llm-security-scanner 0.1.0__tar.gz

llm_security_scanner-0.1.0/.dockerignore

@@ -0,0 +1,14 @@
+.git
+.venv
+.pytest_cache
+.ruff_cache
+.idea
+.planning
+.claude
+reports
+__pycache__
+*.pyc
+*.pyo
+*.pyd
+.DS_Store
+commits.txt

llm_security_scanner-0.1.0/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,20 @@
+---
+name: Bug report
+about: Something doesn't work as expected
+labels: bug
+---
+
+**Command run** (redact any secrets/API keys)
+```
+llm-scanner --target ... --target-type ... --judge-model ...
+```
+
+**Expected behavior**
+
+**Actual behavior**
+
+**Environment**
+- OS:
+- Python version:
+- `llm-scanner` version / commit:
+- Ollama version:

llm_security_scanner-0.1.0/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,11 @@
+---
+name: Feature request
+about: Suggest a new payload, target type, reporter, or CLI flag
+labels: enhancement
+---
+
+**What's missing**
+
+**Which OWASP LLM category (if a new payload)**
+
+**Why it matters**

llm_security_scanner-0.1.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,8 @@
+## What this changes
+
+## Testing
+
+- [ ] `uv run pytest` passes
+- [ ] `uv run ruff check .` passes
+
+## Notes for reviewer

llm_security_scanner-0.1.0/.github/actions/llm-scan/action.yml

@@ -0,0 +1,125 @@
+name: 'LLM Security Scanner'
+description: 'Automated OWASP Top 10 for LLMs security testing — 46+ attack payloads, local Ollama judge, fully offline.'
+author: 'Konrad Malinowski'
+
+inputs:
+  target:
+    description: 'Target URL (HTTP endpoint) or Ollama model name to test'
+    required: false
+  target-type:
+    description: 'Type of target: url or ollama'
+    required: false
+    default: 'url'
+  judge-model:
+    description: 'Local Ollama model used as the AI evaluator'
+    required: false
+    default: 'llama3.2:3b'
+  api-key:
+    description: 'Bearer token for authenticated endpoints (never logged)'
+    required: false
+    default: ''
+  severity:
+    description: 'Minimum severity filter: critical, high, medium, low, info. Empty = all.'
+    required: false
+    default: ''
+  categories:
+    description: 'Comma-separated OWASP categories (e.g. LLM01,LLM07). Empty = all except LLM10.'
+    required: false
+    default: ''
+  include-dos-tests:
+    description: 'Include LLM10 Unbounded Consumption probes. Only use against targets you own.'
+    required: false
+    default: 'false'
+  output-dir:
+    description: 'Directory for saved report files'
+    required: false
+    default: 'llm-scan-reports'
+  fail-on-score:
+    description: 'Fail the workflow when risk score is greater than or equal to this threshold. Empty = never fail by score.'
+    required: false
+    default: ''
+  config:
+    description: 'Optional llm-scan.yml config path. Explicit action inputs override config values.'
+    required: false
+    default: ''
+
+outputs:
+  report-html:
+    description: 'Path to the generated HTML report'
+    value: ${{ steps.scan.outputs.report-html }}
+  risk-score:
+    description: 'Numeric risk score (0.0–10.0)'
+    value: ${{ steps.scan.outputs.risk-score }}
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Set up Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: '3.11'
+
+    - name: Set up uv
+      uses: astral-sh/setup-uv@v3
+
+    - name: Install llm-security-scanner
+      shell: bash
+      run: |
+        uv pip install --system -e "${{ github.action_path }}/../../.."
+
+    - name: Install Ollama
+      shell: bash
+      run: |
+        curl -fsSL https://ollama.com/install.sh | bash
+
+    - name: Start Ollama and pull judge model
+      shell: bash
+      run: |
+        ollama serve &
+        echo "Waiting for Ollama to be ready..."
+        for i in $(seq 1 30); do
+          if curl -sf http://localhost:11434/api/version >/dev/null 2>&1; then
+            echo "Ollama ready after $((i * 2))s"
+            break
+          fi
+          sleep 2
+        done
+        ollama pull "${{ inputs.judge-model }}"
+
+    - name: Run LLM security scan
+      id: scan
+      shell: bash
+      run: |
+        set -e
+        mkdir -p "${{ inputs.output-dir }}"
+
+        ARGS=()
+
+        [ -n "${{ inputs.config }}" ] && ARGS+=(--config "${{ inputs.config }}")
+        [ -n "${{ inputs.target }}" ] && ARGS+=(--target "${{ inputs.target }}")
+        [ -n "${{ inputs.target-type }}" ] && ARGS+=(--target-type "${{ inputs.target-type }}")
+        [ -n "${{ inputs.judge-model }}" ] && ARGS+=(--judge-model "${{ inputs.judge-model }}")
+
+        ARGS+=(--format json,html,sarif --output-dir "${{ inputs.output-dir }}")
+
+        [ -n "${{ inputs.api-key }}" ]    && ARGS+=(--api-key "${{ inputs.api-key }}")
+        [ -n "${{ inputs.severity }}" ]   && ARGS+=(--severity "${{ inputs.severity }}")
+        [ -n "${{ inputs.categories }}" ] && ARGS+=(--categories "${{ inputs.categories }}")
+        [ -n "${{ inputs.fail-on-score }}" ] && ARGS+=(--fail-on-score "${{ inputs.fail-on-score }}")
+        [ "${{ inputs.include-dos-tests }}" = "true" ] && ARGS+=(--include-dos-tests)
+
+        set +e
+        llm-scanner "${ARGS[@]}"
+        SCAN_RC=$?
+        set -e
+
+        HTML=$(find "${{ inputs.output-dir }}" -name report.html -print | head -1 || true)
+        echo "report-html=${HTML}" >> "$GITHUB_OUTPUT"
+
+        JSON=$(find "${{ inputs.output-dir }}" -name report.json -print | head -1 || true)
+        if [ -n "$JSON" ]; then
+          SCORE=$(python -c 'import json,sys; print(json.load(open(sys.argv[1])).get("risk_score", ""))' "$JSON" || true)
+          echo "risk-score=${SCORE}" >> "$GITHUB_OUTPUT"
+        fi
+
+        exit "$SCAN_RC"

