Security tooling you can read,
install, and build on.

Every Santh crate is open source. Install a CLI in one command, or import the same code as a library in your own Rust project.

GitHub → Read the blog → X / @SanthProject crates.io How we operate
fleet at work
$ keyhog scan . 2 live keys - 4 findings - 1.9s $ gossan scan acme.com 61 subdomains - 12 services - 4 flagged $ cargo add simdsieve 50 GB/s pattern matching behind one trait $

The stack

The tools share crates, and you can use any crate on its own. keyhog's scanner, gossan's tree walker, and vyre's matching engine are all published libraries.

santh ├─ tools keyhog · gossan · wafrift · truestack · envseal ├─ libraries codewalk · attackstr · secfinding · openpack · procjail ├─ engines simdsieve · dfajit · flashsieve · ziftsieve · ebpfkit └─ substrate vyre · matchkit # gpu - cpu - jit, one matching trait
Services Custom scoped

Penetration testing,
by the people who build the tools.

You get human testers attacking your application, not a scanner with a dashboard.

You describe the system over email. We scope the engagement and price it by what is exposed, not by a tier sheet. Testers use the same open-source tools on this page, plus manual OWASP Top 10 and business-logic work. Every fix is re-verified free.

scopecustom, priced by what is exposed, not a tier sheet
methodmanual OWASP Top 10 and business-logic abuse
retestsfree, every fix re-verified at no extra cost
contactdirect line to the tester who found the bug
How engagements work → Quote by email
Featured Tool

keyhog

Find leaked secrets in your code before someone else does.

keyhog scans your tree and your git history with 923 service-specific detectors, then checks with the provider whether each leaked key still works. One binary, one command, one SARIF report your CI already reads.

┌ CRITICAL ─────────────── OpenAI API Key │ Secret: sk-9...M8vZ │ Location: src/llm/client.ts:4 │ Action: Revoke immediately and rotate. └──────────────────────────────────────────
detectors923, every one covered by regression tests
engineAho-Corasick on GPU, memchr SIMD on CPU
output9 formats, SARIF drops straight into CI
installcargo install keyhog
Install keyhog → GitHub → crates.io → Read the story →
Product veyyon.dev

veyyon

The coding-agent harness, on your machine.

A local terminal coding agent. It runs in your terminal with your provider keys: CLI and TUI, plan mode, subagents, approval modes, and a multi-provider catalog with local model discovery. Its own site, its own releases.

surfaceCLI + TUI on macOS, Linux, Windows
providersAnthropic, OpenAI, Google, Groq, OpenRouter, local daemons
installcurl -fsSL https://get.veyyon.dev | sh
veyyon.dev → GitHub → Handbook →

All projects

01 /Security Tooling

Scanners, detection, reconnaissance, evasion testing, detonation, and secret management.

gossan Tool →
Recon. DNS enumeration, port scanning, service fingerprinting, web crawling. Async Rust on io_uring. Subdomain discovery, tech-stack fingerprinting via TrueStack, rate-limited scanning, JSON output. Each capability is its own crate. sitegithubcrates.io
wafrift Tool →
WAF evasion testing. Grammar mutation and dialect-specific bypass generation. TOML grammar definitions, 15+ encoding strategies, presets for ModSecurity, Cloudflare, AWS WAF. Uses AttackStr for payload generation. sitegithub
envseal Tool →
Encrypted secret storage. Replaces .env files. AES-256-GCM vault, Argon2id key derivation. CLI and Tauri GUI. Audit log, team key sharing, granular access control. crates.io
truestack Tool →
Tech fingerprinting from HTTP. Identifies frameworks, servers, CDNs, and services. Header analysis, favicon hashing, HTML and JS pattern detection. TOML signature database; add a new fingerprint in 5 lines. Used by Gossan; works standalone. githubcrates.io
procjail Library →
Subprocess sandbox. Linux namespaces, seccomp-bpf, rlimits, watchdog timeout. Network isolation, filesystem restrictions, syscall filtering, memory and CPU limits. Used by Sear and Keyhog. sitegithubcrates.io
karyx Coming Soon
Template-based vulnerability scanner. YAML and TOML templates, HTTP probing, headless browser. Orchestrates Gossan, Wafrift, and Keyhog. Templates with conditional logic, extractors, and matchers. Targets web apps, APIs, and network services.
sear Coming Soon
URL detonation. Sandboxed browser execution for phishing analysis and malware triage. Headless Chromium inside a Procjail sandbox. Captures network traffic, screenshots, DOM mutations, and JavaScript behaviour.

