Harden CLI is the OSS core: static analysis, deterministic dependency locking, Dockerfile generation, and SBOM + vulnerability reporting. Enterprise adds runtime profiling, guardrails, and fleet management.
Start with the CLI in CI. Upgrade when you need runtime enforcement.
Three commands. From source to Dockerfile + SBOM.
What a typical vibe-coded app looks like vs. what harden produces
harden analyze scans secrets, dependencies, and frameworks and writes a structured JSON report, including an inferred entry_command.
Generate a CycloneDX SBOM with vulnerability metadata from OSV, backed by a local cache for fast CI runs.
harden lock produces requirements.lock and a build report, inferring dependencies from imports when a manifest is missing.
harden generate prefers requirements.lock, falls back to requirements.txt, and supports pyproject.toml-only projects.
Scan secrets, dependencies, framework, and risks. Emit a JSON report with entry command.
Pin every dependency to an exact, reproducible version (with import inference if needed).
Write a lockfile-aware Dockerfile and CycloneDX SBOM, with optional fail-on-critical.
Uses requirements.lock when present, falls back to requirements.txt, and supports pyproject.toml-only installs.
Dependency vulnerabilities are enriched via OSV with a local cache for fast, repeatable CI runs.
Best-effort detection of how your app should run, surfaced in both terminal output and JSON reports.
Generates a CycloneDX SBOM from pinned dependencies with vulnerability metadata when available.
OSS stays minimal. Enterprise adds runtime enforcement and fleet controls.
Analyze, lock, generate (Dockerfile + SBOM) for Python apps.
Closed-source extensions for runtime hardening and org workflows.
Run the OSS core locally or in CI. Docs at /docs.
pip install harden-cli
"Because 'it works on my machine' isn't a security strategy."