Most "security scanners" ship your system data to their servers before showing you a score. I wanted the opposite: a tool that never leaves your machine. So I built VulnCheck Local — an open-source (MIT), local-first security auditor for Windows 10/11 and Linux (Ubuntu/Debian).
👉 github.com/rtostudioco/vulncheck-local
The problem
Home labs, small businesses and offline/air-gapped machines have real security posture questions — firewall on? SSH hardened? password policies enforced? — but the tools that answer them usually demand cloud accounts, telemetry, or agents that phone home. And CIS Benchmarks documents, while excellent, are hundreds of pages you have to check by hand.
What it does
Automatic platform detection — Windows gets read-only PowerShell collectors, Linux gets Bash collectors. Same scorecard on both.
27 versioned rules (VC-FW-001, VC-AC-003, …) grouped CIS-style: firewall, account security, endpoint protection, services, network exposure, updates, backup.
Honest scoring 0–100 with fixed weights: CRITICAL −25, HIGH −15, MEDIUM −7, LOW −3. Grades: A ≥ 90, B ≥ 80, C ≥ 65, D ≥ 50.
Every check resolves to an explicit state: PASS, FAIL, WARNING, NOT_APPLICABLE, NOT_ASSESSED or ERROR. A check that couldn't run is never reported as "secure" — it just lowers your assessment coverage.
Reports: branded PDF, JSON, CSV. Every run is persisted in SQLite with full history.
Bilingual UI (English / Español), one click in the header.
Optional AI explanations — fully opt-in, consent-gated, off by default. The only feature that can ever reach the network, and only if you flip the switch.
Design decisions worth stealing
Command allowlist, not string building. Collectors can only execute IDs from a fixed allowlist (24 PowerShell + 8 Bash collectors). User input never reaches a command line — that kills the classic injection vector in "run this command" tools.
Read-only is a hard promise. The engine collects evidence; it never modifies config, never disables services, never touches credentials. Remediation is display-only: problem → impact → fix → verify.
"Unknown" is a first-class state. Most scanners treat "couldn't check" as "pass". That's how false confidence is born. Here, if evidence is missing, you get NOT_ASSESSED and lower coverage — the score only counts what was actually verified.
One SQLite file. No database server. Prisma + SQLite means the whole state of the app is one file you can back up or delete.
Under the hood
Next.js 16 (App Router) + TypeScript strict, Tailwind CSS 4 + shadcn/ui, Prisma + SQLite, jsPDF for reports. The engine is a clean pipeline: collect → audit → score → report, with rules as versioned data (each has an ID and version, so historical scores stay comparable).
Try it (4 commands)
git clone https://github.com/rtostudioco/vulncheck-localcd vulncheck-local && npm installcopy .env.example .env # Windows | cp .env.example .env (Linux)npx prisma db push && npm run dev
Open localhost:3000, hit Run New Audit, get your score.
What's next
More rules, remediation dry-runs, and scheduled audits are on the roadmap. It's MIT licensed — issues and PRs are very welcome. If it's useful to you, a ⭐ on the repo helps a lot!
github.com/rtostudioco/vulncheck-local
Top comments (0)