Skip to main content
Free to download — no account needed →
DocsContact
About HZSec

Security should start with the developer.

HZSec is a local-first security platform built to help developers find exposed secrets, insecure configurations, and unsafe code patterns before they become production problems.

Your code stays on your machine.

HZSec — Horizon Zero Security

The problem

Security issues reach production because they're too easy to miss.

Developers move quickly. Between writing features, reviewing PRs, and keeping up with dependencies, security is often the thing that gets checked after the fact — if it gets checked at all.

That's how things like this end up in production:

API keys and tokens committed to a public repo
Database credentials hardcoded in a config file
Debug mode left on in a production build
Wildcard CORS policies that were never tightened
Private keys checked in "temporarily" and forgotten
Dangerous code patterns that slip past code review

HZSec exists to make catching those problems easier — before the commit, before the PR, before the deploy.

Local-first

Your code belongs to you.

Most security tools work by sending your code to a remote server for analysis. That means your source code, your secrets, your architecture — all of it leaves your machine.

The HZSec CLI runs entirely on your machine. Your files are read locally, analysed locally, and the results stay local. Nothing is uploaded. No account required to scan.

No upload
$ hzsec scan .
✓ Scanning locally...
Secrets detected: 2 CRITICAL
Config issues: 1 HIGH
Code patterns: 1 MEDIUM
No data left this machine.
What HZSec is today

A CLI and a desktop app.

Free CLI

npm install -g hzsec-cli

  • Secrets detection — API keys, tokens, private keys
  • Unsafe code patterns — command injection, eval()
  • Configuration issues — CORS, debug mode, and more
  • Web security checks
  • Hardening recommendations
  • Text, JSON, and SARIF output formats
  • CI-friendly with --fail-on and exit codes
  • Multiple scan modes — quick, full, focused
Desktop AppBeta

macOS · Windows

  • Full GUI — no terminal required
  • Scan history across projects
  • AI assistant for understanding and fixing findings
  • Live process monitor for credential leaks
  • Breach Library — check emails against breach databases
  • Managed Anthropic key for Pro and Team (no API key setup)

The desktop app is in active development and not yet code-signed.

Direction

From finding problems to preventing them.

The long-term direction for HZSec is to help developers move through the full security loop — not just surface issues, but understand them, fix them, verify the fix, and keep them from coming back.

Find the problem
Understand it
Fix it
Verify the fix
Prevent it returning

This includes ideas like smarter remediation guidance, continuous background monitoring, verification workflows, and better security history across a project's lifetime. These are directions, not promises — the work happens incrementally.

The builder
Hamza Al-Samraaie
Founder · HZSec

HZSec began as a project focused on making developer security tooling more practical, private, and accessible. The goal is simple: give every developer the tools to catch security problems early, without adding friction to their workflow or asking them to hand over their code.

Run your first scan.

Install the CLI, point it at any project, and see what it finds. No account required.

$ npm install -g hzsec-cli
$ hzsec scan .