Security that sees
what actually runs.
Runveil maps your real runtime, flags only reachable risk, and generates fixes that fit your stack — so your developers ship fast without drowning in false positives.
Open-source CLI · Node.js first · Early access: founder@runveil.com
The problem
Most scanners drown you in noise.
The large majority of flagged CVEs sit in code paths your app never actually runs. So you either chase ghosts — or learn to ignore the scanner entirely. Runveil shows you only what's reachable.
97% less noise. Same vulnerability data — radically shorter list.
Show, don't pitch
One command. The short list that matters.
How it works
From a wall of CVEs to a ranked short list.
Scan dependencies
Runveil reads your package-lock.json and matches every package against the OSV vulnerability database.
Map reachability
It builds your dependency & call graph to determine which vulnerable code is actually on a path your app can execute.
Confirm with runtime
A lightweight Rust agent reports what executes in the real environment, marking findings reachable = true with live evidence.
Prioritize & fix
Reachable issues rise to the top with evidence and suggested fixes. Dormant noise drops away. Gate CI on what matters.
Capabilities
Built for developers who ship.
Reachability analysis
Static reachability through the dependency and call graph — the incumbents gate this behind enterprise sales. Runveil keeps it open.
Runtime evidence
A Rust agent observes real execution and confirms which vulnerabilities are truly exercised — not just theoretically present.
CI policy gating
--fail-on critical|high|medium|low with non-zero exit codes. Drop the GitHub Action in and block only reachable risk.
Clean reports
JSON for tooling, Markdown for humans. Every report leads with the headline: X reachable of Y total.
Evidence timeline
See where and when a vulnerability was observed at runtime — file, function, environment, and last-seen time.
Open-source first
The free CLI is the product. Scan, reach, gate, and run it locally — forever free. Monetize the team, never the developer.
See what your app actually runs.
Runveil is open-source and Node.js-first. Star the repo, try the CLI, and tell us what it found.
$ go install github.com/mdfaisal1/runveil/cmd/runveil@latest