llm_security_scanner-0.1.0/.github/workflows/llm-scan.yml

@@ -0,0 +1,78 @@
+name: LLM Security Scan
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  llm-security-scan:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60  # LLM inference can be slow on shared runners
+    env:
+      LLM_ENDPOINT: ${{ vars.LLM_ENDPOINT }}
+      LLM_JUDGE_MODEL: ${{ vars.LLM_JUDGE_MODEL || 'llama3.2:3b' }}
+      LLM_FAIL_ON_SCORE: ${{ vars.LLM_FAIL_ON_SCORE || '7.0' }}
+      LLM_SEVERITY: ${{ vars.LLM_SEVERITY }}
+      LLM_CATEGORIES: ${{ vars.LLM_CATEGORIES }}
+      LLM_INCLUDE_DOS_TESTS: ${{ vars.LLM_INCLUDE_DOS_TESTS || 'false' }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install uv
+        run: pip install uv
+
+      - name: Install scanner
+        run: uv pip install -e . --system
+
+      - name: Install Ollama
+        run: curl -fsSL https://ollama.com/install.sh | bash
+
+      - name: Start Ollama and pull models
+        run: |
+          ollama serve &
+          # Wait for Ollama HTTP server to be ready (up to 15 * 2s = 30s)
+          for i in $(seq 1 15); do
+            if curl -s http://localhost:11434 > /dev/null; then break; fi
+            sleep 2
+          done
+          # llama3.2:3b Q4 ~2GB RAM fits within ubuntu-latest 7GB runner limit
+          # do not use 7B+ models (llama3:7b ~4GB, llama3.1:8b ~5GB) -- risk OOM
+          ollama pull "$LLM_JUDGE_MODEL"
+
+      - name: Validate workflow variables
+        run: |
+          test -n "$LLM_ENDPOINT" || {
+            echo "Set repository variable LLM_ENDPOINT to the URL reachable from this job, for example http://localhost:5000/chat" >&2
+            exit 1
+          }
+
+      - name: Run security scan
+        uses: ./.github/actions/llm-scan
+        with:
+          target: ${{ env.LLM_ENDPOINT }}
+          target-type: url
+          judge-model: ${{ env.LLM_JUDGE_MODEL }}
+          severity: ${{ env.LLM_SEVERITY }}
+          categories: ${{ env.LLM_CATEGORIES }}
+          include-dos-tests: ${{ env.LLM_INCLUDE_DOS_TESTS }}
+          fail-on-score: ${{ env.LLM_FAIL_ON_SCORE }}
+          output-dir: ./reports
+
+      - name: Upload SARIF to GitHub Security
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()  # upload even if scan found vulnerabilities (exit code 1)
+        with:
+          sarif_file: ./reports/
+          category: llm-security
+
+      - name: Upload reports as artifact
+        uses: actions/upload-artifact@v4
+        if: always()  # preserve reports even on scan failure
+        with:
+          name: llm-scan-reports
+          path: ./reports/

