security

VoxSecure

Self-hosted Security Operations Platform

Security Operations
Redefined.

OWASP codebase scanning meets real-time threat monitoring. One self-hosted dashboard. Zero external dependencies. Complete audit trail. Built for teams that won't compromise on data sovereignty.

rocket_launchDeploy VoxSecure manage_searchExplore Features menu_bookDocumentation

52 OWASP Rules

21 Threat Detectors

A01–A10 Full OWASP Coverage

0 deps External Dependencies

appsPlatform

Everything you need to
secure your stack

Six integrated modules working together — from codebase analysis to live threat response. All running on your own infrastructure.

manage_search

OWASP Scanner

Static analysis of PHP, JS, HTML and config files. 52 rules covering every OWASP Top 10 category. Score 0–100 with per-finding remediation guidance.

stream

Stream Monitor

Ingest Apache, Nginx, PHP, and syslog streams in real time. 21 threat detection rules with automatic alert creation and live SSE push to your browser.

crisis_alert

Alert Pipeline

Unified alert feed from all sources. Severity tiers, acknowledgement workflow, visual indicators. In-place updates — no page reload required.

history

Scan History

Every scan persisted with a shareable report URL. File type breakdown, passed check count, OWASP distribution. Delete removes DB records and disk files.

group

User Management

Three-role RBAC: Admin, Analyst, Viewer. Add users, reset passwords, deactivate accounts, rotate API tokens. Cannot deactivate the last admin.

receipt_long

Audit Trail

Every login, scan, acknowledgement, and config change recorded. Action filter, live search by IP or action. Colour-coded severity. Admin-only access.

manage_searchOWASP Scanner

52 rules.
Zero blind spots.

Upload a ZIP of your codebase. VoxSecure dissects every PHP, JS, HTML, and config file against the full OWASP Top 10 — then gives you a score, a breakdown, and remediation steps for every finding.

monitoring Sample Scan Report

Hardcoded credentials found in config.php

key_off

Unsanitised user input in SQL query

storage

Missing Content-Security-Policy header

http

Security Score 34 /100

fact_check OWASP Top 10 Coverage

A01Access Control5 rules

A02Cryptographic7 rules

A03Injection10 rules

A04Insecure Design4 rules

A05Misconfiguration6 rules

A06Outdated Deps4 rules

A07Auth Failures5 rules

A08Data Integrity3 rules

A09Logging Failures4 rules

A10SSRF4 rules

folder_zip Scanned File Types

PHP JS HTML JSON YAML XML .ENV PEM SQL INI

Sources

5

Apache·Nginx
PHP·Syslog

Rate Limit

100

events/min
per token

Batch Size

50

lines per
request

streamStream Monitor

Threats detected
as they happen.

Push events from any log source via a simple HTTP POST. 21 rules score every event 0–100. High and critical matches auto-create alerts and push live to your browser via SSE.

Webshell / backdoor keywords

bug_report

Remote code execution attempt

code_off

Brute force lockout triggered

lock

SSRF — internal address requested

hub

Sensitive file access (.env, wp-config)

folder_open

Slow loris / connection flood

network_check

verified_userSecurity by Default

Hardened from
the ground up.

VoxSecure practices what it scans. Every layer of the stack — auth, transport, data, and sessions — is hardened by default, with no optional flags required.

Argon2ID Password Hashing

AES-256 GCM Encryption

0 deps No Composer / npm

7 Security Headers

shield

Authentication

Argon2ID password hashing (memory: 64MB)
Account lockout after 5 failures
Session fingerprinting (IP + UA)
SameSite=Strict cookie policy
Constant-time CSRF comparison

http

Transport & Headers

HSTS (2 years + preload)
Content-Security-Policy strict
X-Frame-Options: DENY
Permissions-Policy (camera/mic/geo)
X-Content-Type-Options: nosniff

database

Data & Storage

PDO prepared statements only
MariaDB strict mode enforced
Scan files stored outside web root
ZIP magic bytes validation
Zip bomb protection (10MB/entry)

manage_accountsManagement

Full control.
Every action logged.

Three-role RBAC, complete audit trail, user management, and settings — all with server-side enforcement. No action goes unrecorded.

Admin

Administrator

Full platform access. Manages users, views audit log, accesses all data across all users.

check_circleUser management
check_circleAll scans and reports
check_circleAudit log access
check_circleAll stream sources
check_circleSystem settings

Analyst

Can run scans, manage their own stream sources, and acknowledge alerts. Standard operational role.

check_circleSubmit and view own scans
check_circleAcknowledge alerts
check_circleManage own stream sources
check_circleChange own password
cancelNo user management

Viewer

Read-only access to dashboard, reports, and alerts. Suitable for stakeholders and observers.

check_circleDashboard & stats
check_circleRead scan reports
check_circleView alerts
cancelNo scans or sources
cancelNo acknowledgements

rocket_launchInstallation

Up in
5 minutes.

Shared hosting compatible. No SSH required. A built-in wizard walks you through database setup, directory configuration, and the initial admin account.

Create Database

Create a MariaDB database in cPanel or phpMyAdmin. Note the host, name, username, and password.

Upload Files

Extract the VoxSecure ZIP to your domain root via FTP or cPanel File Manager.

Run Installer

Visit /install.php — the wizard handles DB migration, config writing, and directory setup.

Delete Installer

Remove install.php immediately. Then log in to your new dashboard.

Requirements

PHP 8.1+ MariaDB 10.4+ Apache / Nginx cPanel Ready No Build Step No Composer

stream ingest · bash

										# Push a single log line
									
										curl
										-X POST
										https://yourdomain.com/api/stream_push.php
										\
									
										  -H
										"Authorization: Bearer YOUR_TOKEN"
										\
									
										  -H
										"Content-Type: application/json"
										\
									
										  -d
										'{"payload": "log line here"}'
									
										# Tail nginx access log live
									
										tail
										-f /var/log/nginx/access.log
										\
									
										  | xargs
										-I{}
										curl
										-s -X POST \
									
										    https://yourdomain.com/api/stream_push.php
										\
									
										    -H
										"Authorization: Bearer TOKEN"
										\
									
										    -d
										"{\"payload\": \"{}\"}"

securityVoxSecure

Own your security.
Own your data.

Self-hosted. No telemetry. No subscriptions. No cloud dependencies. Your infrastructure, your rules.

rocket_launchDeploy VoxSecure menu_bookRead the Docs support_agentGet Support

Security OperationsRedefined.

Everything you need tosecure your stack