Coverage

What Vigil notices

131 checks, grouped so a founder can read them. Filter to one group. The product describes the impact. It does not publish a hacking guide.

Requests that look like they are trying to bend a database query, a document filter, or a system command.

You see a title such as “Database union pattern” and a sentence about extra data being pulled out of a query.

Parameters that look like they contain browser script, a frame, or a cookie read.

The alert says a script could run if your app echoed the value back. It does not show a working snippet.

Asks for hidden config, keys, source folders, backups, or common admin tools.

You get the path that was asked for, the address it came from, and why that path usually holds secrets.

Automated tools that announce themselves in the client name.

The alert names the client. Ordinary browsers do not match this group.

Many failures from one address, many usernames, or a burst against a login path.

These use a counter over the last minute, so one wrong password stays quiet.

Characters hidden by double encoding, unicode escapes, or overlong forms.

Vigil unfolds one layer of encoding so a disguised probe still matches, then stores the path, not a tutorial.

Parameters pointing at private networks, link-local addresses, or cloud metadata.

The note says the destination is not a public website. It does not list an address to try.

Huge page sizes, schema introspection, or a role field a caller should not set.

A single odd parameter is recorded. It becomes an alert when the score crosses 50.