HZSec is a local-first security platform built to help developers find exposed secrets, insecure configurations, and unsafe code patterns before they become production problems.
HZSec — Horizon Zero Security
Developers move quickly. Between writing features, reviewing PRs, and keeping up with dependencies, security is often the thing that gets checked after the fact — if it gets checked at all.
That's how things like this end up in production:
HZSec exists to make catching those problems easier — before the commit, before the PR, before the deploy.
Most security tools work by sending your code to a remote server for analysis. That means your source code, your secrets, your architecture — all of it leaves your machine.
The HZSec CLI runs entirely on your machine. Your files are read locally, analysed locally, and the results stay local. Nothing is uploaded. No account required to scan.
npm install -g hzsec-cli
macOS · Windows
The desktop app is in active development and not yet code-signed.
The long-term direction for HZSec is to help developers move through the full security loop — not just surface issues, but understand them, fix them, verify the fix, and keep them from coming back.
This includes ideas like smarter remediation guidance, continuous background monitoring, verification workflows, and better security history across a project's lifetime. These are directions, not promises — the work happens incrementally.
HZSec began as a project focused on making developer security tooling more practical, private, and accessible. The goal is simple: give every developer the tools to catch security problems early, without adding friction to their workflow or asking them to hand over their code.
Install the CLI, point it at any project, and see what it finds. No account required.