LanguageFounding pilotRequest a scoped pilot

VIGILRA / Assessment

Overview

View for

Know what changed. Know what still needs proof.

Compare repository assessments, inspect the source evidence and prepare a repair brief for your developer.

GITLEAKS + OSV

Authorised operators can import private runner reports in the operator workspace. This public example contains fictional data. Operator workspace ↗

Files stay in this browser tab. No upload, source execution or persistent storage.

Fictional release comparison · no scan performed

Release evidence

fictional/acme-agent

11111111 → 22222222

Review before release

These observations need developer review. Exploitability and application impact have not been verified.

Current findings2

Engines completed2 / 2

Snapshot files148

Files omitted0

Repair tasks

What should we fix first?

Related dependency findings become review tasks. Every priority has a reason; every finding stays visible.

Fictional example — including any intelligence values

2Current findings

2Repair tasks

—Tasks with KEV matches

No intelligence lookup in this report

Selected task

github-pat

Why this comes first: Provider-specific credential candidate

Confirm the candidate and its owner. If real, rotate or revoke it at the provider and test the integration. Deleting the string does not revoke access.

Install scope: Not applicable

Intelligence sources

No intelligence lookup in this report

EPSS older than two days cannot raise priority. KEV absence is considered recent for seven days. Missing or low scores never clear a finding.

Review order: KEV → credential candidates → critical → EPSS ≥10% → high → unknown → remaining. Production/mixed install scope breaks ties. This is Vigilra's policy, not a CISA or FIRST deadline.

Data: CISA KEV (CC0); EPSS by FIRST / Empirical Security. CISA ↗ · FIRST ↗

Install scope is not runtime reachability. This queue does not change severity, close findings or approve a release.

Release comparison

Evidence detail

Possible exposed credential

A Gitleaks rule matched a credential-like value at this location. The value is removed. Validity and live access were not tested.

Source location: workflows/customer-agent.json:42

Review → change → test → re-scan

Confirm the credential. If real, revoke or rotate it at the provider, move configuration to a secret store, then test the integration and scan again. Removing the string alone does not revoke access.

A missing finding is not proof of a safe fix. Rotation, runtime behavior and regression tests need separate verification.

Coverage & provenance

Gitleaks 8.30.1Completedcompleted · 0.4sSHA-256 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb

OSV-Scanner 2.7.0Completedcompleted · 4.5sSHA-256 160c6253e2922e9e0a6a9771c5c4c40a4b3c6090b34a3cdd5e80c96cc2e4218b

Commit: 2222222222222222222222222222222222222222
Assessment time: 10/31/2026, 9:00:00 AM
Assessment policy: vigilra-repository-2026.10.31.2

Outside this assessment: git history, untracked files, media/archives, non-npm and local/private packages, access control, AI behavior, deployed configuration and application regression tests.

Reports describe a local runner's observations. A digest identifies content; it does not prove origin or certify security.

Test the boundary. Keep the proof.

Repeatable staging checks for cross-tenant data exposure and instructions hidden in untrusted content.

STAGING / RESPONSE EVIDENCE

Fictional example · no customer test performed

Reports stay in this browser tab. Credentials, prompts and response bodies are excluded by the runner. No upload or persistent storage.

Private reports can be opened by authorized operators in the workspace. This public example uses fictional data. Operator workspace ↗

RELEASE / bbbbbbbb

Review before release

A pass covers only the declared cases and attempts. It is not proof that an AI system is secure or that a production repair is complete.

fictional/acme-support-agent

1Failed checks

3/3Controls established

18HTTP attempts

2Now passing

A comparison needs the same test pack, runner, model and target. Changing the test scope cannot close a previous failure.

Test outcomes

Current results, including positive controls.

Observed evidence

Tenant data boundary

Checks whether one test identity receives the other tenant’s synthetic marker. Both legitimate-access controls must pass first.

1 / PassedDeclared response assertion passed

2 / FailedForbidden synthetic marker observed

3 / PassedDeclared response assertion passed

Give your developer the failed case and repair brief, then compare the same test pack after the change.

Scope & provenance

Asset: fictional/acme-support-agent
Declared release: bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
Declared model / workflow: fictional-model-version-1
Staging host: staging.example.com
Runner policy: vigilra-behavior-2026.10.31.1
Test pack digest: cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc
Recorded at: 2026-10-31T09:00:00Z
Attempts per check: 3

VIGILRA / FOUNDING REVIEW

A review with a clear next step

Start with one application and one AI workflow. Agree the scope and price first, then receive reviewed evidence, prioritized repairs and a defined follow-up check.

Website and repository observations
Authorized staging behavior checks where supported
Prioritized developer handoff and scoped retest

Request a scoped reviewFounding review service. Customer connections, continuous monitoring and automatic repairs are not included in the current pilot.

Illustrative samplehttps://example.com/

Fictional example. No scan was performed.

Homepage posture

Weighted observations, not a breach probability or a security guarantee.

Needs review02Findings

Checks assessed9 / 10

Your next priority

Review the observations in context, agree a change, then test it before release.

VIGILRA / INSIGHT

Evidence, in focus.

Select a status to filter the findings below. Every value comes from this report.

Observation balance

10Checks shown

Explore the controls

Select a control to open its evidence below.

Findings

Observed controls: 7 · Coverage: Not tested

Finding detail

Browser content policy

MediumIllustrative

Evidence

Fictional example: no enforced content policy was observed.

Technical evidence and code retain their original language.

Vigilra / VCMPCustomer connections, scheduled monitoring and tested fix pull requests are planned. Operator-run repository assessments and scoped staging response tests are available.

Vigilra live check & interactive workspace | VCMP | VCMP