VICE overview

Find security issues earlier

VICE audits web applications and source repositories, then turns what it observes into findings you can verify and fix. Use it before a release, on a live domain, or continuously in a pull request.

Each result keeps the evidence, recommendation, severity, confidence, rule identifier, and coverage context together. The score summarizes the result, but the finding explains the work.

Choose a surface

• VICE Platform keeps domains, managed audits, history, reports, schedules, and alerts in one workspace.
• VICE CLI audits a local repository or a live URL directly from your terminal, without a Platform account.
• VICE GitHub Action runs the repository audit in GitHub Actions and can return comments, SARIF, a badge, and a score gate.

Combine them when it helps

The surfaces complement each other. Start with the CLI while developing, add the Action when the policy is ready for CI, and use Platform for the deployed domain and its history.

A Platform integration can ingest a GitHub Action report after the workflow. The Action still audits the repository in GitHub, while managed Platform audits inspect the linked domain separately.

Run the first useful audit

• For a public URL, begin with a light Platform scan.
• For source code, install the CLI and run vice audit . from the repository root.
• For a pull request, add the official Action after reviewing the first local report.