IKAREM EXTENSIONS

Power tools, one pip install each.

The core stays zero-dependency forever. Everything heavy — active vulnerability scanning, OAuth2 social login, verified backups — ships as an installable extension that never touches ikarem/. Basics built in, power installable.

01 — IKAREM-PENTEST

Pentest your own Python API before strangers do.

pip install ikarem-pentest — then ikarem-pentest myapp:app fires auth-bypass, reflected-XSS, SQL-injection smoke, open-redirect, body-cap, and traceback probes at every route, in-process via TestClient. No server, no network, no third-party service. CI gate with --strict, ticket-ready reports with --format markdown, and the 8000+ template Nuclei engine via --nuclei --serve. Full detail: the pentest page.

02 — IKAREM-OAUTH

Google/GitHub login plus refresh tokens that survive audit.

pip install ikarem-oauth — OAuth2 authorization-code flow with PKCE S256, single-use login state, exact redirect allowlists, RFC 6749 error codes, and opaque refresh tokens with single-use rotation (replay kills the whole chain) and revocation. Stdlib only. Full detail: the OAuth page.

03 — IKAREM-BACKUP

Backups that prove they restore.

pip install ikarem-backup — online dumps of live SQLite files, a restore drill (integrity_check + table census) on every run, retention pruning, and an upload hook for S3. Stdlib only. Full detail: the backup page.

MODEL

Freemium, stated plainly.

Free forever in core: ikarem audit (read-only security grading), ikarem check (static handler audit), JWT auth, rate limiting, security headers. Installable power: ikarem-pentest (live-fire attacks + Nuclei), ikarem-oauth (refresh rotation + social login). Every extension documents its removal path — uninstall and the app keeps working on core alone.

FAQ

Straight answers.

What are IKAREM extensions? Installable pip packages that add security power tools without changing the zero-dependency core.

How do I pentest my own Python API? pip install ikarem-pentest && ikarem-pentest myapp:app — six active probes in-process, Nuclei layer optional.

How do I add Google/GitHub login? pip install ikarem-oauth, register OAuthPlugin with a preset and an on_user hook.

Do extensions slow down the framework? No — outside ikarem/, lazy-loaded, zero new required dependencies.

KEEP GOING

From extensions to running code.

New here? Start at the docs, then the 25-chapter guide. Compare surfaces in the reference, copy from 20 recipes, or map your old framework in migration guides.