DevGuard: A Zero-Dependency Security Scanner Built from Python's Standard Library

When the developers at Zero Dependency 2026 removed common security libraries and built DevGuard using Python's standard library, they aimed to create a lightweight security scanner for codebases and dependency manifests. The primary goal was to provide developers with a simple tool to detect sensitive information and potential vulnerabilities.

DevGuard focuses on three core checks: SecretScanner, FileRiskScanner, and DependencyScanner. These scanners return standardized Finding objects, which include file path, line number, rule, severity, and a message. By keeping the detection logic separate from reporting and presentation, it becomes easier to add new scanners without redesigning the entire application.

The DevGuard dashboard is built using Python's built-in http.server for the backend and plain HTML, CSS, and JavaScript for the frontend. This eliminates the need for additional dependencies like Flask or FastAPI. The dashboard presents an overall security score, risk level, severity counts, scanner-wise findings, detailed finding information, and recommended remediation.

DevGuard's secret detection goes beyond simple keyword searching. It checks for obvious environment lookups, placeholder values, and private-key material. The scanner also identifies sensitive assets like .env files, SSH keys, credential files, and certificate containers. However, it excludes known-safe environment templates to minimize false positives.

The dependency scanner in DevGuard recognizes several common manifest formats and reports them as findings. However, it does not assume any vulnerability simply because a dependency exists. DevGuard keeps the boundary between discovering dependencies and identifying known vulnerabilities explicit.

Developing DevGuard presented challenges, such as deciding what not to report and handling various edge cases. For example, scanning a project blindly could lead to irrelevant results from directories like .git/, .venv/, node_modules/, build/, dist/, tests/, and fixtures/. DevGuard maintains project-level exclusions to avoid irrelevant findings.

The zero-dependency constraint forced the developers to rely on Python's standard library, which made them consider the implications of each decision. By carefully selecting the components and algorithms, DevGuard was built to be practical, understandable, and easily extensible. The result is a developer-friendly security scanner that provides immediate protection without requiring a large security stack.