Find the flaw
before somebody else does.
Vift AI Studio is a desktop app that scans your code for leaked keys, vulnerable packages, insecure code and plain bugs, in forty-one languages. It runs on your own machine: your source is never uploaded.
Windows and Linux; macOS coming soonFirst month includedNo account needed
How a scan works
No agent to install on a server and no upload. It reads the code where it lives and tells you what is wrong, worst first.
Choose what to scan
A folder on this computer, a Git repository by its address, or a folder on a server over the SSH you already use.
Every check runs here
Credentials, dependencies, code, bugs, containers, pipelines and infrastructure, in one pass on your machine. Only package names and versions go out, to be looked up in public advisories.
Worst first, with the fix
Findings that together make a way in are joined into one. Each says what to change, and some it can change for you.
Rules that follow the data, not the line
Security rules for forty-one languages and template engines, and bug checks for sixty-seven languages and five data formats. A value is followed from where it comes in to where it is used, across files.
- Injection and unsafe code — queries joined from strings, shell commands built from a request, markup printed unescaped.
- Bugs that are not attacks — a merge left half-done, JSON that no longer parses, a value compared with itself, a loop counting the wrong way.
- An optional second reader — a model on your machine, or an API you choose, reads for the mistakes no rule can name. It is off until you turn it on.
Twenty-eight scanners, one engine
The terminal, the window and the dashboard run the same engine, so no two of them can disagree about the same scan.
- Committed credentials
- 96 vendor patterns — AWS, GitHub, Stripe, private keys — graded by whether git tracks the file;
--verifyasks the vendor whether a key is still live. - Credentials in git history
- The key deleted from the files and still in every clone.
- Internal tokens
- Credential-shaped names holding generated-looking values.
- Vulnerable dependencies
- Every package against OSV, across twenty lockfiles and manifests, ordered by what is being exploited.
- Supply chain
- Install scripts, typosquats, code trying not to be read.
- Code
- Injection, unsafe deserialisation, code built and run, markup printed unescaped — followed across files.
- Bugs
- Not attacks, in sixty-seven languages: conflict markers left in, code that no longer parses,
if (x = 0). 89.5% of Juliet's logic cases, no false alarms. - Second reader
- Optional: a model reads up to forty files for the bugs no rule can name, and says where they go first.
- AI tooling and apps
- MCP servers that run anything, keys shipped to the browser, Supabase without row-level security, Firebase in test mode, and a launch checklist for vibe-coded apps.
- Speed
- Queries in loops, missing indexes, unpaginated lists, heavy images, unused packages.
- Mobile
- Cleartext traffic, pullable backups, debuggable builds, exported components.
- Devices and control systems
- MQTT, PLC protocols, firmware and bootloaders.
- Containers and pipelines
- Unpinned images, baked-in credentials, the Docker socket, forks checked out with secrets.
- Infrastructure
- Terraform and Kubernetes: open ingress, public buckets, privileged pods, Secrets in clear.
- Ports and this machine
- The socket table on all three platforms — never a packet sent — the Docker daemon, key files anyone can read.
- Cloud accounts
- AWS, GCP, Azure, Cloudflare, Kubernetes, Oracle, Alibaba — read-only, from credentials already here.
- Repository settings
- Branch protection, workflow permissions, deploy keys — asked of GitHub.
- A live site
- Certificate, TLS, security headers, cookie flags, CORS — once you have proved the host is yours.
On a plan it also watches a folder or the whole machine, puts a firewall in front of an app or an AI agent, answers your AI assistant over MCP, scans a server over SSH, runs on every pull request, and sends findings to Slack, email or a team server you host.
Measured on public test suites
What matters is what the rules find in code written to test them, and what they report in code that is safe: a scanner that cries wolf is switched off within a month.
100%
OWASP Benchmark
2,740 Java test cases. All 1,415 vulnerable ones found; none of the 1,325 safe ones reported.
100%
NIST Juliet, Java
Sixteen web weaknesses, sampled evenly across every flow variant. Every flawed method found; 1.4–1.6% of clean ones reported.
96%
Semgrep's own rule tests
106 of 110 of the cases Semgrep writes for its security rules, and no false alarms. 89.7% counting its audit rules.
27%
NIST Juliet, C and C++
The weak one. Use after free 59%, double free 31%, format strings 53%, all with no false alarms. Buffer overflows need a compiler's model of memory: 3%.
