filevet

Self-hosted, open-source scanner that checks the files finance teams receive for security risks before anyone opens or ingests them.

Why

Fintechs and finance teams take in files from outside every day: invoices, bank statements, KYC documents, payment files. Any of them can carry malware, exploit the parser that reads it, or hide instructions meant for an AI system further down the line. Commercial scanners are closed and expensive, and the open-source ones don't understand financial formats like ISO 20022. filevet runs several independent analyzers over a file and returns one report you can act on.

Status

Quickstart

pipx install filevet
# or
uv tool install filevet

filevet scan statement.pdf

With Docker, without network access and with the file mounted read-only:

docker run --rm --network none --read-only --tmpfs /tmp -v "$PWD:/in:ro" ghcr.io/pablodt00/filevet scan /in/statement.pdf

To add ClamAV signature scanning, use the Compose file, which runs clamd as a sidecar and shares its socket with filevet:

docker compose --profile clamav up -d clamav
docker compose run --rm filevet scan /in/statement.pdf

filevet alone needs about 200 MB of RAM. With ClamAV, plan for 1 to 2 GB more for its signature database.

Example

filevet scan invoice.pdf

Trimmed output from a file named invoice.pdf that's really a Windows executable (the format may still change):

{
  "filevet_version": "0.1.1",
  "artifacts": [
    {
      "id": "1bf01f46-66b9-4b57-a40c-031d8d71615f",
      "name": "invoice.pdf",
      "sha256": "9f2c…e41a",
      "declared_type": "pdf",
      "detected_type": "pe",
      "depth": 0
    }
  ],
  "findings": [
    {
      "rule_id": "basic.type_mismatch",
      "title": "File content does not match its extension",
      "severity": "critical",
      "confidence": 1.0,
      "evidence": "invoice.pdf",
      "references": ["https://cwe.mitre.org/data/definitions/434.html"],
      "analyzer": "basic.type_mismatch/0.1.0"
    }
  ],
  "summary": { "critical": 1, "high": 1, "medium": 0, "low": 0, "info": 0 },
  "verdict": "block"
}

--format table prints the same report as a table for people. The full report format is in docs/schema/report.schema.json, and filevet schema prints it too.

Other commands: filevet analyzers lists the registered analyzers, and filevet version prints the version.

Integrity findings are signals for review, not proof of fraud. docs/integrity.md explains each technique and its limits. IBANs in the evidence are masked (ES91 **** **** **** **** 1332) unless you pass --no-mask. docs/privacy.md lists what a report can contain.

Exit codes

CI jobs can act on the exit code of filevet scan without parsing the report.

What it checks

Each rule has a page in docs/rules/ that explains what it means, why it matters for finance files, how to fix the file and when it can be a false positive.

Configuration

filevet scan --context context.yaml adds what you already know: the IBANs on record for your suppliers, the PDF producers your banks use, and the certificates you trust for signatures. The format is in docs/integrity.md. The context file is never logged or copied into the report.

The synthetic test corpus in tests/corpus/cases/ has one case per threat and per legitimate look-alike. uv run pytest tests/corpus prints a detection matrix showing which rules fire on which case.

Limitations

• filevet never declares a file safe. It reports what it checked and what it found, and no scanner catches everything.
• PDFs are scanned as raw objects. Content hidden behind encryption, or behind filters other than Flate, isn't decoded.
• 7z, RAR and gzip archives are detected but not extracted, so their contents aren't scanned.
• VBA is found by its source text. P-code-only projects (VBA stomping) can get past it.
• No ISO 20022 XSDs ship with filevet yet, so schema validation only runs once you supply them.
• The rules are tested against a synthetic corpus, not real-world malware.
• It doesn't replace antivirus or EDR, email security, or human review of high-value payments.
• Integrity checks only see traces of editing. A document forged from scratch, or flattened into a new PDF, looks clean to them. Scanned images aren't read.
• PDF signatures are checked offline, against the trust roots you supply, without revocation data.
• Content aimed at AI pipelines isn't detected yet (planned for v0.3).
• It doesn't analyze network traffic, attribute malware to families, or store scanned files.

The full scope is in docs/SCOPE.md.

Roadmap

Work is split into phases, each tracked as a milestone: foundations, MVP (v0.1), integrity checks (v0.2), platform features such as a REST API and policy engine (v0.3), and hardening for v1.0.

Contributing

Start with CONTRIBUTING.md. Everyone taking part is expected to follow the Code of Conduct.

Security

Report vulnerabilities privately, as described in SECURITY.md. Please don't open public issues for them.

License

Apache License 2.0. See also NOTICE.