FlosForge Guard for macOS
Native macOS vulnerability scanner
A native macOS vulnerability scanner that runs entirely on your machine. Scan sites and repositories, detect outdated tech, and generate targeted reports for your team.
- No subscription
- No telemetry
- Runs locally
Coming soon
- Requires
- macOS 15 or later
- Built with
- SwiftUI and Swift 6
- Distribution
- Mac App Store, sandboxed
- Accounts
- None, and no telemetry
Scan websites, folders and repositories
Add an asset by URL, by local directory, or by git remote. Guard detects the frameworks, libraries and server software it runs, records where each version came from, and re-scans on a schedule you set. It also tracks DNS, hosting, response times and security headers for every asset.
- Website, web app and API assets, each analysed differently
- Technology and version detection, flagging components with no version
- Scheduled re-scanning with automatic advisory database refresh
- macOS notifications when a new advisory affects something you own
Manage responsibilities
Guard sorts findings into four roles — developer, administrator, hoster and library supplier — and lets you attach real contacts to each one per project. Export a report addressed to a single role containing only their work, as PDF, HTML, Markdown, plain text, CSV or a CycloneDX SBOM.
- Four responsibility roles, assigned per finding
- Contacts attached to roles, per project
- Remediation history with mean time to fix, broken down by severity
- Kanban task board where each card keeps its finding’s identifier
Triage by what is actually being exploited
Severity is where triage starts, not where it ends. Guard separates the findings known to be exploited in the wild from the ones that merely score highly, carries an exploit-probability estimate on every advisory, and says plainly when there is no fix information to give rather than leaving the column blank.
- Exploited-in-the-wild findings on their own list, from CISA KEV
- CVSS and EPSS side by side, so a high score with low probability is visible as such
- Filters for severity, exploited status and whether a fix exists
- “What changed” as a diff between two scans, not a fresh wall of findings
Reports targeted to the right role
Who the report is for, which severities it carries and whether closed findings are listed are all settled before it is written. The result goes out as HTML, PDF, Markdown, plain text, CSV, or a CycloneDX SBOM — the developer gets the library work, the hoster gets the server work, and neither has to read the other’s.
- Six output formats, from the same report definition
- Scoped to one role, so nobody is handed work that is not theirs
- Remediation history with mean time to fix, broken down by severity
- Sample reports on this page are real exports with the data replaced
Tweak how risk is calculated
Every factor and every weight in the formula is editable, and the settings pane ranks three example findings underneath so a change to the weights shows its effect before you keep it.
- The formula is printed, not hidden behind a number
- Weights tuned to how you actually triage
- Risk factor history, so you can see what moved a score
- Custom AI prompts you write, run against findings and assets
Every feature, in full
A list of features you can find in the application.
Vulnerability Databases the application queries
FlosForge Guard consults nine published vulnerability sources and matches your asset's technologies against known records.
See it working
Take a look at the user interface of the application.
Opt-in AI that runs on your Mac first
FlosForge Guard answers with models running on your own hardware. A cloud provider is used only if you switch it on and supply your own key.
- First Default
Apple Intelligence
On-device. Nothing leaves your Mac — no key, no account, no cost.
- Then Local
Ollama
Your own local models, on your own machine or a box you control.
- Only if you say so Opt-in
Gemini API
Off until you enable it and enter your own API key. Your key, your account, your billing — never proxied.
Reports you can open right now
Samples of reports FlosForge Guard produces.
- HTML
Full security report
One asset, written up the way Guard writes it: filtered counts, the exploited findings first, and a note saying what the report leaves out.
- MD
The same report, as Markdown
For pasting into a ticket, a wiki or a pull request without reformatting it first.
- TXT
The same report, as plain text
No markup at all — the version that survives an email client and a terminal.
- CSV
Findings as a spreadsheet
Every finding with its severity, CVSS, EPSS, exploited flag and the version that fixes it.
- CSV
Component inventory
What Guard detected on the asset, with the version it found and how sure it is of it.
- CycloneDX
CycloneDX SBOM
The same inventory as a standards-compliant software bill of materials.
What Guard is not
Here is exactly what Guard does not do:
- It reads, but never writes. Guard scans your files and points out vulnerabilities, but it never patches or changes your systems automatically.
- It’s not an antivirus. It checks website files for known malware patterns, but it doesn’t scan or protect the Mac it runs on.
- It’s not a pentesting tool. Guard doesn’t try to hack your site. It only sends standard requests to check for exposed files, and only if you tell it to.
- It’s not a cloud service. It runs entirely locally on your Mac, on your schedule, and only while your Mac is awake.
- It doesn’t catch everything. A clean scan means it didn’t find known vulnerabilities in the components it recognized. It’s good news, but not a guarantee.
- You’re still in charge. Guard gives you the data, but deciding what to patch and what to ignore is entirely up to you.
How every FlosForge app works
-
No telemetry
No analytics, no crash reporting, no usage pings. Not configurable — simply absent.
-
Local storage only
Your data stays on your own device, stored in private application sandboxes under your control.
-
Open exports
Everything exports to standard formats you own (CSV, GPX, JSON, Markdown), with zero lock-in.
Coming soon
FlosForge Guard for macOS is in active testing in real-world scenarios, and will be released in the near future.
- Development (done) Features being built
- Active Testing (current stage) In daily use, tested in real-world scenarios
- Release prep Store listing and final checks
- Released Available to download