Perplexity open-sources Bumblebee security scanner

Hot take: this is the kind of security tooling that matters in real engineering orgs, because it focuses on answering "am I exposed right now?" instead of trying to replace SBOMs or EDR.

• –Strong practical angle: it scans local developer-machine metadata without executing package managers or install scripts.
• –Good fit for incident response: the baseline/project/deep profiles map cleanly to routine inventory, workspace checks, and emergency sweeps.
• –Narrow but useful scope: package ecosystems, MCP configs, editor extensions, and browser extensions cover the surfaces AI teams actually touch.
• –Open source makes it more credible and more adoptable, especially for teams that want a lightweight exposure checker they can run in their own workflow.