security
VoxSecureSelf-hosted Security Operations Platform

Security Operations
Redefined.

OWASP codebase scanning meets real-time threat monitoring. One self-hosted dashboard. Zero external dependencies. Complete audit trail. Built for teams that won't compromise on data sovereignty.

rocket_launchDeploy VoxSecure manage_searchExplore Features menu_bookDocumentation
52
OWASP Rules
21
Threat Detectors
A01–A10
Full OWASP Coverage
0 deps
External Dependencies

Platform

Everything you need to
secure your stack

Six integrated modules working together — from codebase analysis to live threat response. All running on your own infrastructure.

OWASP Scanner

Static analysis of PHP, JS, HTML and config files. 52 rules covering every OWASP Top 10 category. Score 0–100 with per-finding remediation guidance.

Stream Monitor

Ingest Apache, Nginx, PHP, and syslog streams in real time. 21 threat detection rules with automatic alert creation and live SSE push to your browser.

Alert Pipeline

Unified alert feed from all sources. Severity tiers, acknowledgement workflow, visual indicators. In-place updates — no page reload required.

Scan History

Every scan persisted with a shareable report URL. File type breakdown, passed check count, OWASP distribution. Delete removes DB records and disk files.

User Management

Three-role RBAC: Admin, Analyst, Viewer. Add users, reset passwords, deactivate accounts, rotate API tokens. Cannot deactivate the last admin.

Audit Trail

Every login, scan, acknowledgement, and config change recorded. Action filter, live search by IP or action. Colour-coded severity. Admin-only access.

OWASP Scanner

52 rules.
Zero blind spots.

Upload a ZIP of your codebase. VoxSecure dissects every PHP, JS, HTML, and config file against the full OWASP Top 10 — then gives you a score, a breakdown, and remediation steps for every finding.

monitoringSample Scan Report

99
Hardcoded credentials found in config.php
key_off
82
Unsanitised user input in SQL query
storage
55
Missing Content-Security-Policy header
http
Security Score34/100

fact_checkOWASP Top 10 Coverage

  • A01 Access Control5 rules
  • A02 Cryptographic7 rules
  • A03 Injection10 rules
  • A04 Insecure Design4 rules
  • A05 Misconfiguration6 rules
  • A06 Outdated Deps4 rules
  • A07 Auth Failures5 rules
  • A08 Data Integrity3 rules
  • A09 Logging Failures4 rules
  • A10 SSRF4 rules

folder_zipScanned File Types

PHPJSHTMLJSONYAMLXML.ENVPEMSQLINI

Stream Monitor

Threats detected
as they happen.

Push events from any log source via a simple HTTP POST. 21 rules score every event 0–100. High and critical matches auto-create alerts and push live to your browser via SSE.

99
Webshell / backdoor keywords
bug_report
98
Remote code execution attempt
code_off
95
Brute force lockout triggered
lock
80
SSRF — internal address requested
hub
78
Sensitive file access (.env, wp-config)
folder_open
55
Slow loris / connection flood
network_check
Sources
5
Apache·Nginx
PHP·Syslog
Rate Limit
100
events/min
per token
Batch Size
50
lines per
request

Security by Default

Hardened from
the ground up.

VoxSecure practices what it scans. Every layer of the stack — auth, transport, data, and sessions — is hardened by default, with no optional flags required.

Argon2ID
Password Hashing
AES-256
GCM Encryption
0 deps
No Composer / npm
7
Security Headers

Authentication

  • Argon2ID password hashing (memory: 64MB)
  • Account lockout after 5 failures
  • Session fingerprinting (IP + UA)
  • SameSite=Strict cookie policy
  • Constant-time CSRF comparison

Transport & Headers

  • HSTS (2 years + preload)
  • Content-Security-Policy strict
  • X-Frame-Options: DENY
  • Permissions-Policy (camera/mic/geo)
  • X-Content-Type-Options: nosniff

Data & Storage

  • PDO prepared statements only
  • MariaDB strict mode enforced
  • Scan files stored outside web root
  • ZIP magic bytes validation
  • Zip bomb protection (10MB/entry)

Management

Full control.
Every action logged.

Three-role RBAC, complete audit trail, user management, and settings — all with server-side enforcement. No action goes unrecorded.

Admin

Administrator

Full platform access. Manages users, views audit log, accesses all data across all users.

  • User management
  • All scans and reports
  • Audit log access
  • All stream sources
  • System settings
Analyst

Analyst

Can run scans, manage their own stream sources, and acknowledge alerts. Standard operational role.

  • Submit and view own scans
  • Acknowledge alerts
  • Manage own stream sources
  • Change own password
  • No user management
Viewer

Viewer

Read-only access to dashboard, reports, and alerts. Suitable for stakeholders and observers.

  • Dashboard & stats
  • Read scan reports
  • View alerts
  • No scans or sources
  • No acknowledgements

Installation

Up in
5 minutes.

Shared hosting compatible. No SSH required. A built-in wizard walks you through database setup, directory configuration, and the initial admin account.

  1. Create Database

    Create a MariaDB database in cPanel or phpMyAdmin. Note the host, name, username, and password.

  2. Upload Files

    Extract the VoxSecure ZIP to your domain root via FTP or cPanel File Manager.

  3. Run Installer

    Visit /install.php — the wizard handles DB migration, config writing, and directory setup.

  4. Delete Installer

    Remove install.php immediately. Then log in to your new dashboard.

Requirements

PHP 8.1+MariaDB 10.4+Apache / NginxcPanel ReadyNo Build StepNo Composer
stream ingest · bash
# Push a single log line
curl -X POST https://yourdomain.com/api/stream_push.php \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"payload": "log line here"}'

# Tail nginx access log live
tail -f /var/log/nginx/access.log \
  | xargs -I{} curl -s -X POST \
    https://yourdomain.com/api/stream_push.php \
    -H "Authorization: Bearer TOKEN" \
    -d "{\"payload\": \"{}\"}"

VoxSecure

Own your security.
Own your data.

Self-hosted. No telemetry. No subscriptions. No cloud dependencies. Your infrastructure, your rules.

rocket_launchDeploy VoxSecure menu_bookRead the Docs support_agentGet Support