Security checks outside a managed engineering pipeline
Local secret scanning and static analysis for solo builders, small teams, and people working with coding agents. It runs before code leaves the machine through a Git push.
Open source · v0.1.2
The problem
Coding agents make it easier to build software without an established engineering team or development pipeline. The security checks that normally surround that work do not necessarily come with it. Hosting a repository on GitHub or another platform does not mean those checks have been configured. I wanted a practical way to bring secret scanning and static analysis into the local Git workflow, rather than assume a managed pipeline would catch mistakes later.
What I built
I added parallel checks, normalized and deduplicated findings, and Git-hook integration around Gitleaks and Semgrep.
- A Ruby CLI and Git-hook integration that runs Gitleaks and Semgrep and combines their findings.
- Finding deduplication, changed-file workflows, and SARIF output in the canonical Ruby implementation.
- Optional model-assisted triage, with the underlying scanner results still available when that assistance is unavailable.
The engineering decision
Put the checks where the code is being built.
I brought the two scanners into one pre-push workflow, with parallel execution, a consistent finding format, and deduplication. Changed-file support keeps the workflow focused, while SARIF makes the results usable by other tools.
I kept the detection engines independent. Optional model-assisted triage adds context, but scanner results remain available without it. The workflow is my contribution; Gitleaks and Semgrep supply the detection capabilities.
Workflow illustration · synthetic data
Bring independent checks into one review.
The scanners find issues. Zwischen coordinates the workflow and normalizes their output.
$ zwischen scan
Scanners Gitleaks + Semgrep
Normalize Consistent findings
Review Inspect before pushing
Optional model triage adds context.
Scanner results remain the foundation.A workflow illustration, not a live scan. No repository, file, or command is accessed.
What I checked
- Public source implements both scanner runners, the combined result pipeline, hook integration, and structured output.
- The public repository includes a v0.1.2 release and a successful CI run.
- Tests cover orchestration and result handling; the Ruby implementation is the reference for the capabilities described here.
Limits
- Findings still need review. The checks do not certify an application as secure. The pre-push hook must be installed, can be bypassed, and cannot cover code shared or deployed outside that Git workflow.
- The npm and pip wrappers do not have feature parity with the Ruby implementation.
Tools and foundations
I built Zwischen’s orchestration and developer workflow. Gitleaks and Semgrep are independent scanning engines; optional model providers supply the triage assistance.