Scan
LiveFunctional local scan for JavaScript and TypeScript projects with local HTML and JSON reports.
Verglos · public alpha · local scan
Scan the code your agent helped write.
Verglos 2.0.0-alpha.1 scans JavaScript and TypeScript projects on the developer's machine and writes local HTML and JSON reports. Hunt, attest, paid plans, agent integrations, and hosted verification are not available in this release.
~ / verglos
$ npx verglos@2.0.0-alpha.1 scan
Local. No account. No repo upload.
Availability boundary
One command works.
Two shells do not.
Hunt
Unavailable shellThe command name exists in 2.0.0-alpha.1, but it does not run sandbox verification or produce a verified verdict.
Attest
Unavailable shellThe command name exists in 2.0.0-alpha.1, but it does not sign a bundle or publish a verification URL.
Review workflow
What the
current alpha
actually does.
A useful run records the tool version, repository commit, scan scope, local output, and a human decision about each candidate.
01
Authorized project
JavaScript or TypeScript
02
Pinned command
Local alpha scan
03
Human review
Context and limits
04
Local output
HTML and JSON reports
Capability status
Local scanAvailable
HTML and JSON reportsAvailable
Sandbox verificationUnavailable
Signed or hosted evidenceUnavailable
Alpha boundary
Current release
Scan only
ALPHA
ScanReviewRetain
The scan campaign · ICP-top-300 · TypeScript + JavaScript
300
Repositories in the selected public campaign corpus
57.7%
Produced at least one high-or-critical scanner candidate
v1.5.2
Scanner version recorded by the campaign methodology
Alpha
Findings were observations, not verified vulnerabilities
This was a selected corpus scanned with Verglos v1.5.2. The result describes scanner output for that corpus; it is not an estimate of software prevalence or a count of verified vulnerabilities. Read the full campaign.
The problem
Why AI code
fails differently.
AI coding tools can produce plausible software quickly. Plausible is not the same as reviewed: generated handlers can omit ownership checks, input boundaries, or deployment-safe defaults while still compiling and passing a happy-path test.
Those shapes are not proof of AI authorship and are not always vulnerabilities. They are review prompts: trace user input, verify authorization, inspect package identity, and confirm whether a risky-looking path is reachable in production.
Verglos currently contributes one artifact to that review: a local scanner report. It does not certify the code, prove exploitability, or replace a security assessment.
Three boundaries
What can be evaluated today.
Inspectable scanner
The public package and source repository expose the current local scan path and report artifacts for review.
Local-first
The supported scan path analyzes the project on the developer's machine without requiring a repository upload.
Bounded claims
The product page separates working scan behavior from proposed verification, signing, agent, CI, and commercial surfaces.
Market context
Agentic AppSec got crowded in 2026.
ZeroPath, Corgea, Snyk Agent Fix, Cycode Maestro, XBOW, Semgrep AI Assistant, Pixee, and Ghost Security all point at the same buyer shift: security tools are moving from alerts toward agents that triage and repair code.
Verglos does not claim parity with those platforms. Its current public surface is smaller: local JavaScript and TypeScript scanning with reviewable reports. Broader verification and evidence concepts remain proposals.
The AI-specific catalogue
Six patterns AI code
keeps writing.
Pattern 01
Wildcard CORS on authenticated surfaces
A permissive origin policy can survive into a credentialed path. Review the actual route, credentials mode, and deployment boundary before assigning impact.
Pattern 02
Math.random for tokens and IDs
Convenient random sources sometimes appear in token-shaped code. Confirm whether unpredictability is part of the security model and whether the value reaches production.
Pattern 03
Auth without authz
Authentication can be present while object ownership or role checks are absent. Review every identifier that crosses a user or tenant boundary.
Pattern 04
Slopsquat and hallucinated packages
A plausible package name can be wrong or maliciously claimed later. Verify package identity, ownership, provenance, and the exact version before installation.
Pattern 05
Verbose error handlers that leak stack traces
Debug-friendly error output can expose paths, queries, or upstream details. Separate operator diagnostics from responses returned to clients.
Pattern 06
Mass assignment on ORM writes
Passing an entire request body into a data write can expose fields the caller should not control. Allowlist writable fields and enforce authorization at the operation.
The public repository is the source of truth for the current rule catalogue and supported behavior. Read the pattern breakdown.
The workflow
From
scan to
review.
The current output supports review. It is not signed, independently verified, or hosted by Verglos.
01
Pin
Use a pinned alpha version when the result must be reproducible. The current public package is
2.0.0-alpha.1.02
Scan
Run
npx verglos@2.0.0-alpha.1 scaninside an authorized JavaScript or TypeScript project.03
Review
Read each candidate in its code context. Scanner severity is a review priority, not proof of reachability or exploitability.
04
Retain
Keep the local HTML and JSON reports with the version, commit, scope, and reviewer decision.
Real scanner surface
Ten security
domains, made
inspectable.
Injection, authentication, authorization, cryptography, misconfiguration, supply chain, API, data exposure, runtime, and monitoring are presented as review domains in the current scanner surface.
The scan report keeps the domain list visible so the coverage claim is verifiable, not marketing.
How Verglos differs
Not another
generic scanner.
Verglos is an early local scanner, not a replacement for mature application-security platforms. Compare supported languages, detector coverage, deployment model, policy, and workflow needs.
Snyk
A broader commercial developer-security platform. Evaluate it on supported ecosystems, dependency analysis, policy, and organization workflows.
GitHub Advanced Security
Security capabilities integrated into GitHub repositories and organization workflows. Its deployment model differs from a small local CLI.
Semgrep
A mature rule-based static-analysis platform with broad language and workflow support. Verglos does not claim equivalent coverage.
Socket
A supply-chain security product focused on package behavior and dependency risk. That scope overlaps only part of Verglos scanning.
Gitleaks / TruffleHog
Focused secret-detection tools. They should be evaluated directly when secret discovery and verification are the primary job.
The full comparison, with sourced references: Verglos vs Snyk, GitHub, Semgrep, Socket, Gitleaks.
Shipped · Planned
Honest
roadmap.
What runs in the public alpha today, and which ideas remain explicitly unshipped. Planned items have no launch commitment.
Shipped
- Public npm package at 2.0.0-alpha.1
- Functional local scan command for JavaScript and TypeScript projects
- Local HTML and JSON report output
- Public source repository and campaign methodology
- Hunt and attest names present only as unavailable command shells
Planned
- Proposed local sandbox verification; no launch date
- Proposed signed summary and hosted verification; no launch date
- Proposed coding-agent and CI integrations; not supported today
- Proposed paid plan boundaries; no plans or prices are available
What Verglos is not
Claims we
will not
make.
- Not an autonomous pentester. Verglos does not choose external targets or run open-ended offensive campaigns.
- Not a cloud SAST. Verglos does not upload source to run an LLM triage pass.
- Not a compliance platform. A scanner report does not replace an audit, penetration test, threat model, or secure development lifecycle.
- Not a signed-evidence product today. Hunt, attest, hosted verification, and paid plans remain unavailable.
Verglos notes
The evidence
trail.
ResearchWhat our 300-repository TS/JS scan did and did not showRead note →PatternsEight patterns AI-assisted code keeps producingRead note →ProposalThe proposed local sandbox verification model behind Verglos huntRead note →ProposalSigned evidence artifacts are the proposed Studio wedgeRead note →ComparisonVerglos vs Snyk, GitHub, Semgrep, Socket, GitleaksRead note →
Run the
public alpha.
Pin the version, scan an authorized project, and review the report in context. No paid plan or hosted evidence service is available today.