Skip to content

Releases: ekbm/verilay

Release list

Verilay 1.1: site setup checks with fixes, stronger dependency checks, security headers

Verilay 1.1: site setup checks with fixes, stronger dependency checks, security headers Latest
Latest

Choose a tag to compare

View all tags
@ekbm ekbm released this 23 Oct 15:59
v1.1.0
6d2a9c6

What changed since 1.0.0. The full list, in plain English, is in CHANGELOG.md and at https://verilay.dev/changelog.

New

  • Site setup, for live-address scans. After a free scan of a live address, Verilay now says what is worth fixing about how the site is set up, and how: plain http not sent on to https, the certificate's remaining days, unprotected sign-in cookies, headers that announce the server software, SPF and DMARC email records for your own domain, and a missing security.txt. Each item comes with plain steps for the host the site seems to run on and a prompt you can paste into your AI builder. It only reads what any browser is sent plus public DNS records, never looks for hidden files, and stays a checklist, not a grade.
  • Security headers on every Verilay page, and a /.well-known/security.txt.
  • A security policy (SECURITY.md) saying how to report a problem.

Improved: the dependency check

  • When the vulnerability database does not answer, a report now says the check could not be completed. It no longer reads as "no known vulnerabilities".
  • Every known problem is described, not just the first few, and each version of a package is checked.
  • More package lists are read: yarn.lock, pnpm-lock.yaml, poetry.lock, uv.lock, Pipfile.lock and Bun's text bun.lock. Bun's older binary bun.lockb cannot be read, and a report says so and what to do.

Live at https://verilay.dev. Free, no account needed.

Assets 2
Loading

Verilay 1.0: free scans, deep scans, and a private-repository beta

Verilay 1.0: free scans, deep scans, and a private-repository beta

Choose a tag to compare

View all tags
@ekbm ekbm released this 22 Oct 15:14
v1.0.0
9727ed3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Verilay reads an app built with an AI tool and explains, in plain English, what it is made of and where it may be unsafe. It is made for people who build with AI but are not developers.

Live at https://verilay.dev. Free, no account needed.

What is in this release

Free scan

  • Paste a public GitHub link, upload a ZIP of your project, or enter a live address.
  • A layer map of your app (sign-in, database, API, front end, libraries), in plain English.
  • Findings written for non-developers, each with short, safe steps to check it yourself.
  • Checks that do not depend on an AI's opinion: secrets left in code, libraries with known vulnerabilities, and access rules.
  • Honest labels: "no issues seen", "Nothing found", "Check required". A live address is shown as a preview and is never graded, because a scan from outside cannot see the backend.

Deep scan (A$19, one repository)

  • A fuller review of the code, with fix prompts and re-scans for 30 days.

Private repositories (free beta)

  • Connect one private GitHub repository with read-only access. Verilay reads its code once and then removes its own access. The report is private to your browser and is removed after 30 days. Daily limits apply.

Also

  • A free security checklist for apps built with AI: https://verilay.dev/checklist
  • A directory of checked apps built with AI tools: https://verilay.dev/apps
  • "What we keep": a ZIP is read during the scan and is not saved. A report keeps the findings, the score and file names, never your project's files. A free report's link works for 90 days and can be deleted. Full detail: https://verilay.dev/privacy

Every change, in plain English: https://verilay.dev/changelog

Licence

Free for personal, educational and open source use. A commercial licence is needed to build Verilay into a commercial product. See LICENSE.md, or write to moses@verilay.dev.

Loading