Every day is zero day
CRAZY.
Critical Response Against Zero-day Yikes
A static abnormality and vulnerability scanner for the five biggest languages — Python, JavaScript/TypeScript, Java, C/C++ and Go — with a rule pack built for banks and finance. One command, zero dependencies, runs in your CI.
$ crazy ./my-bank-app
CRITICAL app.py:3 PY-PICKLE
pickle deserialises untrusted data into code execution (CWE-502)
CRITICAL app.py:8 FIN-CARD [FINANCE]
possible real card number (PAN) in source - PCI DSS violation (CWE-312)
CRITICAL server.js:1 JS-JWTNONE
JWT 'none' algorithm accepted - auth bypass (CWE-347)
HIGH main.go:2 GO-TLS
TLS verification disabled (CWE-295)
MEDIUM Ledger.java:3 JAVA-RANDOM
java.util.Random is not cryptographically secure (CWE-338)
Dependencies: 2 checked, 8 with known vulnerabilities
VULN npm lodash@4.17.15 GHSA-p6mc-m468-83gw
Health score: 0/100 (619 ms)
5languages
48rules, CWE-mapped
6finance-specific rules
0npm dependencies
liveOSV vulnerability DB
What it catches
- Injection: SQL, shell, code (eval/pickle/deserialisation), XSS, XXE, JNDI (Log4Shell family)
- Memory: strcpy/gets/sprintf, format strings, overflow-prone malloc
- Crypto and TLS: disabled certificate checks, weak hashes, insecure random
- Secrets: API keys, AWS keys, private keys committed in source
- Finance pack: card numbers (PAN) and IBANs in code, money as float, sensitive data in logs, disabled auth/MFA/KYC flags, money-moving calls without idempotency
- Dependencies: every declared package checked against osv.dev, used by Google and GitHub
Get it — $4 or sats, one-time
Free for personal use and open source. Commercial use needs a licence: one payment per developer, rule updates for a year.
After paying, download: crazy-0.1.0.zip
Unzip, then:
Or run straight from the repo:
Unzip, then:
node src/cli.js ./your-project (Node 18+, nothing to install)Or run straight from the repo:
npx github:hasky00/CRAZY ./your-project
In CI
# .github/workflows/crazy.yml
- run: npx github:hasky00/CRAZY . --fail-on=high --out=crazy-report.json
Exit code 1 on any high or critical finding, or any known-vulnerable dependency. The build stops; the yikes never ships.