Show HN: Rowan, an open-source SAST scanner for AI apps (code, models, MCP)" (github.com)

Rowan, a new open-source Static Application Security Testing (SAST) scanner specifically designed for AI and machine learning applications, has been announced. This tool scans source code and model files to identify potential security vulnerabilities without executing any code, making it safer to use. It can detect a variety of issues, such as injection flaws, unsafe deserialization, and leaked secrets, among others. The current alpha version emphasizes that its findings should be treated as leads rather than confirmed bugs, underscoring the importance of manual verification in security assessments. Rowan is significant for the AI/ML community as it addresses the increasing need for security in AI-driven projects, where unique challenges and vulnerabilities often arise. It supports extensive analysis for Python and modern JavaScript, with built-in mechanisms to analyze dependencies for known vulnerabilities. Developers can easily install Rowan and initiate scans using command-line tools, producing reports in multiple formats. The tool is built with a comprehensive rule catalog that encompasses 590 rules, ensuring broad coverage of potential security flaws. This innovation is part of the evolving landscape of secure AI development, providing essential resources to enhance security practices in the growing field of AI/ML applications.