llm_security_scanner-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,50 @@
+name: Release to PyPI
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Build sdist and wheel
+        run: |
+          pip install --no-cache-dir build
+          python -m build
+
+      - name: Verify tag matches package version
+        run: |
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          PKG_VERSION="$(python -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')"
+          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
+            echo "Tag $GITHUB_REF_NAME does not match pyproject.toml version $PKG_VERSION" >&2
+            exit 1
+          fi
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write # required for PyPI trusted publishing (OIDC) — no API token secret needed
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

llm_security_scanner-0.1.0/.gitignore

@@ -0,0 +1,11 @@
+.claude
+.planning
+.venv
+.idea
+.tests/__pycache__/
+*.pyc
+__pycache__/
+.env
+sessions/
+plans/
+reports/

llm_security_scanner-0.1.0/CHANGELOG.md

@@ -0,0 +1,10 @@
+# Changelog
+
+Releases are tagged on GitHub (`vX.Y.Z`); this file summarizes what changed in each one. Tagging `vX.Y.Z` (matching the version in `pyproject.toml`) triggers `.github/workflows/release.yml`, which publishes to PyPI via trusted publishing. Until the first release ships, install via `pip install git+https://github.com/konradxmalinowski/llm-security-scanner`.
+
+## Unreleased
+
+- Split the hosted landing page / premium service out into a private repo (`llm-security-scanner-saas`). This repo is now scan-engine-only.
+- Added `LICENSE` (MIT), `CONTRIBUTING.md`, issue/PR templates.
+- Fixed example CI/CD pipelines (`examples/github/`, `examples/gitlab/`): Docker variants no longer try to build the scanner image from the consumer's own checkout (they had no Dockerfile to build from); GitLab variants no longer ship an environment-specific `LLM_ENDPOINT`/`OLLAMA_HOST` default that silently defeated the "did you configure this?" check; GitLab pipelines now only trigger on merge requests/manual runs instead of every push, matching the GitHub examples.
+- Added `.github/workflows/release.yml`: tag-triggered PyPI publish via trusted publishing (OIDC, no stored API token). Docker CI/CD examples now build a minimal `pip install llm-security-scanner` image instead of cloning this repo's full source — requires the first PyPI release to exist (see `docs/FUNCTIONALITY.md` for the one-time pending-publisher setup).

