WhiteHat
Vigil checks any public GitHub repository for security flaws, explains them in plain words and hands maintainers a verified fix. No exploit code, ever. Nothing public before the flaw is fixed.
Verified fixes merged
first fix
Demo · simulated run
See it work
Every scan runs in its own sealed container: no network, ten minutes at most, destroyed the moment it ends. This is what one looks like, from clone to verified fix.
Simulated scan of a demo repository: sandbox, analysis, triage of four confirmed findings, a verified patch and a pull request.
By the numbers
Updated live
- 0
- Repositories scanned
- 0
- Vulnerabilities found
- 0
- Fix PRs opened
- 0
- Fix PRs merged
The pipeline
How a scan runs
- 01
Clone
A shallow, read-only copy inside an ephemeral container with no network access.
- 02
Analyze
Psalm taint analysis, PHPStan, Semgrep, composer and npm audit, osv-scanner and gitleaks.
- 03
Triage
Claude separates real flaws from false positives and explains each one in plain words.
- 04
Fix
A minimal patch, rescanned and tested before any pull request. Never merged automatically.
Responsible disclosure
Details stay with the maintainers. The public only sees numbers.
Locations and explanations are shown only to verified maintainers, or once a fix is merged. Secrets are never displayed, not even partially.
Recent activity
Full live feed →No scans yet
New scans appear here the moment they start, with their stage and the number of findings. Nothing else is ever shown.
Scan a repository