Local-first security scanner

Find vulnerabilities
before attackers do.

VulnScope scans your Python project for CVEs, leaked secrets, and misconfigurations. Runs entirely on your machine — no cloud, no account, no recurring fees.

Try Free Demo Get $799 lifetime

2 free scans included — no sign-up required

VulnScope Dashboard
GATE FAIL
Total
227
Critical
35
High
70
CVEs
197
CriticalAWS access key in .env
CriticalStripe live secret keyfalse-positive
Highrequests — CVE-GHSA-9wx4
Higheval() in utils/parser.py
MediumCORS_ALLOW_ALL_ORIGINS=Trueconfirmed
Interactive demo

Try VulnScope right now

Enter a GitHub URL, website URL, or select a sample project. See real findings in seconds.

2 free scans remaining
VulnScope Scanner DEMO MODE
GitHub / ZIP
Website URL
Sample Project
What it scans

Everything in one dashboard

VulnScope combines four scanner categories into one unified interface — no switching tools.

Dependency CVEs
Checks every package in requirements.txt against the OSV.dev database — the same CVE source GitHub uses. Gets CVSS scores, affected versions, and fix recommendations.
pipOSV.devCVSS
Static Analysis (SAST)
16 rules covering eval(), shell injection, SQL concatenation, pickle deserialization, hardcoded credentials, debug flags, and more. Direct file + line number references.
16 rulesevalSQL injectionshell=True
Secrets & Config
Detects API keys, tokens, and passwords in .env files, Python configs, and YAML. Secret values are masked in reports — only partial samples are stored, never the full key.
API keys.envtokensmasked
Web Security Headers
Scans any public website for missing or misconfigured HTTP security headers: CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy, and more.
CSPHSTSany domain
Triage Dashboard
Review every finding in a clean UI. Mark as confirmed, false-positive, accepted-risk, or fix-later. Bulk-triage hundreds of findings at once. Filter, search, sort by severity.
bulk triagefilternotes
Export Reports
Export in JSON (machine-readable, round-trip), Markdown (human-readable with fillable fields), or CSV (spreadsheet, one row per finding). Include triage status in every format.
JSONMarkdownCSVCI gate
Why VulnScope

Compare your options

Feature Manual audit SaaS scanner
Snyk, SonarQube		 VulnScope
Price $5,000+ per audit $1,200–$2,400/yr $799 — one time
Code leaves your machine Sometimes Yes — cloud upload Never
CVE scanning Manual Yes Yes
Secret detection Manual Yes Yes
Triage & reports Varies Yes Yes
Works offline Yes No Yes
Windows + macOS + Linux Varies Yes (web) Yes — native
Subscription required No Yes Never
Pricing

One price. Forever.

Lifetime License
VulnScope Dashboard
Everything included. No subscription. No upsell.
$799
One-time
payment
Pay once, use forever. Includes 12 months of free updates.
Unlimited scans on any project
Dep CVEs · SAST · Secrets · Web headers
Full triage dashboard + bulk triage
Export: JSON · Markdown · CSV
CI gate (PASS/FAIL per severity)
Windows · macOS · Linux · Docker
Runs 100% offline — your data stays local
12 months of free updates
Get VulnScope — $799 one-time

Secure checkout via Lemon Squeezy · Instant download after purchase

© 2026 Cikal Studio Labs

FAQ

Common questions

What Python versions does VulnScope support?
VulnScope supports Python 3.9 and above. The scanner itself requires Python 3.9+; the dashboard runs on Node.js 18 LTS or later. Both are available on Windows, macOS, and Linux.
Does VulnScope scan JavaScript or TypeScript projects?
Currently VulnScope is optimized for Python projects (CVE detection via pip packages, SAST rules for Python). JavaScript/TypeScript scanning is on the roadmap. The web header scanner works for any domain regardless of stack.
What happens to my code during a scan?
Your code never leaves your machine. VulnScope runs entirely locally. The only outbound request during a scan is to OSV.dev to fetch CVE metadata for your package names and versions — your actual source code is never transmitted anywhere.
What happens after 12 months?
The license is lifetime — VulnScope continues to work indefinitely. The 12-month update period means you receive new features and scanner rule updates for one year. After that, your existing version keeps working; you just won't get new feature releases automatically.
Can I use it for client projects or bug bounties?
Yes — the license permits use on projects you own or are authorized to test, including client work (with engagement authorization) and bug bounty targets listed in a program's scope. It is not permitted to scan systems you do not have authorization for.
What do I get in the download?
A ZIP archive containing: the VulnScope Dashboard (Next.js standalone build), the VulnScope CLI Python scanner, setup scripts for Windows (PowerShell), macOS/Linux (bash), and Docker, plus INSTALL.md with step-by-step instructions. No internet required after initial setup.