llm_security_scanner-0.1.0/CLAUDE.md

@@ -0,0 +1,183 @@
+<!-- GSD:project-start source:PROJECT.md -->
+
+## Project
+
+**LLM Security Scanner**
+
+A Python CLI tool that tests LLM-based applications against the full OWASP Top 10 for LLMs vulnerability framework. It accepts either an HTTP endpoint or a local Ollama model as a target, runs a battery of ~50 automated attacks, and uses a second Ollama model as an AI Judge to evaluate each result — producing reports in terminal, Markdown, JSON, and HTML formats.
+
+**Core Value:** Give security engineers a fully offline, one-command tool to test local LLM endpoints and local models against all 10 OWASP LLM attack categories — no cloud dependencies, no manual analysis.
+
+### Constraints
+
+- **Tech Stack**: Python 3.11+, httpx, ollama SDK, rich, Pydantic v2, jinja2, pytest — no deviations from spec
+- **Offline-first**: All judge inference via local Ollama — no calls to OpenAI/Anthropic/etc.
+- **Payload format**: YAML files per OWASP category; each payload must have `id`, `name`, `payload`, `judge_criteria`
+- **Judge contract**: Must return parseable JSON `{"success": bool, "reasoning": str}` — parser must handle malformed output gracefully
+- **OWASP coverage**: All 10 categories (LLM01–LLM10) must have at least 4 payloads each to reach ≥40 total
+
+<!-- GSD:project-end -->
+
+<!-- GSD:stack-start source:research/STACK.md -->
+
+## Technology Stack
+
+## Recommended Stack
+
+### Core Runtime
+
+| Technology | Version | Purpose | Why |
+|------------|---------|---------|-----|
+| Python | 3.11+ | Runtime | `asyncio.TaskGroup` (3.11+) for parallel attack dispatch; modern `match` for pattern-matching judge output; `tomllib` stdlib |
+| uv | latest | Package/venv manager | Replaces pip+venv; lockfile-native; `uv run` executes CLI without install |
+
+### HTTP Client (Attack Delivery)
+
+| Technology | Version | Purpose | Why |
+|------------|---------|---------|-----|
+| httpx | 0.28.1 | Async HTTP to URL targets | Sync+async parity (same API surface); native `AsyncClient`; fine-grained `Timeout(connect=5, read=120)` for slow LLM responses; `HTTPTransport(retries=N)` for flaky endpoints. Outperforms aiohttp on DX and error handling. |
+
+### Ollama SDK (Local Model Inference)
+
+| Technology | Version | Purpose | Why |
+|------------|---------|---------|-----|
+| ollama | 0.6.2 | Chat with local models | Official SDK; `AsyncClient` mirrors httpx's async model; structured output via Pydantic schema; `format='json'` for judge responses |
+
+- `chat()` accepts a `messages` list — supports system prompt + user turn in one call, which is exactly the judge pattern: `[{"role": "system", "content": judge_prompt}, {"role": "user", "content": f"Payload: {p}\nResponse: {r}"}]`
+- `generate()` is for single-prompt completion without conversation history — appropriate only for raw completions, not structured judge evaluation
+- `chat()` with `format=JudgeOutput.model_json_schema()` forces structured JSON output natively (Ollama >= 0.5.0 supports Pydantic schema in `format`)
+
+### Terminal UI
+
+| Technology | Version | Purpose | Why |
+|------------|---------|---------|-----|
+| rich | 15.0.0 | Progress bars, colored tables, console output | Industry standard for Python CLI UX; `Progress` context manager with `track()` is idiomatic; `Table` renders colored severity columns without extra dependencies |
+
+### Data Models
+
+| Technology | Version | Purpose | Why |
+|------------|---------|---------|-----|
+| pydantic | 2.13.4 | AttackResult, ScanReport, Severity models | v2 is 10–20x faster than v1; `model_dump_json()` outputs JSON directly; `ConfigDict(extra='forbid')` catches YAML schema drift; enum serialization in JSON mode outputs values not members |
+
+### Template Engine
+
+| Technology | Version | Purpose | Why |
+|------------|---------|---------|-----|
+| jinja2 | 3.1.6 | HTML report generation | Standard for Python templating; `FileSystemLoader` loads from `templates/` dir; auto-escaping via `Environment(autoescape=True)` mandatory for security tools (prevents XSS in report if payloads contain HTML) |
+
+### YAML Payload Loader
+
+| Technology | Version | Purpose | Why |
+|------------|---------|---------|-----|
+| PyYAML | 6.0.3 | Loading payload YAML files | Sufficient for read-only structured data; simpler API than ruamel.yaml; always use `yaml.safe_load()` |
+
+### CLI Framework
+
+| Technology | Version | Purpose | Why |
+|------------|---------|---------|-----|
+| argparse | stdlib | CLI argument parsing | Per project spec; zero extra dependencies; sufficient for flat argument surface (~10 flags, no subcommands); security-tool users expect POSIX-standard `--flag value` syntax |
+
+- **Click (38.7% market share in 2025):** Better DX for complex CLIs with subcommands, but adds a dependency. Unnecessary here — no subcommands, no command groups.
+- **Typer:** Adds Click as transitive dep; designed for type-hint-native CLIs. Overkill for a single-command tool. Also 14ms startup vs argparse 18ms (negligible, but argparse wins on dep count).
+- **argparse wins here because:** flat single-command surface; zero deps; pip-installable by security teams in air-gapped environments without extra packages.
+
+### Testing
+
