Vigilo

Vigilo is a fast, zero-configuration static security scanner for Python. It detects exploitable vulnerability patterns (CWEs) in first-party code using AST traversal combined with local data-flow analysis to minimize false positives.

Runs across Linux, macOS, and Windows — either via pip or as a standalone binary with no Python installation required.

Why Vigilo?

• High-Signal over High-Noise: Traditional linters (like Bandit) flag safe string constants and standard library calls indiscriminately. Vigilo uses local data-flow analysis to distinguish harmless constants from untrusted dynamic inputs.
• Zero Configuration: Drop it directly into your workflow or CI pipeline with vigilo scan . or vigilo .. No YAML rule authoring or database setup required.
• Zero Runtime Dependencies: Built strictly on Python's standard library. Lightweight and instantaneous.
• First-Party Code Focus: While tools like pip-audit scan third-party dependencies for CVEs, Vigilo scans your code for logic and injection flaws.

Installation & Quickstart

Option A: Install via PyPI (Python 3.10+)

pip install vigilo

Option B: Standalone Executable (No Python Required)

Pre-built standalone single-file executables are available for Linux, macOS, and Windows on the Releases Page:

• Linux (x86_64): vigilo-linux-x86_64
• macOS: vigilo-macos
• Windows (x86_64): vigilo-windows-x86_64.exe

Verifying Checksums

Every release includes a SHA256SUMS.txt file to verify binary integrity:

# Verify checksum on Linux/macOS
sha256sum -c SHA256SUMS.txt

Note on Antivirus Alerts: Standalone executables are bundled with PyInstaller. Some heuristic antivirus engines or Windows SmartScreen may occasionally flag newly published PyInstaller binaries as unfamiliar. This is a known false positive with packed binaries. You can verify the integrity using the SHA256 checksum or install via pip install vigilo to run from source.

Usage

Scan the current directory:

vigilo scan .

Or use the shortcut alias:

vigilo .

Generate structured JSON output for CI/CD pipelines:

vigilo scan . --format json

Filter by minimum severity:

vigilo scan . --min-severity high

Include code correctness diagnostics (syntax errors, undefined names, unclosed resources):

vigilo scan . --correctness
# or run the dedicated diagnose subcommand:
vigilo diagnose .

Exclude specific directories or glob patterns:

vigilo scan . --exclude "tests/*" --exclude "migrations/*"

Python API

from vigilo import scan

# Security scan (default)
findings = scan("src/")

# Security + Correctness scan
all_findings = scan("src/", include_correctness=True)

for finding in findings:
    print(
        f"[{finding.severity.upper()}] {finding.detector.id} {finding.detector.name} ({finding.detector.category})"
    )
    print(f"  Location: {finding.location}")
    print(f"  Fix: {finding.fix_hint}")

Supported Detectors

Security Vulnerabilities (Default)

Code Correctness Diagnostics (Opt-In with --correctness or diagnose)

CLI Reference

usage: vigilo [-h] [--version] {scan,diagnose} ... [target] [--format {text,json}]
              [--min-severity {low,medium,high}] [--exclude EXCLUDE] [--correctness]
              [--no-color]

Commands:
  scan                  Scan target directory or file for security vulnerabilities
  diagnose              Run code correctness diagnostics (syntax, undefined names, resources)

Options:
  target                Directory or file to scan (default: '.')
  --format, -f          Output report format: 'text' or 'json' (default: 'text')
  --min-severity, -s    Minimum severity threshold: 'low', 'medium', 'high' (default: 'low')
  --correctness, -c     Include code correctness diagnostics alongside security checks
  --exclude, -e         Exclude path matching glob pattern (repeatable)
  --no-color            Disable ANSI terminal coloring
  --version, -V         Show version and exit
  --help, -h            Show help and exit

Exit Codes

Contributing

We welcome contributions! Please review our Contributing Guide, Code of Conduct, and Security Policy.

License

Distributed under the MIT License. Copyright (c) 2026 Sanjiv - Vigilo.