v0.1.0: first release

First public release of Deviant: it finds the one thing in your code that breaks the pattern.

Install

pip install deviant-scan
deviant-scan path/to/your/project --with-git

Or run it once without installing: uvx deviant-scan path/to/your/project --with-git.

In Claude Code, to have Claude judge each exception:

/plugin install deviant --marketplace ImalkaPerera/deviant

What is in it

• FastAPI routes: finds a route missing the auth, rate limit or response model its neighbours
  have. Auth is followed through routers, shared dependencies and include_router.
• GitHub Actions: finds an action not pinned to a commit, a job with no timeout, and a workflow
  with no permissions block or concurrency setting, in workflows and composite actions.
• Git evidence for each exception: who last changed it, when, why, and how many of the
  protected items that person wrote.
• A Claude Code skill that labels each exception as a bug, intentional or unsure, with proof.
• Coloured output in a terminal, JSON with --json, and support for Python 3.10 to 3.14.

What to know

• This is an early release. It has been run on seven real open-source projects, with the results
  read by hand. At the default settings it reported one candidate, which turned out to be
  intentional.
• There is no confirmed bug in someone else's project yet, and no accuracy number. Both are on the
  roadmap.
• Small projects will often show nothing: a rule needs roughly 25 similar items before one
  exception is strong evidence.

Full story, including what the early versions got wrong:
tested on real projects.