Tools
Open-source tools for testing authorization, mapping attack surfaces, and running security workflows locally.
Published
Released under permissive licenses and ready to use.
VardrGate
Define who should be allowed to call an endpoint. VardrGate repeats the request across users and roles, then flags where actual behavior violates the policy—with request and response evidence.
Because the policy is a file, it runs in CI. Authorization gets tested on every commit rather than once a year.
VardrMap
Keep scope, assets, testing hypotheses, evidence, and findings in one workspace so you always know what has—and has not—been tested.
Reconnaissance and enrichment APIs feed the same workspace, so context does not end up spread across a document, an email, and a terminal scrollback.
VardrRunner
Run queued security jobs on your own machine while a remote backend handles orchestration and results. Credentials and scan traffic remain local.
The backend and the runner are fully decoupled and only ever exchange JSON, so orchestration never requires handing over access to the systems being tested.
In Development
Active experiments and design work. These projects are not yet supported for production use.
VardrScanner
An API security testing framework focused on the OWASP API Top 3. Architecture and design notes are public; the implementation is not.
VardrForge
A local CLI that generates small, modular penetration testing tools from controlled templates—with scope validation baked in. Every generated tool is restricted to an explicit target allowlist, so it cannot be pointed somewhere it was never authorized to go.
VardrVault
A secrets manager with token auth, encrypted storage, and audit logging. Built mostly to understand the problem properly—you learn a great deal about a threat model by having to implement against it.
Found a bug? Have a better idea?
Issues and pull requests are welcome on any of the published repositories. If you have found something security-relevant in one of these tools, please report it privately first—the same courtesy I would ask of anyone testing a system of mine.