Launched this week
Virgil
A security scanner that tells you what not to fix
22 followers
A security scanner that tells you what not to fix
22 followers
Virgil is an AI-assisted security audit platform for source code. Security at this moment essential for vibe coded applications and indie developers. It runs the scan in a sandbox, clusters duplicate findings, drops unreachable dependency CVEs, and ranks what to fix this week, with explanations grounded in your actual code. Open source, pay per audit, 3 free scans. You can find the web app at virgilhq.app, or download the cli: pipx install virgilhq&&virgil login&&virgil scan
@ayanm I've tried it and it was very helpful
Tell me more about it!!!!!!!
NOWWWWW
@huzaifa_anwar Thanks, Huzaifa, glad it was useful!
A bit more on how it works: it runs the scan in a locked-down sandbox (--network=none, read-only, non-root), then does the part most scanners skip, it clusters findings that share a root cause into one item instead of listing every call site separately, and checks whether a flagged dependency CVE is actually reachable from your code before it earns a spot in the queue. Unreachable ones get demoted, not deleted, so nothing's hidden, it's just not blocking your week. Your raw secrets never reach the LLM -> code context does, redacted first. Your privacy and security is important to us, and we do not break it.
Everything you see explained is grounded in the actual code slice too, the LLM isn't freelancing, it's citing what's really in your repo, and there's a validator that rejects anything that looks like a payload or exploit walkthrough.
3 more free audits have been credited to your account, if you want to point it at another repo. What repo did you run it against, out of curiosity?
Actually I don't understand how it works
Some_one help me.
@abdullah_randhawa2 Sure, simple version:
1. You give it a link to your repo (or upload a zip) on either the web app or the command line interface.
2. It runs a few well-known security scanners on your code, safely, inside a locked-down sandbox.
3. Instead of dumping every single warning on you, it groups duplicates together and ignores the ones that don't actually apply to your code (like a vulnerability in a package you never even use).
4. You get a short list back: "fix these this week," with a plain-English reason for each one.
Takes about 3 minutes. Happy to answer anything more specific!