Reports
Nine ways out
A scan usually ends with somebody asking for it. Email it, post it to Slack, Discord, Teams or WhatsApp, send it to any webhook, or save it in the format the person asking needs.
Nothing carries the credential
Evidence is redacted where it is found: a report names a finding without being the leak. No scanned file content ever appears in one.
Nothing runs
The PDF has no JavaScript, the web page no script, and the spreadsheet defuses cells starting =. A report Excel would execute is the attack, not the warning.
Every finding carries a CWE and an OWASP category, so it means something to a code-scanning tool and to whoever is filling in the security questionnaire.
Two rules it holds itself to
Only what you own
Nothing here can be pointed at somebody else's system. The file scanners read a directory; the port inventory reads this machine's own socket table and never sends a packet. The site audit refuses to run until you have proved control of the host — by DNS record, a file, or a response header.
No dependencies
A security tool with four hundred transitive packages is its own attack surface. The scanner, the API, the database layer, the dashboard, the PDF writer and the zip writer are all Node's standard library.
And one thing it will not claim: a scan that found nothing has checked what it knows how to check. That is not the same as there being nothing there, and every report says so.
Pricing
₹599 buys the app for Windows or Linux, and your first month at the One month level comes with it. After that, a plan from ₹875, bought inside the app. Each is paid once; nothing renews by itself. Prices are in Indian rupees, paid through Razorpay. Terms · Refunds · Delivery
Download
₹599
once, first month included
- The app, on Windows or Linux
- Your first month at the One month level
- Every check, every finding, nothing withheld
One month
₹875
28 days
- Unlimited scans
- 3 projects, clouds or monitors at a time
- SARIF and PDF reports
- Container images and cloud accounts
- Slack, email and webhooks
Three months
₹2,499
84 days, about 5% less than three single months
- Everything in One month
- 3 projects, clouds or monitors at a time
Enterprise
₹7,999
28 days
- Everything in One month
- No limit on projects, clouds or monitors
- Scheduled background scans
- Team workspaces and roles
Plans are bought, renewed or switched inside the app, under Settings → Licence. The licence installs as soon as Razorpay confirms the payment, and renewing early adds the days you have left.
A licence is a signed key checked on your own machine. Nothing is sent anywhere and it works on a disconnected network — so every key is signed to a name, and that name appears on every scan and in every report.
Download
₹599 for Windows or Linux, with the first month included. Nothing is installed: unzip it, run it, and point it at a folder, a repository or a server.
Vift AI Studio for Mac is coming to the Mac App Store soon. Until then it runs on Windows and Linux. Already using it on a Mac? Its update is still here: Apple silicon · Intel
vift.cmd update --verify=ViftStudioAI-windows-x64.zip
(./vift on Linux). It says Genuine or tells you not to run it.
Questions
Does my code leave my machine?
No. Scanning runs on your machine, even with the network unplugged. A default scan asks public advisory databases about your packages — names and versions only, and you can switch that off. The one thing that can send code anywhere is the optional second reader, off until you choose it, which says where the files go first.
Do I need an account?
No. A licence is a signed key checked on your own machine, and the app works without signing in. Signing in is optional: it brings your plan back after a reinstall or on a new computer, and it never sees your code.
I paid — how does the licence get into the app?
Buy from inside the app (Settings → Licence) and it installs itself the moment Razorpay confirms — even if you closed the window or paid by UPI. Bought on this site instead, press "Open in Vift AI Studio" after paying; the key is shown too, for another machine.
Which languages does it read?
Security rules cover forty-one languages and template engines, from JavaScript, Python, Java, Go and C to Solidity, Vue, Svelte, Jinja and Razor. Bug checks cover sixty-seven languages and five data formats. Help → Languages and checks in the app lists every one.
Can Claude, Cursor or another AI assistant use it?
Yes — over MCP, with a ready-made entry for each under Settings → Connect AI tools. Any other program can use the REST API on the same machine, with a key on every request.
Why does my computer warn me when I open it?
Because the builds are not code-signed yet, and the warning is telling the truth. Check the download against the published checksums, or with the signed release manifest from a copy you already trust. A Windows version signed by Microsoft is coming to the Microsoft Store.
Is there a Mac version?
It is coming to the Mac App Store soon. Until then, Vift AI Studio runs on Windows and Linux.
Download Vift AI Studio
Windows or Linux, ₹599 with the first month included. A question before you buy goes to support@brainybolt.net, and a person answers within two working days.