filevet

Self-hosted, open-source scanner that checks the files finance teams receive for security risks before anyone opens or ingests them.

Why

Fintechs and finance teams take in files from outside every day: invoices, bank statements, KYC documents, payment files. Any of them can carry malware, exploit the parser that reads it, or hide instructions meant for an AI system further down the line. Commercial scanners are closed and expensive, and the open-source ones don't understand financial formats like ISO 20022. filevet runs several independent analyzers over a file and returns one report you can act on.

Status

Quickstart

pipx install filevet
# or
uv tool install filevet

filevet scan statement.pdf

With Docker, without network access and with the file mounted read-only:

docker run --rm --network none --read-only --tmpfs /tmp -v "$PWD:/in:ro" ghcr.io/pablodt00/filevet scan /in/statement.pdf

To add ClamAV signature scanning, use the Compose file, which runs clamd as a sidecar and shares its socket with filevet:

docker compose --profile clamav up -d clamav
docker compose run --rm filevet scan /in/statement.pdf

filevet alone needs about 200 MB of RAM. With ClamAV, plan for 1 to 2 GB more for its signature database.

The same Compose file runs the REST API with an async worker, Redis and ClamAV. docs/api.md covers the setup:

export FILEVET_SPOOL_KEY=... FILEVET_API_KEYS=...
docker compose up -d

Example

filevet scan invoice.pdf

Trimmed output from a file named invoice.pdf that's really a Windows executable (the format may still change):

{
  "filevet_version": "0.1.1",
  "artifacts": [
    {
      "id": "1bf01f46-66b9-4b57-a40c-031d8d71615f",
      "name": "invoice.pdf",
      "sha256": "9f2c…e41a",
      "declared_type": "pdf",
      "detected_type": "pe",
      "depth": 0
    }
  ],
  "findings": [
    {
      "rule_id": "basic.type_mismatch",
      "title": "File content does not match its extension",
      "severity": "critical",
      "confidence": 1.0,
      "evidence": "invoice.pdf",
      "references": ["https://cwe.mitre.org/data/definitions/434.html"],
      "analyzer": "basic.type_mismatch/0.1.0"
    }
  ],
  "decision": {
    "policy": "default",
    "verdict": "block",
    "rule": 0,
    "rule_ids": ["basic.executable", "basic.type_mismatch"],
    "reason": "rule 0 of policy default sets block for basic.executable, basic.type_mismatch"
  },
  "summary": { "critical": 1, "high": 1, "medium": 0, "low": 0, "info": 0 },
  "verdict": "block"
}

The full report format is in docs/schema/report.schema.json, and filevet schema prints it too. filevet scan takes several files at once. --format picks the output:

The verdict comes from a policy: default, strict (bank-grade intake), ai-ingestion (files an LLM will read) or your own YAML file, chosen with --policy. filevet policy test shows how verdicts change under a policy, and --suppressions silences a rule for a known file until a set date. Both are described in docs/policies.md.

Other commands:

• filevet extract --visible-only file.pdf prints only the text a person would see, as a safe extraction step before an AI pipeline.
• filevet serve and filevet worker run the REST API and its async workers (docs/api.md).
• filevet analyzers lists the registered analyzers, and filevet version prints the version.

Python

from filevet import Policy, ascan, extract_text, scan

report = scan("invoice.pdf", policy=Policy.load("strict"))
print(report.verdict, report.decision.reason)

report = await ascan(upload_bytes, name="invoice.pdf")
text = extract_text("invoice.pdf", visible_only=True)

examples/ has a FastAPI upload endpoint, an S3 event handler that moves files to a quarantine bucket, and a RAG ingestion script.

CI and pre-commit

The repository is a GitHub Action that scans the documents a pull request adds or changes and uploads SARIF to code scanning:

- uses: actions/checkout@v4
  with:
    fetch-depth: 0
- uses: pablodt00/filevet@v0  # pin to a release tag or commit
  with:
    policy: strict

The job needs security-events: write. For pre-commit:

- repo: https://github.com/pablodt00/filevet
  rev: v0.4.0
  hooks:
    - id: filevet

Integrity findings are signals for review, not proof of fraud. docs/integrity.md explains each technique and its limits. IBANs in the evidence are masked (ES91 **** **** **** **** 1332) unless you pass --no-mask. docs/privacy.md lists what a report can contain.

Exit codes

CI jobs can act on the exit code of filevet scan without parsing the report.

With several files, the exit code is the one for the strictest verdict. --fail-on <severity|verdict> replaces these codes with 1 when any file reaches that severity or verdict and 0 otherwise, which is often simpler in CI.

What it checks

Each rule has a page in docs/rules/ that explains what it means, why it matters for finance files, how to fix the file and when it can be a false positive.

Configuration

The REST API has its own settings, listed in docs/api.md.

filevet scan --context context.yaml adds what you already know: the IBANs on record for your suppliers, the PDF producers your banks use, and the certificates you trust for signatures. The format is in docs/integrity.md. The context file is never logged or copied into the report.

The synthetic test corpus in tests/corpus/cases/ has one case per threat and per legitimate look-alike. uv run pytest tests/corpus prints a detection matrix showing which rules fire on which case.

Limitations

• filevet never declares a file safe. It reports what it checked and what it found, and no scanner catches everything.
• PDFs are scanned as raw objects. Content hidden behind encryption, or behind filters other than Flate, isn't decoded.
• 7z, RAR and gzip archives are detected but not extracted, so their contents aren't scanned.
• VBA is found by its source text. P-code-only projects (VBA stomping) can get past it.
• No ISO 20022 XSDs ship with filevet yet, so schema validation only runs once you supply them.
• The rules are tested against a synthetic corpus, not real-world malware.
• It doesn't replace antivirus or EDR, email security, or human review of high-value payments.
• Integrity checks only see traces of editing. A document forged from scratch, or flattened into a new PDF, looks clean to them. Scanned images aren't read.
• PDF signatures are checked offline, against the trust roots you supply, without revocation data.
• Hidden-content checks assume a white page and estimate glyph positions, so text hidden by a dark vector shape, or made unreadable in a way the rules don't model, gets through. The prompt injection patterns are heuristics in English and Spanish only.
• It doesn't analyze network traffic, attribute malware to families, or store scanned files.

The full scope is in docs/SCOPE.md.

Roadmap

Work is split into phases, each tracked as a milestone: foundations, MVP, integrity checks, platform features (the REST API, policy engine and AI-ingestion checks), and hardening for v1.0.

Contributing

Start with CONTRIBUTING.md. Everyone taking part is expected to follow the Code of Conduct.

Security

Report vulnerabilities privately, as described in SECURITY.md. Please don't open public issues for them.

License

Apache License 2.0. See also NOTICE.