02 /Performance Infrastructure

General-purpose systems libraries. Not security-specific - anyone can use these.

vyre Compiler →
Sequential logic on the GPU, bit-exact against a CPU reference. The compute substrate keyhog runs on. Workgroup-local stacks, queues, hashmaps, dominator trees, fixed-point dataflow. Targets CUDA, WGPU, and SPIR-V. Conformance gate rejects any backend that diverges by one bit. C11 frontend; Rust frontend in beta. sitegithubcrates.io
dfajit Library →
JIT DFA compilation to native x86-64. Cranelift-backed JIT that converts DFA state tables to native code. Removes interpreter overhead for hot patterns. Uses the same matching API as Vyre and SimdSieve. githubcrates.io
simdsieve Library →
AVX-512 and NEON multi-pattern matching. Vectorised Aho-Corasick with runtime CPU feature detection. Runtime dispatch between AVX-512, AVX2, and NEON. Benchmarked at 15-50 GB/s depending on ISA and pattern count. githubcrates.io
ebpfkit Library →
eBPF kernel-space filtering. Load, manage, and interact with eBPF programs from safe Rust. Type-safe eBPF map access, program lifecycle, tracepoint attachment. Used for kernel-level network and syscall filtering without writing raw C. githubcrates.io
ziftsieve Library →
Pattern matching inside compressed streams. Scan without decompressing. Matches against the decompression buffer of gzip, zstd, and brotli streams without materialising the full output. Reduces I/O for archive scanning. githubcrates.io
flashsieve Library →
Block-level pre-filtering. Skip files that cannot match before full scan. Bloom filter and n-gram pre-screening. Reads file blocks and rejects non-matching files in microseconds. Cuts the volume sent to the full matching engine by 10-100×. githubcrates.io
wireshift Coming Soon
io_uring ring manager. Typed submit, wait, and complete for async I/O on Linux. Safe Rust wrapper around Linux io_uring. Typed completion entries, multi-ring management, zero-copy buffer pools.
tenshift Coming Soon
ML data loader in Rust. Prefetch, shuffle, batch, transform. A replacement for PyTorch's DataLoader.

03 /Shared Libraries

Foundational crates that everything else is built on. Each works standalone.

secfinding Library →
Security finding types. Severity, Evidence, Finding, Reportable trait. Shared type system for security findings. SARIF output, CVSS-aligned severity, Reportable trait for serialisation. githubcrates.io
codewalk Library →
Security-aware file tree walker. Gitignore-aware, binary detection, memmap2, parallel. Walks a repository tree, respects .gitignore, skips binary files, memory-maps for zero-copy reads, parallelises across cores. Used by Keyhog and Gossan. githubcrates.io
matchkit Library →
Multi-pattern matching primitives. Unified trait over Aho-Corasick, regex sets, and custom engines. Shared matching interface that DfaJIT, SimdSieve, Vyre, and Hyperscan implement. Swap backends without touching consumer code. githubcrates.io
attackstr Library →
Grammar-based payload generation. TOML-driven, composable, 19 encoding strategies. SQL injection, XSS, SSRF, path traversal, and custom payloads from composable grammar rules. TOML definitions, mutation engine, encoding pipeline (URL, hex, unicode, base64, HTML entity). githubcrates.io
openpack Library →
Safe archive reader for ZIP-derived formats. ZIP, CRX, JAR, APK, IPA. Protects against zip bombs, path traversal, and symlink attacks. Unified API for ZIP, CRX, JAR, APK, IPA. githubcrates.io
secir Coming Soon
Security intermediate representation. Typed IR for vulnerability modeling and cross-tool data exchange.