bydemodevsIdentity not verifiedAnnounced Nov 6, 2026
Audits dependencies, scans for secrets, models threats.
Sec Sweep runs three security passes over a project and keeps the model for what a tool cannot do. The dependency audit runs your ecosystem's own audit tool, then checks for each advisory whether the vulnerable code is reachable from yours, and names the upgrade that fixes it. The secret scan is plain code over tracked files, env files and recent history, with a stable ID per finding, so what you accepted stays accepted. The threat model is written to a fixed method: inputs, trust boundaries, checks, storage, failure modes.
Usage
Start Audit dependencies: it reads the lockfiles, runs the audit tool of each ecosystem it finds, and triages the result.
Start Scan for secrets before a push.
Start Threat model with the part of the code you are working on ("the upload handler").
What it produces
A Markdown report per pass in security/, named by pass and date. The audit lists each advisory as reachable, not reachable or unknown, with the call path when it found one and the upgrade that fixes it. The scan names the file, the line and the kind of secret, never the secret itself. The threat model lists the risks most severe first, with the check that would close each one.
Configuration
security/ignore.txt: finding IDs you accepted, one per line, with the reason after #.
ecosystems (default: detected): which audit tools to run.
history (default 50 commits): how far back the secret scan looks.
Notes
The audit's advisory lookup needs network access; the secret scan and the threat model work offline.
Treat a threat model as the start of a conversation, not as a sign-off.
