Find the risk. Trace the path. Fix it. Verify it. Remember it.
Mini Ora is a private security assistant for developers. It works locally to find security risks in code and projects, explain why they matter, trace dangerous paths, provide remediation guidance, and help you confirm a fix actually resolved the problem — then remembers it, so a regression can’t sneak back in unnoticed.
● Signed & notarized · Apple Developer ID: Dan Aridor (6JBK94Z45M) · Local static analysis, encrypted rule pack, restricted to the project folder
This is the whole point of Mini Ora: not one more list of warnings, but a loop that ends with the risk actually resolved.
Find meaningful security risks in the files and projects you're working in.
Understand how dangerous data reaches a sensitive operation — source to sink, in plain terms.
Get practical remediation guidance for the specific pattern that fired, not a generic checklist.
Re-check the original condition after your change, so "fixed" means confirmed, not assumed.
Keep local security history — resolved findings, accepted risks, and regressions — so noise drops over time.
Every check is a pattern SPR{K3 has seen lead to a real compromise. When one fires, Mini Ora marks the line, explains the risk, and shows it in the editor, the Problems panel, a notification, and the SPR{K3 security view.
Untrusted input reaching pickle.load / pickle.loads — a direct path to arbitrary code execution.
Risky torch.load usage that can execute code hidden inside a checkpoint.
Model paths that enable trust_remote_code, running third-party code from a downloaded repo.
User-reachable eval and exec that turn data into executable code.
Unsafe subprocess patterns that let input become a shell command.
API keys, tokens, passwords and credentials committed straight into source.
weights_only=True.Inline findings, explanations, and remediation while you're typing — the experience shown throughout this page.
The same local engine from the terminal — mini-ora scan . — for anyone who'd rather not leave the shell.
Check security-relevant changes before they're committed, using the files already staged.
Coding agents generate large amounts of working code quickly — but generated code still needs independent security review. Generation and verification shouldn’t be the same job.
Same local analysis as everywhere else on this page — no cloud AI required to review what an agent wrote.
SPR{K3 watches every point where code, models, or instructions cross a trust boundary. Mini Ora is the earliest of them — it verifies trust as you write it, so the same research that powers the runtime agent reaches you before the code even exists on disk elsewhere.
Static analysis on the line you're typing. Dangerous patterns flagged before run.
Scan the codebase and model artifacts for supply-chain risk, unsafe deserialization, and lineage gaps.
The Defend agent watches the running system for orchestration drift, prompt injection, and tool misuse.
Static, runtime, and behavioral signals correlated into one continuous trust score.
Each layer alone is useful. Together they close the gap between a risky line of code and a runtime breach — the same reason a downloaded file executing twelve seconds later is a finding for Defend, not just an event. See the full platform →
Mini Ora — know your code. · Defend — know its behavior. · SPR{K3 — trust what you build. Trust what you run.
A dependency with a known CVE, a workflow with too much trust, a secret that leaked through CI rather than source — these live at the boundaries around your code, not inside one function. Mini Ora watches the line you're writing right now; the at-rest layer of the SPR{K3 platform (Ora) is what looks at code, dependencies, CI/CD, and containers together.
Mini Ora, live in the editor — this page.
Supply-chain risk across what your project pulls in.
Trust boundaries in the pipelines that build and ship your code.
What ends up in the image that actually runs.
The extension sends it to the local agent over an authenticated connection on 127.0.0.1.
Detection runs entirely on your Mac, inside the folder you opened — nowhere else.
Each result names the line, the risk, and the fix, and appears everywhere VS Code shows problems.
Previous findings and the risks you've accepted inform future results, so the noise drops over time.
Mini Ora 0.9.0 is a focused public beta, not a replacement for a full SAST platform. It ships six targeted detection classes for Python and configuration files, and coverage grows as beta users put it to work. What it catches, it catches immediately, privately, and inside the editor.
Enter your email and we send a one-time link (valid 30 minutes). The confirmation page shows your mo_beta_ activation token once. Tokens work for 120 days on up to two Macs and can be revoked. No account, no password.
Security shouldn’t be measured by how many warnings a tool generates. It should be measured by whether developers can resolve the risks that matter.
Find the risk. Trace the path. Fix the problem. Verify the result. Remember what happened.
Get Mini Ora