+| Technology | Version | Purpose | Why |
+|------------|---------|---------|-----|
+| pytest | 9.1.1 | Test runner | Standard |
+| pytest-asyncio | 1.4.0 | Async test support | Required for testing `AsyncClient` judge and httpx async scanner; `asyncio_mode = "auto"` eliminates decorator noise |
+
+# No decorator needed in auto mode
+
+### Linter / Formatter
+
+| Technology | Version | Purpose | Why |
+|------------|---------|---------|-----|
+| ruff | 0.15.20 | Linting + formatting | Replaces flake8 + black + isort in one tool; 100x faster; S-series rules (flake8-bandit) flag unsafe YAML, subprocess calls, hardcoded secrets — exactly what a security tool should self-enforce |
+
+- `S506`: `yaml.load()` without `Loader=yaml.SafeLoader` → force `yaml.safe_load()`
+- `S701`: Jinja2 `Environment(autoescape=False)` → force `autoescape=True`
+- `S105`/`S106`: hardcoded API keys/passwords in source
+- `S113`: requests without timeout (not applicable with httpx, but good discipline)
+
+## Dependency Summary
+
+### Production (`[project.dependencies]`)
+
+### Dev (`[project.optional-dependencies]`)
+
+## Alternatives Explicitly Rejected
+
+| Category | Recommended | Alternative | Why Rejected |
+|----------|-------------|-------------|--------------|
+| HTTP client | httpx | aiohttp | aiohttp's session lifecycle is more verbose; no sync parity; DX inferior |
+| HTTP client | httpx | requests | Blocking — incompatible with async attack loop |
+| CLI framework | argparse | Click | Adds dependency; subcommands not needed |
+| CLI framework | argparse | Typer | Click transitive dep; startup overhead; overkill for flat CLI |
+| Models | pydantic v2 | dataclasses | No JSON serialization; no validation; no schema generation for Ollama `format=` |
+| YAML | PyYAML | ruamel.yaml | Needed only for round-trip write-back (preserving comments); payload files are read-only |
+| YAML | PyYAML | StrictYAML | No standard pip install; unnecessary for internal authored payload files |
+| Linting | ruff | flake8+black+isort | Three tools replaced by one; ruff is 100x faster |
+| Judge inference | ollama.chat() | ollama.generate() | generate() lacks system/user turn structure for structured evaluation |
+| Jinja2 autoescape | autoescape=True | autoescape=False | Attack payloads contain HTML/JS; False creates XSS in rendered reports; Ruff S701 flags it |
+
+## Sources
+
+- httpx async client: https://www.python-httpx.org/advanced/timeouts — HIGH confidence (official docs via Context7)
+- Ollama Python SDK: https://github.com/ollama/ollama-python/blob/main/README.md — HIGH confidence (official SDK via Context7)
+- Ollama chat vs generate: https://context7.com/ollama/ollama-python/llms.txt — HIGH confidence (official docs)
+- Rich tables and progress: https://rich.readthedocs.io/en/stable/tables.html — HIGH confidence (official docs via Context7)
+- Pydantic v2 serialization: https://github.com/pydantic/pydantic/blob/main/docs/concepts/serialization.md — HIGH confidence (official docs via Context7)
+- pytest-asyncio auto mode: https://pytest-asyncio.readthedocs.io/en/stable/concepts.html — HIGH confidence (official docs via Context7)
+- Ruff S-series (bandit) rules: https://docs.astral.sh/ruff/rules — HIGH confidence (official docs via Context7)
+- PyYAML vs ruamel.yaml: https://yaml.dev/doc/ruamel.yaml/pyyaml/ — MEDIUM confidence (official ruamel docs, cross-checked with PyYAML docs)
+- Jinja2 FileSystemLoader: https://jinja.palletsprojects.com/en/stable/api — HIGH confidence (official docs via Context7)
+- argparse vs Click vs Typer: https://dasroot.net/posts/2025/12/building-cli-tools-python-click-typer-argparse/ — MEDIUM confidence (third-party article, consistent with project spec decision)
+- Package versions: PyPI index (pip index versions), confirmed 2026-06-25
+
+<!-- GSD:stack-end -->
+
+<!-- GSD:conventions-start source:CONVENTIONS.md -->
+
+## Conventions
+
+Conventions not yet established. Will populate as patterns emerge during development.
+<!-- GSD:conventions-end -->
+
+<!-- GSD:architecture-start source:ARCHITECTURE.md -->
+
+## Architecture
+
+Architecture not yet mapped. Follow existing patterns found in the codebase.
+<!-- GSD:architecture-end -->
+
+<!-- GSD:skills-start source:skills/ -->
+
+## Project Skills
+
+No project skills found. Add skills to any of: `.claude/skills/`, `.agents/skills/`, `.cursor/skills/`, `.github/skills/`, or `.codex/skills/` with a `SKILL.md` index file.
+<!-- GSD:skills-end -->
+
+<!-- GSD:workflow-start source:GSD defaults -->
+
+## GSD Workflow Enforcement
+
+Before using Edit, Write, or other file-changing tools, start work through a GSD command so planning artifacts and execution context stay in sync.
+
+Use these entry points:
+
+- `/gsd-quick` for small fixes, doc updates, and ad-hoc tasks
+- `/gsd-debug` for investigation and bug fixing
+- `/gsd-execute-phase` for planned phase work
+
+Do not make direct repo edits outside a GSD workflow unless the user explicitly asks to bypass it.
+<!-- GSD:workflow-end -->
+
+<!-- GSD:profile-start -->
+
+## Developer Profile
+
+> Profile not yet configured. Run `/gsd-profile-user` to generate your developer profile.
+> This section is managed by `generate-claude-profile` -- do not edit manually.
+<!-- GSD:profile-end -->

