I got tired of security scanners that hand you 200 findings and walk away. Semgrep, Trivy, and Gitleaks are great at finding things. The problem is everything after: 47 SQL injection rows that are really one bad helper, CVEs in dependencies you never import, a wall of MEDIUMs nobody will ever read. So I built Virgil. It runs those same scanners in a sandbox, then spends all its effort on the output: — Clusters instead of lists: 12 findings sharing one root cause collapse into one item pointed at the shared helper, not 12 rows. — Reachability first: CVEs in deps your code never imports get demoted and hidden by default (Python, JS/TS, Go, Ruby, Java/Kotlin). — A ranked fix this week queue with a one-line rationale per item. — Chat grounded in your code: every finding stores a redacted 30 line slice, so the auditor can say line 42 is already parameterized two lines up instead of speaking in generalities. Deliberate constraints: it s audit only: a validator rejects payloads, exact patches, and step-by-step exploit content from every LLM output. Secrets are scrubbed before storage or any model call. Your repo s code never executes; scanners run in --network=none --read-only containers. Full security model: virgilhq.app/docs/security The source is Apache-2.0 — the repo is what production actually runs, so audit the auditor. One honest caveat: self-hosting isn t a supported path (accounts and credits are wired to the hosted service). The easy way to try it is hosted: 3 free audits, no card — paste a repo at virgilhq.app, or pipx install virgilhq virgil login virgil scan . It s not just for vibe-coders. I d love to hear where the ranking gets it wrong on your codebase. ps the vps can only handle 2 concurrent users, if you get queued, please bear with me.