← all posts
Dec 13, 2025

Why I Built My Own Security Scanner (And Why You Might Need It)

Solving the “local security gap” for developers who want to ship code, not configure pipelines.

The “Security Blindspot” in Development

You know how sometimes a small irritation becomes impossible to ignore? Like a pebble in your shoe during a long walk. That’s what this problem became for me.

I’ve been writing code for years now, across different companies, different teams. And somewhere along the way, I noticed this pattern that kept repeating itself. We had security tools, plenty of them actually. SAST for code analysis, SCA for dependencies, Docker scanners. They were all there. But they all lived in one place: the CI/CD pipeline.

This created what I call the “wait and pray” cycle:

You write your code with care. You push it. Then you wait, maybe 15 minutes, sometimes more. The pipeline fails. Why? Because you used an outdated version of requests. So you fix it locally, push again, and the cycle repeats. Another 15 minutes gone.

I wanted to break this cycle. I wanted to catch that accidentally pasted API key, that vulnerable dependency, right there in my terminal, before the push. Before the wait. Before the context switch that breaks your flow.

The Problem: Tool Fatigue

So naturally, I looked for solutions. And I found tools, good ones. Trivy for containers. Gitleaks for secrets. Semgrep for code patterns. Each one excellent at what it does.

But here’s where it gets tricky. Running all of them meant installing three different binaries, remembering three different command syntaxes, parsing three different output formats. It felt like having three different remote controls for one TV. Technically possible, but exhausting in practice.

What I really wanted was simple. One tool that would look at my project and tell me: “Here’s what’s wrong.” No ceremony, no complexity. Just clarity.

Conceptualizing Cerberus

So I decided to build it myself. Well, vibe-code it myself, to be exact.

Cerberus became my answer. Think of it as a conductor for an orchestra. The individual instruments (Trivy, Gitleaks, Semgrep) are world-class. But someone needs to bring them together into a coherent performance.

The design principles emerged from my own pain points:

  1. Unified: One command (cerberus scan), one comprehensive report.
  2. Isolated: No dependency conflicts, no system pollution. Your environment stays clean.
  3. Local-First: Fast execution, mostly offline. Because not every developer has a stable connection all the time.

Building it in 12 Hours (With a little help)

The architecture was clear in my mind. I knew exactly what needed to happen. But implementation? That’s where the rubber meets the road.

Writing a cross-platform installer that works on both Linux and Mac. Managing subprocess concurrency without race conditions. Generating clean HTML reports with proper error handling. These are the unglamorous parts of software engineering that can stretch a weekend project into weeks of grinding.

This is where I leveraged Google’s Antigravity.

Let me be clear about this. It didn’t design the product. That came from lived experience. But it accelerated all those tedious implementation details. The boilerplate. The edge cases in the installation script. The Docker configuration nuances. Things that are necessary but not particularly creative.

What might have consumed two or three weekends of my time happened in less than 12 hours. It allowed me to stay focused on what actually mattered: the developer experience, the core logic, the workflow that would make this tool genuinely useful.

Introducing Cerberus (Alpha)

Today, I’m releasing this as open source. It’s an alpha, a working proof of concept, ready for you to test in your own projects.

How to use it today

Right now, the primary installation method is a standalone script. It’s intelligent enough to detect your OS, set up an isolated Python environment, and fetch the necessary scanning tools without disrupting your existing setup.

Installation:

curl -sL https://raw.githubusercontent.com/manojisnow/cerberus/main/install.sh | bash

The output:

No more drowning in raw logs. You get a consolidated report in multiple formats (HTML, JSON, Markdown), with findings sorted by severity. Critical issues at the top, informational notes at the bottom. The way it should be.

What’s Coming Next

This is just the foundation. I have plans to make this even more accessible:

Try It Out

If you’ve ever sat waiting for a CI pipeline to tell you about a simple mistake, if you’ve ever wished for faster feedback, give Cerberus a try.

This is the tool I wish I had when I started. The tool that would have saved me countless hours and context switches. Now it exists, and it’s yours to use.

GitHub: github.com/manojisnow/cerberus

#DevSecOps #OpenSource #CyberSecurity #DeveloperTools #Python