github.com/khadikul/torlyx-cli
cd torlyx-cli
pip install -e ".[dev]"
pytest

Every check module implements run(context) -> list[Finding] and is registered automatically; adding a rule never requires changes to the orchestrator. Validate changes against the two fixture applications: tests/fixtures/vulnerable_app must trigger every rule, and tests/fixtures/clean_app must produce zero findings.

Released under the MIT License.

Torlyx CLI is the open source scanner from the Torlyx security platform.