io.github.arthurpanhku/dvalincode

English · 中文 · 🌐 dvalincode.dev

Open security engineering for code written by humans and AI agents.
Discover. Repair. Verify.

Dvalin is the independent security runtime between code generation and merge. Humans, coding agents, and CI call the same versioned contract for discovery, remediation, and verification; Dvalin normalizes scanner evidence, applies a baseline-aware gate, persists the security workflow, and independently verifies a repair before publication. Its built-in coding capability is a remediation executor—not the trust boundary and not an attempt to compete with every general-purpose coding agent.

Dvalin can run independently, compete in overlapping application-security workflows, or interoperate with specialist systems such as Codex Security. Codex Security's portable SARIF export can become local Dvalin remediation cases and pass through the same release gate as every other human or agent. Dvalin differentiates through a no-account deterministic baseline, an open multi-engine scanner fleet, agent-neutral interfaces, local operation, and policy-bound audit evidence. We adopt strong workflow ideas where they improve user outcomes while keeping both products optional. See the security-agent strategy.

⏱️ 30 seconds, no install, no API key

npx dvalincode security scan .
# After installing the package: dvalin scan .

That is the whole thing. It runs the built-in rules for injection, hardcoded secrets, XSS, eval, and unsafe shell use against the current directory and prints what it found. No account, no model, no config, no code leaves your machine. The default policy runs only Dvalin Built-in, so the first scan always works. Add optional engines explicitly, or inspect their fixed install commands:

dvalin scanners list
dvalin scanners install semgrep       # review the command
dvalin scanners install semgrep --yes # execute it under Dvalin policy

For an incremental “no new high-risk findings” gate, commit the policy and baseline with the repository:

dvalin init
dvalin baseline
dvalin scan

This creates dvalin.security.json and .dvalin/baseline.json. Suppressions require a reason and may have an owner and expiry date. Scan output is a versioned envelope with a deterministic gate result and a resumable workflow ID.

Or put it on every pull request — nothing t

... View full README on GitHub