Launched this week
TriageKit
Security triage for pull requests, repositories & web apps
2 followers
Security triage for pull requests, repositories & web apps
2 followers
TriageKit is an open-source Python security platform for GitHub pull-request triage, repository scanning, and authorized web assessments. It combines static and heuristic analysis, risk scoring, Python/JavaScript/TypeScript taint analysis, OSV dependency intelligence, finding correlation, and AI-assisted security reasoning. Use it through a CLI, FastAPI dashboard, or optional React UI, with JSON reports and OpenAI-compatible providers—including local Ollama models or Nvidia Nim.
Free
Launch Team
AWS Activate CreditsCredits that fuel your startup’s next milestone
Promoted
Why I built TriageKit
I built TriageKit because I wanted to make application security testing more accessible, practical, and connected to the way developers actually work.
Security issues can be scattered across pull requests, repositories, dependency reports, and web applications. Finding vulnerabilities is only part of the challenge. Understanding their severity, connecting related findings, prioritizing what matters, and deciding what to fix first can be just as difficult.
I wanted to bring these workflows together in one open-source platform.
TriageKit combines static and heuristic analysis, risk scoring, Python/JavaScript/TypeScript taint analysis, OSV dependency intelligence, finding correlation, and AI-assisted security reasoning. It supports GitHub pull-request triage, repository scanning, and authorized web assessments, with access through a CLI, FastAPI dashboard, or optional React interface.
Another important goal was flexibility. Developers should be able to use different AI providers, including OpenAI-compatible services, local Ollama models, and Nvidia NIM, rather than being locked into one provider or workflow.
I built TriageKit to be useful for developers who care about security, independent researchers, and teams that want better visibility into the security of their code without adding unnecessary complexity.
Most importantly, I want it to evolve through real-world use and community feedback.
What feedback would help me most?
I'd especially appreciate feedback on:
Detection quality: Are the findings accurate? Where do you notice false positives or missed vulnerabilities?
Risk prioritization: Do the severity levels and risk scores help you decide what to fix first?
Developer experience: Is the CLI, dashboard, and overall workflow intuitive? What feels confusing or unnecessarily complicated?
Language and framework coverage: Which additional languages, frameworks, or vulnerability classes should I prioritize?
GitHub integration: Does the pull-request triage workflow fit naturally into your development process?
Dependency intelligence: Is the dependency analysis useful, and what would make it more actionable?
AI-assisted analysis: Does it provide meaningful context and reasoning, and which model providers or capabilities would you like to see supported?
Missing features: What would make TriageKit genuinely useful in your everyday security workflow?
Honest criticism, bug reports, feature requests, and real-world test results are all welcome. Even a small piece of feedback can help shape the project's direction.
TriageKit is open source, and I'd love to build something genuinely useful with the developer and security community.
Give it a try, challenge its findings, and tell me what could be better.