{"slug": "show-hn-novul-open-source-mac-app-to-find-and-fix-vulnerabilities-on-your-mac", "title": "Show HN: NoVul – Open-source Mac app to Find and fix vulnerabilities on your Mac", "summary": "Developer Misbah Sy released NoVul, an open-source menu bar app for Apple Silicon Macs running macOS 13 or later that scans project lockfiles, Homebrew formulae, global packages, language runtimes and AI coding tools against OSV.dev, GitHub advisories and endoflife.date vulnerability data. NoVul re-checks every 30 minutes and on lockfile changes, ranks findings by malicious packages, CISA KEV actively exploited flaws and EPSS scores, flags exposed API keys via gitleaks without displaying them, and ships a CLI and MCP server so Claude Code or Codex can read and repair the problems in one prompt.", "body_md": "NoVul is a menu bar app for your Mac. It finds the security problems in the software on your Mac and tells you how to repair them.\n\n- **Your projects.** Checks each package in your lockfiles against public vulnerability data.\n- **This Mac.** Checks Homebrew packages, language runtimes, global packages and AI coding tools.\n- **Exposed secrets.** Finds API keys in plain-text files.\n- **Fix plan.** Shows what to fix first, with the command that fixes it.\n- **Always current.** Checks again every 30 minutes and when a lockfile changes. Notifies you only\nabout important problems.\n- **Private.** Your code, files and keys stay on your Mac. Refer to[Privacy](#privacy) .\n\n| **Fix with agent.** Send all the problems to Claude Code or Codex in one prompt. | **This Mac.** The problems in your runtimes, Homebrew packages, global packages and AI tools. | \n| **Exposed secrets.** The location of each key and how to make it safe. NoVul does not show the key. | **First start.** Select the folders that contain your code. | \n\n<sub>The screenshots show the demo data of NoVul.</sub>\n\n| Area | Details | \n|---|---|\n| Project packages | Lockfiles of npm, pnpm, Yarn, Bun, uv, Poetry, Pipenv, PDM, `requirements*.txt` , Composer, Go, Cargo, Bundler, Dart/Flutter and Mix. If a Python project has a`.venv` and no lockfile, NoVul reads the installed versions from the venv. | \n| Homebrew | Installed formulae, with `brew vulns` . | \n| Global packages | npm, pnpm and Bun globals, pipx and uv tools, `cargo install` packages, Go binaries and Ruby gems. | \n| Runtimes | Node, Python, PHP, Go, Ruby and Java, including versions past end of life. | \n| AI and developer tools | Claude Code, Codex, OpenCode, pi, Ollama and Bun, and the runtimes bundled in them. | \n| Exposed secrets | API keys and tokens in project folders and common configuration files, found with [gitleaks](https://github.com/gitleaks/gitleaks) . NoVul shows where a key is and how to move it, never the key. | \n\nVulnerability data comes from [OSV.dev](https://osv.dev), the GitHub advisories and\n[endoflife.date](https://endoflife.date).\n\n1. **Malicious** packages.\n2. Vulnerabilities that attackers **actively exploit** , from the[CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) list.\n3. All other vulnerabilities, from the highest severity to the lowest. If two have the same\nseverity, the one with the higher [EPSS](https://www.first.org/epss) score is first.\n\nA key for a service with a recent public data breach gets a higher priority.\n\nYou must have a Mac with Apple Silicon and macOS 13 or later.\n\n1. [Download NoVul](https://github.com/misbahsy/novul/releases/latest/download/NoVul-arm64.dmg) .\nFor a different version, refer to[Releases](https://github.com/misbahsy/novul/releases) .\n2. Open the DMG file.\n3. Drag NoVul to the Applications folder.\n4. Open NoVul.\n5. Select the folders that contain your code. NoVul shows the code folders that it found.\n\nNoVul starts the first scan. The package results show in approximately 1 to 2 minutes. Then NoVul does the check for exposed secrets.\n\nNoVul shows only in the menu bar. It does not show in the Dock. When NoVul does not scan, it uses approximately 20 MB of memory. Each scan runs in a separate process with a low priority. The process stops when the scan is complete.\n\nNoVul has a CLI and an MCP server. Claude Code, Codex or a different agent can use them to:\n\n- Read the problems in its repository.\n- Repair the problems.\n- Tell NoVul to do the scan again.\n\nNoVul does not use AI and does not use API keys.