v0.4.0 · Apache-2.0 · by Vatsal Shah

Inspect the repo. Keep the secrets out of the report.

An offline, read-only auditor for source, CI, containers, Kubernetes, Terraform, and AI-agent setup. No account. No telemetry. The CLI never calls the network.

npx vigilsutra@0.4.0 audit .

That writes vigilsutra-report/report.html and report.md. Open the HTML file in a browser.

What a scan does

42 rules, each with a bad and a clean test.
Reads git history (SHA-1 or SHA-256) until the time limit, without running git.
Redacts token-shaped text in text, JSON, Markdown, SARIF, and HTML.
Leaves an untracked .env unread when a git index exists.

What a scan does not do

Advisory matches use a snapshot from 2026-11-07, not a live feed.
Name tracking stops at object fields, dynamic imports, and function returns.
No mobile, runtime, or compliance verdict.
A clean report is not proof the project is secure.

Use it

vigilsutra audit . --fail-on high for a CI gate.
vigilsutra audit . --since <rev> for the files that differ.
vigilsutra sbom . for a CycloneDX file. vigilsutra fix . shows edits; --apply writes them.
vigilsutra init --hook to scan the git index before commit.
vigilsutra adapters install cursor (also claude, codex, gemini, copilot). File copy is tested. The IDE is not.

Handbook and rule list stay in the repository: docs/rules.md, quickstart, security model.