Local-first security analysis for entire codebases.
Important
Secure Engine is experimental pre-1.0 software. Findings require human validation, and a clean report is not proof that a codebase is secure.
Secure Engine is the local Rust analysis core of the Secure project family. Release candidate 0.1.7 is based on the completed Phase 6.11 development line. It adds bounded local convergence independent of call depth, same-resource authorization, final dynamic sequence-expression callee resolution, composed filesystem path identity and confinement, constructed-redirect exact-origin reasoning, and outbound property/destructuring connectivity. The tool-neutral taxonomy 1.0.0, Evidence Contract v2, secure-json-v1, SARIF 2.1.0, rule IDs, CLI/desktop parity, baselines/history/suppressions, and disabled-by-default AI remain compatible; the private parse cache is v10.
Version 0.1.7 has not yet received an independent holdout evaluation and makes no benchmark, superiority, production-readiness, or complete-coverage claim. Computed dispatch and properties, reflection, ambiguous calls/imports, unresolved callbacks, and unproven runtime filesystem state remain conservative limits.
Start with GOAL.md, then read the full PLAN.md. Phase 6.11 and the 0.1.7 candidate are summarized in docs/phase611-tranche3-root-cause-remediation.md and docs/release-notes-v0.1.7-rc1.md. The stable public projection remains documented in docs/evidence-contract-v2.md. Fedora operations are documented in docs/fedora-packaging.md; the published 0.1.6 verification remains frozen in docs/verification-fedora-phase610.md.
Secure
|- secure-skill Agent workflow and review guidance
|- secure-engine Rust analyzer, CLI, and native desktop UI
`- secure-bench Independent, evidence-aware benchmark harness
The skill and engine are complementary but independent. Secure Engine must remain useful without an AI model, and Secure Skill must remain installable without the desktop application.
They integrate through a versioned CLI and JSON report contract. Secure Skill may invoke an installed Secure Engine and reason over its structured evidence, but it must keep a functional skill-only fallback when the binary is unavailable.
cargo run -p secure-cli -- scan . --format secure-json-v1 --output report.json
cargo run -p secure-cli -- scan . --include 'src/**' --exclude 'src/generated/**' --max-files 50000
cargo run -p secure-cli -- scan . --cache-dir /tmp/secure-engine-cache --clear-cache
cargo run -p secure-cli -- scan . --format sarif --output report.sarif
cargo run -p secure-cli -- rules list
cargo run -p secure-cli -- explain fd_FINDING_ID --report report.json
cargo run -p secure-cli -- baseline create report.json --output baseline.json
cargo run -p secure-cli -- baseline compare baseline.json report.json
cargo run -p secure-cli -- history list
cargo run -p secure-cli -- ai providers
cargo run -p secure-cli -- ai preview fd_FINDING_ID --report report.json --provider recorded --config secure-ai.json
cargo run -p secure-cli -- ai validate fd_FINDING_ID --report report.json --provider recorded --config secure-ai.json --consent CONSENT_FINGERPRINT
cargo run -p secure-cli -- ai cache clear
cargo run -p secure-cli -- doctor --format secure-json-v1
cargo run -p secure-cli -- schema print secure-json-v1
cargo run -p secure-desktop -- .AI validation never originates, deletes, or rewrites a finding. It requires an enabled project configuration, an exact redacted payload preview, and per-operation consent. Provider credentials are read only from the named environment variable and are never serialized. See docs/ai-validation.md.
Licensed under the MIT License. Contributions use the Developer Certificate of Origin; see CONTRIBUTING.md. Report security concerns through SECURITY.md.