Solutions
For developers
Findings in your terminal, with the reason attached.
No dashboard to check and no ticket from another team. The finding appears where you write the code, and it tells you what happened to the last person who shipped this.
rvl — terminal
$ rvl scan
spec cache 2026-08-20.a660ca56 (schema 1, Current)
sites 1 | specs 60 | unparseable lines 0
judgments 18 (from the signed cache)
■ BLOCKING
orderbot/notify.py:6 — secret.stripe_secret_key — hardcoded Stripe live secret key
■ ADVISORY
Dockerfile (stage:0) — dep-manifests dockerfile.base_image_pin — not one of digest, tag
✗ blocked — fix or suppress 1 blocking finding to commit
From install to first scan
Install with Homebrew, run
rvl init, and scan. rvl doctor tells you what your machine is missing for this repo.rvl — quick start
$ brew install --cask revelara-ai/tap/rvl
$ rvl init # write .revelara.yaml, install the agent skills
$ rvl doctor # what is missing on this machine, for this repo
$ rvl scan # scan the current directory
$ rvl hook install # gate `git commit` on the scan
A finding you can act on
Each finding names the site, the reason, and the control.
rvl explain shows the fix. If it does not apply, rvl suppress records a waiver that your team reviews in git.rvl — one finding
■ BLOCKING (base severity elevated by incident evidence)
svc/main.py:4 — requests.get has no timeout or deadline — not at the call, not on a client or session it is built from, and not anywhere up the call chain, and requests applies no default of its own; it can hang indefinitely
$ rvl explain bfyx # the sites, the control, the fix
$ rvl suppress bfyx --reason="…" # waive it in .revelara.yaml
In your agent too
The same findings arrive as slash commands in your coding agent. Scan, ask about a finding, and get remediation guidance, without leaving the session.
In your coding agent
/scanRun a risk scan on your codebase/askUnderstand a finding before you act on it/fixGet remediation guidance for a specific risk/risksSee open risks for the current project
Your code stays on your machine
The Revelara scanner and
rvl CLI run entirely within your own environment. Your source code is analyzed locally and does not leave your infrastructure; only the risk findings you choose to share are transmitted. rvl is open source under Apache 2.0, so you can check.Run your first scan free.
Install the CLI, scan a repo, and read the findings in your terminal. Your source code stays on your machine.