Perplexity Open-Sourced a Scanner Every Dev Should Know — Bumblebee
Perplexity AI has open-sourced Bumblebee, a developer-machine supply chain scanner that audits your local environment for security risks — from exposed credentials and misconfigured SSH keys to vulnerable package managers and browser extensions. Unlike traditional SCA tools that scan codebases, Bumblebee targets the machine itself, the often-overlooked attack surface where developers work every day.
Dev Machine Supply Chain Problem
Most supply chain security tooling focuses on the CI/CD pipeline or the dependency graph of your codebase. But there's a massive blind spot: the developer's machine itself. Your laptop has SSH keys, API tokens, package managers, browser extensions, and system configurations that are all part of the trust chain.
If a developer's machine is compromised — through a malicious VS Code extension, a rogue npm global package, or a misconfigured SSH agent — the entire supply chain is at risk. Bumblebee was born to audit exactly this surface area.
"Your CI pipeline can be hardened to the moon, but if the dev machine that pushes code to it is compromised, none of that matters."
What Is Bumblebee
Bumblebee is an open-source, read-only scanner built by Perplexity AI that audits developer workstations for supply chain risks. It runs locally, inspects system configurations, installed packages, credentials, and extensions — then produces a structured report of findings.
- Open source — fully inspectable code, no phoning home
- Read-only — never modifies your system, only observes
- Developer-focused — scans the tools devs actually use daily
- Structured output — NDJSON format for easy integration with pipelines
Install & Self-Test
Bumblebee ships as a single binary. Installation is straightforward — download the release for your platform and run it. One of its first tricks is a self-test mode that verifies the scanner itself hasn't been tampered with.
The self-test checks the binary's integrity and verifies it can access the scan targets it needs. This is especially important for a security tool — you want to know the tool itself is trustworthy before trusting its output.
Baseline Scan
Running a baseline scan gives you an immediate picture of your machine's security posture. Bumblebee checks for common misconfigurations, exposed secrets, and risky installations across your development environment.
The output groups findings by severity and category, making it easy to prioritize what to fix first. Even on a well-maintained dev machine, you'll likely find a few surprises.
NDJSON Output
Bumblebee outputs findings in NDJSON (Newline Delimited JSON) format by default. Each finding is a self-contained JSON object on its own line, making it trivial to pipe into other tools, filter with jq, or ingest into a SIEM.
This design choice makes Bumblebee composable. You can build automated workflows around it — run it on a schedule, diff results over time, or integrate it into onboarding scripts for new developers.
Not Another SCA
Bumblebee is not a Software Composition Analysis (SCA) tool. It doesn't scan your project's package.json or Cargo.lock for vulnerable dependencies. Tools like Snyk, Dependabot, and Grype already do that well.
Instead, Bumblebee focuses on a different layer entirely:
- System-level packages — globally installed tools (npm -g, pip, brew) that aren't in any lockfile
- Credential hygiene — SSH keys, GPG configurations, environment variables with secrets
- IDE & browser extensions — VS Code plugins, Chrome extensions with broad permissions
- OS configuration — firewall settings, disk encryption status, auto-update policies
"SCA scans your code's dependencies. Bumblebee scans the machine that writes the code. They're complementary, not competing."
Scan Profiles
Bumblebee supports scan profiles that let you customize what gets checked. Different teams have different threat models — a backend engineer's machine looks different from a mobile developer's.
- Default profile — broad sweep of common dev machine risks
- Strict profile — enterprise-grade checks including disk encryption and firewall rules
- Custom profiles — define your own YAML-based scan configuration for team-specific needs
Coverage
Bumblebee covers a wide range of scan targets across macOS and Linux developer machines:
- Package managers — Homebrew, npm (global), pip, cargo, Go binaries
- Version control — Git config, commit signing, credential helpers
- SSH & keys — key strength, passphrase protection, authorized_keys audit
- Containers — Docker daemon configuration, exposed sockets
- IDE plugins — VS Code extensions, JetBrains plugins
- Browser extensions — Chrome/Firefox extension permissions audit
- System security — firewall, disk encryption, SIP (macOS)
The coverage continues to grow as the community contributes new scan modules.
Read-Only Design
A core design principle of Bumblebee is that it is strictly read-only. It never modifies files, changes configurations, or installs anything. This is critical for a security tool — you need to trust that running it won't introduce new risks.
The read-only constraint also makes it safe to run in automated contexts. You can put Bumblebee in a cron job, a CI step that audits build agents, or an onboarding script without worrying about side effects.
"Bumblebee only looks. It never touches. That's not a limitation — it's the entire point."
Should You Use It
If you're a developer who cares about security — or a security team that wants visibility into developer workstations — Bumblebee fills a gap that most other tools ignore. It's lightweight, open source, and non-invasive.
- Individual devs: Run it once to see what your machine looks like from a security perspective. You'll learn something.
- Teams: Include it in onboarding to establish a security baseline for new hires.
- Security orgs: Use NDJSON output to aggregate findings across the fleet and track posture over time.
The tool is still young but already useful. Being open source means you can audit the scanner itself, contribute scan modules, and shape the roadmap.