About Blunt Code

What it is

Blunt Code is a free, open-source desktop app for Windows that checks code quality and security without sending your code anywhere. It bundles eleven analyzers — Ruff for Python, Biome for JavaScript, TypeScript and React, Semgrep with a curated security rulepack, a managed SonarQube runtime, gitleaks for repo-wide secrets, OSV Scanner and Trivy for dependency CVEs, Checkov for infrastructure-as-code, a license scanner, plus built-in secrets and TODO/FIXME trackers — behind one executable and a local web interface. Findings from all eleven merge into a single report you can export as Markdown, HTML, SARIF, CSV or JSON, with scan history and diffs over time.

Who maintains it

Blunt Code is built by Sanket Patel and published as open source under the MIT license at github.com/sanketpatel32/Blunt-code. Releases ship as a portable ZIP with SHA-256 checksums and a one-line installer that verifies them. Development history, roadmap notes and every change are public in the repository’s commit log and changelog.

Why local-first

The project starts from one position: getting quality signals on your code should not require handing your code to someone else’s server. Cloud scanners work by uploading your repository; Blunt Code runs every analyzer on your own machine, serves its interface on a loopback address, and stores results in a local database. After the analyzer tools are downloaded on first run, everything works offline. There is no account, no upload path, and no telemetry — the design goal is that the answer to “where does my code go?” is always “nowhere.”