VulnCheck Local: an open-source security auditor that never leaves your machine

A security audit with no cloud

A developer has released VulnCheck Local, an open-source security auditor for Windows 10/11 and Ubuntu/Debian Linux that is designed to run entirely on the machine being checked. According to the project's introduction post on dev.to, the tool was built as a deliberate counter to mainstream scanners, which typically upload system data to vendor servers before producing a score.

The project is MIT-licensed and hosted on GitHub under the rtostudioco organisation. Its stated audience is home labs, small businesses and offline or air-gapped machines that need answers to basic posture questions, such as whether the firewall is on or SSH is hardened, without signing up for cloud accounts or deploying agents that phone home.

What it checks

On launch, VulnCheck Local detects the platform and selects its collectors accordingly: read-only PowerShell collectors on Windows and Bash collectors on Linux, with the same scorecard produced on both. The current rule set contains 27 versioned checks with identifiers in the style of VC-FW-001 and VC-AC-003, grouped along CIS Benchmark lines into categories covering firewall configuration, account security, endpoint protection, services, network exposure, updates and backups.

Every check resolves to one of six explicit states: PASS, FAIL, WARNING, NOT_APPLICABLE, NOT_ASSESSED or ERROR. The developer stresses that a check which could not run is never reported as secure; instead it lowers the run's assessment coverage, and only evidence that was actually verified counts toward the final score.

Scoring, reports and the one network feature

Scoring runs on a fixed 0–100 scale with set deductions by severity: 25 points for a critical finding, 15 for high, 7 for medium and 3 for low. Those scores map to letter grades of A at 90 or above, B at 80, C at 65 and D at 50. Each run is persisted to a local SQLite database with full history, and results can be exported as branded PDF, JSON or CSV reports. The interface supports English and Spanish.

Exactly one feature can reach the network: optional AI-generated explanations for findings. Per the dev.to post, it is fully opt-in, gated behind explicit consent and switched off by default. Everything else in the tool stays on the machine.

Engineering choices

Two implementation details stand out. First, the collectors never build shell commands from user input; they execute only IDs drawn from a fixed allowlist of 24 PowerShell and 8 Bash collectors, which closes off the command-injection route that plagues tools that shell out dynamically. Second, the engine is strictly read-only: it gathers evidence but never modifies configuration, disables services or touches credentials. Remediation guidance is display-only, structured as the problem, its impact, the suggested fix and how to verify it.

Under the hood the tool is built with Next.js 16 on the App Router, TypeScript in strict mode, Tailwind CSS 4 with shadcn/ui components, Prisma over SQLite, and jsPDF for report generation. The engine runs a four-stage pipeline of collection, auditing, scoring and reporting, with rules stored as versioned data so historical scores remain comparable as the rule set evolves. The entire application state lives in a single SQLite file that can be backed up or deleted, and setup is a short clone, install, environment-copy and database-migrate sequence before running audits from localhost.

The published roadmap lists additional rules, dry-run remediation and scheduled audits as the next steps, with issues and pull requests welcomed.

Why it matters

Most endpoint security scanners assume connectivity and a vendor relationship: accounts, telemetry and agents that report back. Home labs, small businesses and air-gapped machines often cannot or will not meet those terms, which is exactly the gap this tool targets. Its insistence on a distinct NOT_ASSESSED state also addresses a genuine failure mode in scoring tools, where a check that never ran quietly counts as a pass and manufactures false confidence about security. The scope remains modest — the CIS Benchmark documents the tool draws inspiration from span hundreds of pages, while 27 automated rules cover only a slice of that ground — but as an MIT-licensed, inspectable, fully local starting point, VulnCheck Local gives users a defensible baseline score on machines that never touch the internet.