llm_security_scanner-0.1.0/CONTRIBUTING.md

@@ -0,0 +1,29 @@
+# Contributing
+
+Thanks for considering a contribution to LLM Security Scanner.
+
+## Setup
+
+```bash
+uv pip install -e ".[dev]"
+```
+
+## Before opening a PR
+
+```bash
+uv run pytest
+uv run ruff check .
+uv run ruff format .
+```
+
+- Keep payload YAML files (`payloads/`) matching the existing schema: `id`, `name`, `payload`, `judge_criteria`, `severity`.
+- New payloads should map to a specific OWASP LLM Top 10 (2025) category — see `docs/FUNCTIONALITY.md` for the current category list.
+- `ruff` runs with `flake8-bandit` (`S` rules) enabled — don't disable these without a clear reason in the PR description (e.g. `yaml.safe_load` and `Environment(autoescape=True)` are enforced project-wide for security reasons).
+
+## Reporting bugs / requesting features
+
+Open a GitHub issue using the provided templates. Include reproduction steps (target type, judge model, relevant flags) for bugs.
+
+## Scope
+
+This repo is the open-source scan engine and CLI only. Hosted/premium features are out of scope here — see `docs/FUNCTIONALITY.md` for what belongs where.

llm_security_scanner-0.1.0/Dockerfile

@@ -0,0 +1,18 @@
+FROM python:3.11-slim
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1
+
+WORKDIR /app
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends curl ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY pyproject.toml README.md ./
+COPY src ./src
+COPY payloads ./payloads
+
+RUN pip install --no-cache-dir .
+
+ENTRYPOINT ["llm-scanner"]

llm_security_scanner-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Konrad Malinowski
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.