Permi scans live websites and source code for vulnerabilities, then uses AI to filter out false positives — so you only see findings that matter. No cloud. No login. Just install and scan.
Most security tools do one or the other. Permi does both — from a single install, with a single CLI command.
Point Permi at any website. It crawls the pages, injects test payloads into parameters, and checks security headers on the running application. No source code access needed.
permi scan --url https://yoursite.com
Point Permi at a local folder or GitHub URL. It reads your code, matches vulnerability patterns, and catches issues before they ever reach production.
permi scan --path ./myapp
Most security tools were built for enterprise teams in San Francisco. Permi was built for developers in Lagos, Jos, Abuja — and everywhere else where good security tooling should not cost more than a developer earns.
Every finding is reviewed by an LLM before you see it. Real vulnerabilities surface. Noise disappears.
Crawls pages, tests SQL injection payloads, checks XSS, and audits security headers on any running website.
USSD gateway vulnerabilities, Paystack and Flutterwave secret key detection, NDPR-relevant checks. No foreign scanner understands this market.
No cloud backend. No login. Scans run on your machine.
Use --offline
to skip AI calls when your connection is slow.
Scan any public GitHub repository directly. Permi clones it, scans it, and deletes the clone automatically.
Install for free. Use forever. The core scanner engine is open source. No credit card. No trial period.
Coverage across both scan modes. Web scanning tests your running application. Source scanning catches issues before they ship.
Be the first to know when the VS Code extension, NDPR compliance reports, and Pro tier launch. No spam. Unsubscribe anytime.
Already installed? Give us a ⭐ on GitHub — it helps more developers find Permi.