Scan
nothing running live
Watching for intruders
Bugs & security scan
What should Vift Studio AI look at?
What to scan
Signs in with your SSH key or agent — never a password — and installs nothing on the server.
How it works
- Bugs & security copies the folder here, scans the copy, then deletes it.
- Monitoring keeps one SSH connection open and checks every 5 seconds for new ports and connections, new or rewritten files (web shells), cron and systemd entries, and keys added to
authorized_keys. - The access log, if you give one, is read line by line as the server writes it.
- It sees only what the account you sign in as can read.
Visitors reach your application through this port, and every attack on the way is reported — or refused, with Block attacks on.
How it works
- Attacks show here and go to your alert channels. Blocked ones get a
403. - While blocking, an address is held off for 15 minutes if it keeps attacking (5 in a minute), floods (over 60 requests a second) or keeps guessing passwords (10 wrong on one page). Restart the guard to lift it.
- If everyone together sends more than 1,000 requests a second, visitors who were already on the site carry on and new ones are asked to come back in a few seconds.
- Behind nginx on this computer, the real visitor is read from
X-Forwarded-For. Connect Cloudflare, or any other provider through a webhook, in Settings → Cloud blocking, and banned addresses are blocked there too. - Closing the window does not stop it. It runs from the Vift Studio AI icon beside the clock, and keeps the computer awake, until you stop it.
- On a server, run
vift shield --to=…instead.
What for
Reads your code and reports what an attacker could use — injection,
leaked credentials, weak crypto.
How often
Monitoring is always live.
Reads each change the instant it is written, until you stop it — even with the window closed.