How it watches

Three steps. Your app stays in front.

Vigil is not a proxy and not a firewall. Traffic still arrives at the server you already operate. The SDK describes that request after you have answered it.

Install the middleware

You

Add @vigil/sdk to the Express or Fastify app you already run. Put the API key in VIGIL_API_KEY.

Vigil

The hook runs after your response is sent. Your route still answers even if Vigil is unreachable.

Send redacted metadata

You

Nothing new is asked of the visitor. The same request your app handled is described to Vigil.

Vigil

Passwords, cookies, card-like fields, and the Authorization header are stripped before the packet leaves your server. A body is a short sample, not a full dump.

Read the note in plain language

You

Open the workspace. Quiet traffic stays a row in Events. A serious match opens an Alert.

Vigil

The note names the impact: “probe for a hidden config file.” It keeps the method, path, status, and IP. It does not keep the raw probe text, and it does not tell anyone how to repeat it.

What the workspace keeps

Enough to investigate. Not enough to replay the request as an attack.

Method and path
GET /search, POST /login. The path is what your app received.
Status and IP
401 from 102.89.x.x tells you the request failed and where it came from.
Which checks matched
Names and plain-language impacts, such as “Environment file probe.”
A short sample
Capped, with secret-shaped strings already replaced by [redacted].

What never arrives

Stripped in the SDK, then stripped again when the ingest API accepts the packet.

Authorization and cookies
Bearer tokens and session cookies are removed before send.
Passwords and card fields
password, token, cvv, and card-like numbers are replaced.
The raw attack text
The dashboard shows the check name, not a string you could paste back.
A full body
Bodies are not stored whole. The sample stops at a few hundred characters.