Private security assistant · Local-first

Security that stays with your code.

Find the risk. Trace the path. Fix it. Verify it. Remember it.

Your source code stays on your machine. Analysis runs 100% locally.

Mini Ora is a private security assistant for developers. It works locally to find security risks in code and projects, explain why they matter, trace dangerous paths, provide remediation guidance, and help you confirm a fix actually resolved the problem — then remembers it, so a regression can’t sneak back in unnoticed.

Signed & notarized · Apple Developer ID: Dan Aridor (6JBK94Z45M) · Local static analysis, encrypted rule pack, restricted to the project folder

BEFORE — SECURITY FINDING
unsafe_deserialization.py
1import pickle
2
3def load_untrusted(data: bytes):
4 return pickle.loads(data)
5
SPR{K3 FINDINGS
MO-DESER-001 · HIGH
Unsafe deserialization
Untrusted pickle data can execute arbitrary code during loading.
1 active finding
TRACE  external input → load_untrusted()pickle.loads()
AFTER — VERIFIED FIX
safe_deserialization.py
1import json
2
3def load_untrusted(data: bytes):
4 value = json.loads(data.decode("utf-8"))
5 return validate_schema(value)
SPR{K3 FINDINGS
MO-DESER-001 · RESOLVED
Unsafe deserialization removed
Previous finding remembered locally.
0 active findings
🔍 Find → Trace 🔧 Fix ✅ Verify 🧠 Remember 🔒 Source code stays on the Mac
The product loop

Find → Trace → Fix → Verify → Remember

This is the whole point of Mini Ora: not one more list of warnings, but a loop that ends with the risk actually resolved.

Find

Find meaningful security risks in the files and projects you're working in.

Trace

Understand how dangerous data reaches a sensitive operation — source to sink, in plain terms.

Fix

Get practical remediation guidance for the specific pattern that fired, not a generic checklist.

Verify

Re-check the original condition after your change, so "fixed" means confirmed, not assumed.

Remember

Keep local security history — resolved findings, accepted risks, and regressions — so noise drops over time.

What it catches

Six ways a good line goes wrong.

Every check is a pattern SPR{K3 has seen lead to a real compromise. When one fires, Mini Ora marks the line, explains the risk, and shows it in the editor, the Problems panel, a notification, and the SPR{K3 security view.

Unsafe deserialization

Untrusted input reaching pickle.load / pickle.loads — a direct path to arbitrary code execution.

Unsafe model loading

Risky torch.load usage that can execute code hidden inside a checkpoint.

Remote model code

Model paths that enable trust_remote_code, running third-party code from a downloaded repo.

Dynamic execution

User-reachable eval and exec that turn data into executable code.

Shell injection

Unsafe subprocess patterns that let input become a shell command.

Hard-coded secrets

API keys, tokens, passwords and credentials committed straight into source.

See Mini Ora work

Every detection class, start to finish.

Built for the way developers work

One security engine across the development workflow.

VS Code

Inline findings, explanations, and remediation while you're typing — the experience shown throughout this page.

CLI

The same local engine from the terminal — mini-ora scan . — for anyone who'd rather not leave the shell.

Pre-commit

Check security-relevant changes before they're committed, using the files already staged.

Code → Mini Ora → Security check → Commit

  • Same engine, three surfaces. What flags in the editor is what blocks the commit.
  • No separate config. The scanner you already trust in VS Code is the one running in CI-adjacent hooks.
AI-assisted development

Your AI writes. Mini Ora verifies.

Coding agents generate large amounts of working code quickly — but generated code still needs independent security review. Generation and verification shouldn’t be the same job.

Developer Coding agent Generated code Mini Ora Security analysis

Same local analysis as everywhere else on this page — no cloud AI required to review what an agent wrote.

Where Mini Ora fits

One trust model, from the first keystroke to the running system.

SPR{K3 watches every point where code, models, or instructions cross a trust boundary. Mini Ora is the earliest of them — it verifies trust as you write it, so the same research that powers the runtime agent reaches you before the code even exists on disk elsewhere.

WRITE-TIME

Mini Ora — in the editor

Static analysis on the line you're typing. Dangerous patterns flagged before run.

◆ YOU ARE HERE
AT REST

Verify trust at rest

Scan the codebase and model artifacts for supply-chain risk, unsafe deserialization, and lineage gaps.

IN MOTION

Monitor trust in motion

The Defend agent watches the running system for orchestration drift, prompt injection, and tool misuse.

CONTINUOUS

Observe trust continuously

Static, runtime, and behavioral signals correlated into one continuous trust score.

Each layer alone is useful. Together they close the gap between a risky line of code and a runtime breach — the same reason a downloaded file executing twelve seconds later is a finding for Defend, not just an event. See the full platform →

Mini Ora — know your code.  ·  Defend — know its behavior.  ·  SPR{K3 — trust what you build. Trust what you run.

Beyond a single line

Most real vulnerabilities live in a relationship, not a line.

A dependency with a known CVE, a workflow with too much trust, a secret that leaked through CI rather than source — these live at the boundaries around your code, not inside one function. Mini Ora watches the line you're writing right now; the at-rest layer of the SPR{K3 platform (Ora) is what looks at code, dependencies, CI/CD, and containers together.

Code

Mini Ora, live in the editor — this page.

Dependencies

Supply-chain risk across what your project pulls in.

CI/CD & GitHub Actions

Trust boundaries in the pipelines that build and ship your code.

Containers

What ends up in the image that actually runs.

How it works

A VS Code extension and a small local agent. Nothing else.

01

You scan a file or the workspace

The extension sends it to the local agent over an authenticated connection on 127.0.0.1.

02

The agent applies the encrypted rule pack

Detection runs entirely on your Mac, inside the folder you opened — nowhere else.

03

Findings return to the editor

Each result names the line, the risk, and the fix, and appears everywhere VS Code shows problems.

04

Security memory carries forward

Previous findings and the risks you've accepted inform future results, so the noise drops over time.

What leaves your Mac

  • During a scan: nothing. Source code is never uploaded to SPR{K3 or Hetzner.
  • At activation only: a device public key and basic product metadata — never the project's source.
  • Boundaries enforced: loopback-only agent, a restricted project folder, and an encrypted rule pack.
  • Verifiable install: Apple-notarized and stapled, so macOS confirms the binary before it runs.
Beta scope · v0.9.0

A small, high-value set of checks — done well.

Mini Ora 0.9.0 is a focused public beta, not a replacement for a full SAST platform. It ships six targeted detection classes for Python and configuration files, and coverage grows as beta users put it to work. What it catches, it catches immediately, privately, and inside the editor.

COMING IN MINI ORA 1.0

Persistent finding identity

Verification by ID

Local security memory

Accepted-risk history

Regression recognition

Request beta access

Enter your email and we send a one-time link (valid 30 minutes). The confirmation page shows your mo_beta_ activation token once. Tokens work for 120 days on up to two Macs and can be revoked. No account, no password.

Signed & notarized — Apple Developer ID: Dan Aridor (6JBK94Z45M). Notarization is signed distribution, not a security certification.
Installer: sprk3-mini-ora-public-universal-0.9.0.pkg
SHA-256: aad8fd948a5d634255055fd253be15f05f85a88ba96d5e9f68ec453d5c0d42e0 (.sha256) · Apple notarized and stapled.
Support: support@sprk3.com

Find fewer things. Finish them.

Security shouldn’t be measured by how many warnings a tool generates. It should be measured by whether developers can resolve the risks that matter.

Find the risk.  Trace the path.  Fix the problem.  Verify the result.  Remember what happened.

Get Mini Ora