Low Severity
Published: Oct 25, 2026
Local-first security monitor: tracks CVEs across your repos and what actually runs in production
<p align="center">
<picture>
<source media="(prefers-color-scheme: dark)" srcset="docs/assets/logo-dark.png">
<img src="docs/assets/logo-light.png" alt="Security Monitor logo: two raven heads facing outward around an eye" width="220">
</picture>
</p>
<h1 align="center">Security Monitor</h1>
<p align="center"><strong>You fixed it in the repo. Is production still vulnerable?</strong></p>
<p align="center">
<a href="https://github.com/umitaltinozzz/security-monitor/actions/workflows/ci.yml"><img alt="CI" src="https://github.com/umitaltinozzz/security-monitor/actions/workflows/ci.yml/badge.svg"></a>
<a href="LICENSE"><img alt="License: Apache-2.0" src="https://img.shields.io/badge/license-Apache--2.0-blue"></a>
<img alt="Platforms: Windows, macOS, Linux" src="https://img.shields.io/badge/platforms-Windows%20%7C%20macOS%20%7C%20Linux-lightgrey">
<a href="https://umitaltinozzz.github.io/security-monitor/"><img alt="Documentation" src="https://img.shields.io/badge/docs-site-informational"></a>
</p>
<p align="center"><a href="README.tr.md">Türkçe</a></p>
<p align="center">
<img src="docs/assets/demo.gif" alt="Demo: adding a project and running a local quick scan, pairing a production server after verifying its host key, linking it to the project, and seeing the finding fixed in the repository but still affected in production" width="900">
<br><sub>Demo recorded from the desktop UI with sample data (lodash 4.17.20, GHSA-35jh-r3h4-6jhm); no real scan or server.</sub>
</p>
Security Monitor (`secmon`) is an open-source, local-first security monitor for your projects and your Linux servers. It matches your dependencies against vulnerability advisories on your own machine, then checks what is actually running in production, so a fix that never got deployed does not look finished.
No account. No cloud dashboard. Source code, lockfiles, and inventory stay on your device unless you approve a specific transfer.
> **Pre-release: 0.1.0.** The product is