Find the credential
before somebody else does.
Continuous security scanning for the code, the machines and the sites you own. Committed credentials — including the ones already deleted from the files and still live in the history. Vulnerable dependencies, graded by what is actually being exploited. Insecure code, containers, pipelines and infrastructure.
Download
The desktop app
Nothing is installed. Unzip it, run it, point it at a folder or a repository. It reads the code where it lives and sends findings — never source — to an account, if you connect it to one at all.
These builds are not code-signed. Your operating system will warn you the first time, and that warning is doing its job — an unsigned program is one nobody has vouched for. Every release publishes SHA-256 checksums so you can confirm the file you downloaded is the file that was built.
Or from a terminal
One command, no install
Node 22.5 or later and git. Nothing else — the scanner, the
API, the database layer and the dashboard are Node's standard library
and two public APIs.
# scan this project npx viruxacloud . # a repository somewhere else — cloned, scanned, deleted npx viruxacloud repo owner/app --history # a PDF for the audit and a spreadsheet for the backlog npx viruxacloud . --format=pdf,csv # keep scanning after the terminal closes npx viruxacloud service install . --every=60
It exits 1 when anything critical or high is open, so it can gate a build without anybody parsing the output.
What it checks
Ten scanners, one engine
The same engine answers the terminal, the window and the dashboard, so no two screens can disagree about the same scan.
The part that changes the conversation
Is the key you found still live?
Most scanners tell you something looks like an AWS key. Ask for
--verify and this one asks the vendor. A repository with
three hundred findings and four working keys is four problems — and
everything else can wait until Monday.
Live
The vendor accepted it just now. Not a finding — an incident, and the first thing in the report.
Revoked
Refused. Still worth fixing the habit that put it there, and no longer worth waking anybody up for.
Not checked
No verifier for that vendor, or the network was down. Said out loud, because a key wrongly reported as dead is the most dangerous thing a scanner can print.
It is off unless you ask for it, and it always will be. Verifying a credential means sending it to the vendor, which is the one thing the rest of this product exists to avoid. Each key is offered to exactly one host, named in the source, over https, with redirects refused — and the least authenticated call each vendor has.
Handing it over
Seven ways out
The question a scan actually ends on is "can you send me that". Every format is a button in the window, a button in the dashboard, and a flag on the command line — the same document from all three.
Nothing carries the credential
Evidence is redacted where it is found, so a report identifies a finding without being the leak. No file content from the scanned project appears in any of them, ever.
Nothing runs
The PDF has no JavaScript and no embedded files. The web page has no script and no network. The spreadsheet defuses cells beginning =, because a security tool that ships a file Excel executes is the delivery mechanism rather than the warning.
Every finding carries a CWE and an OWASP category, so it means something to a code-scanning tool and to whoever is filling in the security questionnaire.
In your pipeline
Findings on the pull request that caused them
One step, nothing installed, no container image. Upload the SARIF and the findings appear inline next to the lines they are about — for the people who were never going to open a separate dashboard, which is most of them.
- uses: viruxaai-hash/viruxacloud@v1
id: viruxa
with:
history: 'true' # read what the commits added
fail-on: high # or `none`, to report without blocking
- uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: ${{ steps.viruxa.outputs.sarif }}
The fingerprints are the same ones the dashboard uses, so a finding dismissed in one is recognisably the same finding in the other.
The cloud half
Run the server yourself
A dashboard, a scheduler that rescans while nobody is watching, and
notifications that only ever tell you what is new. It is the
same repository — npm run serve — and it stores findings,
never source.
Teams
Owners, members and viewers. Invitations are codes rather than emails, because a security tool with a mail server is a security tool with an SMTP credential to protect.
Trend
Every scan ever run, counted by severity. "Is this getting better" is the question a security programme is judged on.
Told, not asked
Signed webhooks carrying only what changed since the last scan. A notification that repeats last night's three hundred findings gets a mail rule within a week.
Two rules this holds itself to
Only what you own
Nothing here can be pointed at somebody else's system. The file scanners read a directory. The port inventory reads this machine's own socket table and never sends a packet.
The site audit refuses to run until control of the host has been proved by DNS record, a file, or a response header — and the refusal is in the function, not in a policy that could be relaxed. Unauthorised scanning is a crime in most countries and a product that makes it easy is a liability rather than a feature.
No dependencies
A security tool with four hundred transitive packages is its own attack surface, and the irony would be fatal to it.
The scanner, the API, the database layer, the dashboard, the PDF writer and the zip writer are all Node's standard library. The only dependency in the repository is Electron, and only the desktop window uses it.
And one thing it will not claim: a scan that found nothing has checked what it knows how to check. That is not the same as there being nothing there, and every report says so.