vigihq

Vigilance reports the files that gained a power they did not have before, in any part of the SDLC.

A supply chain attack hides one bad change inside a normal release. Everything else in that release is genuine, so a list of changed files tells you nothing. Vigilance does not hunt for known bad code and does not care about CVEs. It reports the change that can now do something the last version could not.

pip install vigihq
vigi ./dist

The command is vigi. One binary, written in Go. It brings no Python dependencies, opens no network connection, holds no credentials, and runs nothing it reads. There is no AI in it.

In CI

vigi ./dist --report vigi-report.html
vigi ./dist --deny network-shell --sarif

--report writes one plain HTML file, black on white, that prints and survives a mail client. --sarif writes SARIF 2.1.0 for a code scanning pipeline. A file holding a denied power raises an alarm and the run exits 5.

Keeping watch

vigi setup
vigi watch /opt/app
vigi status

setup asks two questions, then installs a scheduled check using launchd, systemd, cron or Task Scheduler, whichever the machine has. status says whether those checks are alive and quiet.

On a server

vigi dpkg
vigi rpm

Reads the package manager's own record and asks whether the files on disk match what it says it installed. That record is root-owned, so it is a second witness a payload running as you cannot edit.

Full documentation is at https://vigihq.com/docs

Commercial software. Free tier and Pro at https://vigihq.com Questions go to support@vigihq.com