Show HN: NoVul – Open-source Mac app to Find and fix vulnerabilities on your Mac

Developer Misbah Sy released NoVul, an open-source menu bar app for Apple Silicon Macs running macOS 13 or later that scans project lockfiles, Homebrew formulae, global packages, language runtimes and AI coding tools against OSV.dev, GitHub advisories and endoflife.date vulnerability data. NoVul re-checks every 30 minutes and on lockfile changes, ranks findings by malicious packages, CISA KEV actively exploited flaws and EPSS scores, flags exposed API keys via gitleaks without displaying them, and ships a CLI and MCP server so Claude Code or Codex can read and repair the problems in one prompt.

NoVul is a menu bar app for your Mac. It finds the security problems in the software on your Mac and tells you how to repair them. - Your projects. Checks each package in your lockfiles against public vulnerability data. - This Mac. Checks Homebrew packages, language runtimes, global packages and AI coding tools. - Exposed secrets. Finds API keys in plain-text files. - Fix plan. Shows what to fix first, with the command that fixes it. - Always current. Checks again every 30 minutes and when a lockfile changes. Notifies you only about important problems. - Private. Your code, files and keys stay on your Mac. Refer to Privacy privacy . | Fix with agent. Send all the problems to Claude Code or Codex in one prompt. | This Mac. The problems in your runtimes, Homebrew packages, global packages and AI tools. | | Exposed secrets. The location of each key and how to make it safe. NoVul does not show the key. | First start. Select the folders that contain your code. | <sub The screenshots show the demo data of NoVul.</sub | Area | Details | |---|---| | Project packages | Lockfiles of npm, pnpm, Yarn, Bun, uv, Poetry, Pipenv, PDM, requirements .txt , Composer, Go, Cargo, Bundler, Dart/Flutter and Mix. If a Python project has a .venv and no lockfile, NoVul reads the installed versions from the venv. | | Homebrew | Installed formulae, with brew vulns . | | Global packages | npm, pnpm and Bun globals, pipx and uv tools, cargo install packages, Go binaries and Ruby gems. | | Runtimes | Node, Python, PHP, Go, Ruby and Java, including versions past end of life. | | AI and developer tools | Claude Code, Codex, OpenCode, pi, Ollama and Bun, and the runtimes bundled in them. | | Exposed secrets | API keys and tokens in project folders and common configuration files, found with gitleaks https://github.com/gitleaks/gitleaks . NoVul shows where a key is and how to move it, never the key. | Vulnerability data comes from OSV.dev https://osv.dev , the GitHub advisories and endoflife.date https://endoflife.date . 1. Malicious packages. 2. Vulnerabilities that attackers actively exploit , from the CISA KEV https://www.cisa.gov/known-exploited-vulnerabilities-catalog list. 3. All other vulnerabilities, from the highest severity to the lowest. If two have the same severity, the one with the higher EPSS https://www.first.org/epss score is first. A key for a service with a recent public data breach gets a higher priority. You must have a Mac with Apple Silicon and macOS 13 or later. 1. Download NoVul https://github.com/misbahsy/novul/releases/latest/download/NoVul-arm64.dmg . For a different version, refer to Releases https://github.com/misbahsy/novul/releases . 2. Open the DMG file. 3. Drag NoVul to the Applications folder. 4. Open NoVul. 5. Select the folders that contain your code. NoVul shows the code folders that it found. NoVul starts the first scan. The package results show in approximately 1 to 2 minutes. Then NoVul does the check for exposed secrets. NoVul shows only in the menu bar. It does not show in the Dock. When NoVul does not scan, it uses approximately 20 MB of memory. Each scan runs in a separate process with a low priority. The process stops when the scan is complete. NoVul has a CLI and an MCP server. Claude Code, Codex or a different agent can use them to: - Read the problems in its repository. - Repair the problems. - Tell NoVul to do the scan again. NoVul does not use AI and does not use API keys. The fastest method is the Fix with agent button above the chart. This button copies a prompt for Claude Code or Codex, or opens the prompt in Terminal. The prompt tells the agent to: 1. Read the problems from NoVul. 2. Repair the problems in each project. 3. Run your tests. 4. Tell NoVul to do the scan again. To send only the problems of one project, select that project in the chart first. To connect an agent to NoVul for all sessions, run this command: claude mcp add novul -- /Applications/NoVul.app/Contents/MacOS/novul mcp To show the problems of the project in your terminal folder, run this command: /Applications/NoVul.app/Contents/MacOS/novul findings --project "$PWD" To do a full scan from the terminal, run novul scan --all . This command does the same scan as Scan Now in the menu bar: first the projects, then this Mac, then the secrets. For Codex, OpenCode, the Claude Code skill and an AGENTS.md example, refer to agent/setup.md https://github.com/misbahsy/novul/blob/main/agent/setup.md . NoVul does not use an account. It does not send telemetry. It does not have a server. NoVul downloads most of its data as full lists. These downloads do not send data from your Mac. The lists are: - The CISA list of exploited vulnerabilities. - The FIRST EPSS scores for all CVEs. - The end-of-life dates for all the runtimes that NoVul knows. - The GitHub advisories for all the AI tools that NoVul knows. - The Have I Been Pwned list of data breaches. To find the vulnerabilities in your packages, NoVul has two modes: | Mode | How NoVul checks your packages | Result | |---|---|---| | Standard default | Online. NoVul looks up package names and versions in the OSV.dev https://osv.dev database. This includes your Homebrew packages and AI tools. For requirements.txt projects, NoVul also uses deps.dev https://deps.dev to find the versions. | NoVul shows a new advisory in 30 minutes or less. | | Private mode in Settings | On your Mac. NoVul downloads the OSV databases for your languages approximately 250 MB, one time each day and checks your packages against them. No data about your projects leaves your Mac. | NoVul shows a new advisory in one day or less. NoVul does not check Homebrew packages, because brew vulns must be online. | NoVul does not send your source code, the contents of your files, your file paths or your secrets. NoVul keeps the results in a SQLite database on your Mac, in ~/Library/Application Support/dev.novul.app/ . bun install scripts/fetch-sidecars.sh bun run tauri dev - fetch-sidecars.sh downloads the correct versions of osv-scanner and gitleaks. It compares each file with sidecars/SHA256SUMS . - bun run tauri build builds the app and the DMG file. - scripts/release.sh builds, signs and notarizes the app and the DMG file. You must have an Apple Developer ID. - To run the tests, go to src-tauri and run cargo test --lib . The license of NoVul is the Apache License 2.0 https://github.com/misbahsy/novul/blob/main/LICENSE . NoVul contains osv-scanner Apache 2.0 and gitleaks MIT . NoVul uses data from OSV.dev, CISA, FIRST, Have I Been Pwned CC BY 4.0 and endoflife.date. For more data, refer to NOTICE https://github.com/misbahsy/novul/blob/main/NOTICE and THIRD PARTY LICENSES.md https://github.com/misbahsy/novul/blob/main/THIRD PARTY LICENSES.md .