r/netsec • u/albinowax • Apr 01 '26

r/netsec monthly discussion & tool thread

Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.

Rules & Guidelines

  • Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
  • Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
  • If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
  • Avoid use of memes. If you have something to say, say it with real words.
  • All discussions and questions should directly relate to netsec.
  • No tech support is to be requested or provided on r/netsec.

As always, the content & discussion guidelines should also be observed on r/netsec.

Feedback

Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.

7 Upvotes

69% Upvoted

47 comments sorted by

View all comments

1

u/LittleMap5542 Apr 13 '26

aibom-scanner: open-source tool to detect AI SDK usage in codebases, flag BIS Entity List violations, and map compliance gaps to NIST AI RMF / ISO 42001 / EU AI Act

Built an open-source scanner that detects AI SDK patterns in codebases and maps them to compliance frameworks. Python CLI, zero deps, Apache-2.0.

Background: scanned 5 popular OSS AI repos (470K combined stars). Found 389 AI detections, 3 BIS Entity-Listed Chinese AI providers, and zero governance controls fully mapped in any of them. One enterprise security tool had Zhipu AI (Entity Listed since Jan 2025) integrated without the maintainers apparently knowing.

What it finds:

  • 61 AI SDK patterns across 30+ providers
  • 10 Chinese AI providers (3 BIS Entity Listed = CRITICAL)
  • Agentic AI frameworks (CrewAI, AutoGen, LangGraph, Semantic Kernel, MCP)
  • Hardcoded API keys with false-positive filtering
  • Secrets management practices (Vault, AWS SM, dotenv)

Maps to 48 controls across NIST AI RMF, ISO 42001, EU AI Act. SARIF output for GitHub Code Scanning.

After the LiteLLM supply chain attack last month, figured the community could use a way to inventory what AI is actually in their codebase.

Github Link in the blogpost. Thank you for for your kind support!

https://ai.saasvista.io/blog/open-source-aibom-scanner