\n\nThe fastest method is the **Fix with agent** button above the chart. This button copies a prompt for\nClaude Code or Codex, or opens the prompt in Terminal. The prompt tells the agent to:\n\n1. Read the problems from NoVul.\n2. Repair the problems in each project.\n3. Run your tests.\n4. Tell NoVul to do the scan again.\n\nTo send only the problems of one project, select that project in the chart first.\n\nTo connect an agent to NoVul for all sessions, run this command:\n\n```\nclaude mcp add novul -- /Applications/NoVul.app/Contents/MacOS/novul mcp\n```\n\nTo show the problems of the project in your terminal folder, run this command:\n\n```\n/Applications/NoVul.app/Contents/MacOS/novul findings --project \"$PWD\"\n```\n\nTo do a full scan from the terminal, run `novul scan --all`. This command does the same scan as\n**Scan Now** in the menu bar: first the projects, then this Mac, then the secrets.\n\nFor Codex, OpenCode, the Claude Code skill and an AGENTS.md example, refer to\n[agent/setup.md](https://github.com/misbahsy/novul/blob/main/agent/setup.md).\n\nNoVul does not use an account. It does not send telemetry. It does not have a server.\n\nNoVul downloads most of its data as full lists. These downloads do not send data from your Mac. The lists are:\n\n- The CISA list of exploited vulnerabilities.\n- The FIRST EPSS scores for all CVEs.\n- The end-of-life dates for all the runtimes that NoVul knows.\n- The GitHub advisories for all the AI tools that NoVul knows.\n- The Have I Been Pwned list of data breaches.\n\nTo find the vulnerabilities in your packages, NoVul has two modes:\n\n| Mode | How NoVul checks your packages | Result | \n|---|---|---|\n| **Standard** (default) | Online. NoVul looks up package names and versions in the [OSV.dev](https://osv.dev) database. This includes your Homebrew packages and AI tools. For`requirements.txt` projects, NoVul also uses[deps.dev](https://deps.dev) to find the versions. | NoVul shows a new advisory in 30 minutes or less. | \n| **Private mode** (in Settings) | On your Mac. NoVul downloads the OSV databases for your languages (approximately 250 MB, one time each day) and checks your packages against them. No data about your projects leaves your Mac. | NoVul shows a new advisory in one day or less. NoVul does not check Homebrew packages, because `brew vulns` must be online. | \n\nNoVul does not send your source code, the contents of your files, your file paths or your secrets.\nNoVul keeps the results in a SQLite database on your Mac, in\n`~/Library/Application Support/dev.novul.app/`.\n\n```\nbun install\nscripts/fetch-sidecars.sh\nbun run tauri dev\n```\n\n- `fetch-sidecars.sh` downloads the correct versions of osv-scanner and gitleaks. It compares each\nfile with`sidecars/SHA256SUMS` .\n- `bun run tauri build` builds the app and the DMG file.\n- `scripts/release.sh` builds, signs and notarizes the app and the DMG file. You must have an Apple\nDeveloper ID.\n- To run the tests, go to `src-tauri` and run`cargo test --lib` .\n\nThe license of NoVul is the [Apache License 2.0](https://github.com/misbahsy/novul/blob/main/LICENSE). NoVul contains osv-scanner (Apache 2.0)\nand gitleaks (MIT). NoVul uses data from OSV.dev, CISA, FIRST, Have I Been Pwned (CC BY 4.0) and\nendoflife.date. For more data, refer to [NOTICE](https://github.com/misbahsy/novul/blob/main/NOTICE) and\n[THIRD_PARTY_LICENSES.md](https://github.com/misbahsy/novul/blob/main/THIRD_PARTY_LICENSES.md).", "url": "https://wpnews.pro/news/show-hn-novul-open-source-mac-app-to-find-and-fix-vulnerabilities-on-your-mac", "canonical_source": "https://github.com/misbahsy/novul", "published_at": "2026-10-28 07:32:53+00:00", "updated_at": "2026-10-28 08:13:13.637837+00:00", "lang": "en", "topics": ["ai-tools", "ai-agents", "agent-protocols", "developer-tools"], "entities": ["NoVul", "Misbah Sy", "OSV.dev", "CISA KEV", "gitleaks", "Claude Code", "Codex", "Homebrew"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/show-hn-novul-open-source-mac-app-to-find-and-fix-vulnerabilities-on-your-mac", "markdown": "https://wpnews.pro/news/show-hn-novul-open-source-mac-app-to-find-and-fix-vulnerabilities-on-your-mac.md", "text": "https://wpnews.pro/news/show-hn-novul-open-source-mac-app-to-find-and-fix-vulnerabilities-on-your-mac.txt", "jsonld": "https://wpnews.pro/news/show-hn-novul-open-source-mac-app-to-find-and-fix-vulnerabilities-on-your-mac.jsonld"}}