Argus
Every security scanner + an AI reviewer, one report
Start new thread

Argus - Every security scanner + an AI reviewer, one report

by•
Argus connects your Git repos and runs unified security scans with gitleaks, semgrep, trivy, and syft. AI reviewer verifies every finding, kills false positives, and adds the logic/authorization/business-flow bugs that pattern tools miss. You get one ranked, de-duplicated, source-tagged report instead of four noisy tool outputs. Self-hostable, multi-server agents, per-repo customization.

Add a comment

Replies

Best
Maker
📌
Hey Product Hunt 👋 We launched Argus. Argus started from a boring frustration: to actually check a repo, you end up running gitleaks, semgrep, trivy, and syft - four tools, four config files, four output formats. Point them at a real project, and you don't get an answer; you get four walls of noise. But the noise wasn't even the real problem. The first time I ran all four on a deliberately vulnerable benchmark repo (nodejs-goof), I got 200+ dependency CVEs and 600+ SBOM entries - and the bug that would actually get you owned, a prototype-pollution-to-RCE and a server-side template injection, was sitting in there with the same visual weight as a low-severity transitive dep nobody will ever reach. Detection was never the issue. Triage was. And the worst class of bug - a missing authorization check, an IDOR, a broken business rule - no regex emits at all. So Argus adds a reviewer. It runs every scanner and an AI-powered analyst that verifies each finding, throws out the false positives, and adds the auth/logic bugs the pattern tools can't see. Four walls of output in, one ranked, de-duplicated, source-tagged report out - worst-first, with the reasoning attached. Still fully self-hostable. Your Git tokens stay encrypted end-to-end, and every scan runs over a disposable, read-only copy of your repo - nothing writes back, nothing phones home. Built for teams whose code legally can't leave their own infrastructure. The part I find funny: the highest-CVSS finding is rarely the one that gets you breached. It's usually a five-line diff with no CVE, no score, and no scanner rule - "you forgot to check who owns this record." That's the gap the AI is actually for. Would love to hear how you run security today - one tool, five tools, a SaaS that emails you a 300-page PDF nobody opens, or given up entirely? (No judgment on the last one.) Happy to dig into the architecture, how the AI triage + ranking works, or how we keep your code from ever leaving your box. Fire away!