Development preview Rust security assessment

Evidence before verdicts.

Run bounded web assessments. Understand the evidence. Compare what changed. Termivar produces readable HTML and JSON reports and compares their observations offline without treating disappearance as verified remediation.

Get started View example report Explore architecture
  • Exact-origin authority
  • Bounded request budgets
  • One composed web runtime
Termivar
authorityexplicit
executiondeterministic
claimsevidence-scoped

Why Termivar

A deliberately narrow trust model

Observation, execution, and conclusion remain separate so a successful action cannot silently become a vulnerability verdict.

01

Explicit boundaries

Exact-origin authority, shared budgets, cancellation, and deadlines constrain every supported web assessment.

02

Typed evidence

Observations, hypotheses, verification outcomes, and report items retain distinct identities and authority.

03

Claim-safe reports

Informational, NeedsReview, and Confirmed are not interchangeable. Incomplete execution stays visibly incomplete.

Current preview

Useful surfaces, constrained execution

Capabilities are opt-in where documented. Structural knowledge does not automatically grant network or finding authority.

Bounded web review

One WebAssessmentRuntime composes evidence, reasoning, shared transport accounting, and the final report.

Runtime contract

API surface intelligence

GraphQL, OpenAPI, bounded REST read-only, and selected-resource authorization reviews preserve their own strict limits.

API evidence model

Reports and comparison

Readable assessment reports and offline comparison keep disappearance distinct from verified remediation.

Reporting contract

Local artifact review

An explicit local-file path supports bounded signature review without turning artifact input into web authority.

Artifact boundary

Operator flow

Start with authority. End with evidence.

  1. 01
    Choose a reviewed build

    Use the checksum-verified published archive or build a pinned source commit.

  2. 02
    Declare the exact scope

    Select the authorized origin and only the profile or capabilities you intend to run.

  3. 03
    Run within shared limits

    The runtime accounts for requests, bytes, deadlines, and verification work.

  4. 04
    Read the claim basis

    Interpret each item with its disposition, completeness, and evidence boundary intact.

Start locally

Run the documented, credential-free walkthrough

The repository-owned fixture stays on numeric loopback and demonstrates CLI wiring and report reading—not detection accuracy.

Open the walkthrough Read a real example 
$ termivar scan <AUTHORIZED_ORIGIN> \
  --profile web-review \
  --report-format html \
  --report-output assessment.html