scanned 1mo ago·osv · gitleaks · opengrep · picklescan + heuristics·full breakdown in the Security tab ↓
Chonkie
Chunking is the unglamorous step that quietly decides RAG quality — split too coarsely and retrieval drags in noise, too finely and you shatter context. Chonkie is a no-nonsense library dedicated to doing exactly this one job well, with a tiny footprint and fast defaults instead of a heavyweight framework.
Key features
Multiple chunker strategies: token, word, sentence, recursive, semantic (embedding-similarity), and code-aware splitting
Built for speed and low memory so ingestion of large corpora stays cheap
Pluggable tokenizers and embedding backends; overlap and size fully configurable
Handy SemanticChunker groups semantically coherent sentences for cleaner retrieval units
Small dependency surface — installs light and drops into any ingestion pipeline
It slots in ahead of your embedding + vector-store step, turning raw documents into well-formed passages that downstream retrievers and rerankers can actually use.
Curated mirror of the open-source Chonkie (MIT). Get it from the source.
! Security: Review · 7575/100 · grade Bscanned 1mo ago
✓ no compromise signals14 risk-surface · 6/20 OWASP controls flagged
Compromise signals — malicious or tampered code (leaked secrets, backdoors, a dropped executable) — reduce the score, and known dependency CVEs carry a bounded penalty (they warrant review but never QUARANTINE — update the dependency to clear). Other dangerous-by-capability traits are risk surface, expected for some capabilities. Every finding is mapped to its OWASP control below.
What this capability can do · med confidence (static)
Findings mapped to the OWASP Top 10 for LLM Applications (2025) and the OWASP Machine Learning Security Top 10. Expand any flagged control for the exact findings — compromise reduces the score; expected/risk-surface do not, except a known CVE, which carries a small bounded penalty (high/critical → Review).
OWASP Top 10 for LLM Applications
⚠LLM03Supply Chaincritical
Vulnerable/compromised dependencies, models or archives in the artifact.