Script and hook detection
Find package lifecycle scripts, editor automation, dev-container hooks, and remote content piped directly into shells.
v1.0.0 available now
Inspect repositories
Inspect repositories
before they run.
BeforeRun is a zero-dependency Go security scanner that exposes risky scripts, hooks, downloads, credentials, binaries, symlink escapes, and Unicode deception before project-controlled code executes.
Open source
MIT licensed
Local-first
Windows · Linux · macOS
$ beforerun scan ./untrusted-repo --fail-on high
BeforeRun PASS — risk 0/100 (CLEAN)
Scanned 47 files in 18ms
Findings: 0 critical, 0 high, 0 mediumRepository intake security
Catch execution surfaces ordinary linters ignore.
Repository artifact analysis
Flag executables, dynamic libraries, private keys, suspicious submodules, and symlinks escaping the project root.
Automation-ready reports
Use human-readable output or structured JSON with configurable severity thresholds and reliable CI exit codes.
Start scanning
One command. No runtime dependencies.
CLIInstall the scanner
go install github.com/theworker02/beforerun/cmd/beforerun@latestMODULEEmbed the scanning API
go get github.com/theworker02/beforerun@v1.0.0Do not trust first. Inspect first.