VULNIGO LITE

VULNIGO Lite turns repository security into a game you can watch, play, or use to check your code. Submit a GitHub repo and a Red Agent investigates it, proposes a weakness with file and line, and runs a bounded validation test inside a sandbox. A Blue Agent explains the root cause and proposes a patch. You approve or reject that patch, and a retest decides what actually happened. Every verdict comes from recorded tests, never from a model's confidence. A retest that could not run is reported as inconclusive, not as fixed, and a repo with no hits is reported as nothing detected by the checks, never as secure. Three ways to play: Spectator, where Red and Blue fight while you approve patches; Participate, where you join Red or Blue across two rounds, Attack then Defense; and Repo Check, a static scan grading findings Confirmed, Potential or Inconclusive. Built containment-first on Vultr: a VM runs the FastAPI controller and evidence store; agents call Vultr Serverless Inference; every test runs in a disposable Docker container with no network and strict limits. AST scanners cover command injection (CWE-78) and path traversal (CWE-22), and the demo repo FileDesk carries two planted bugs. A pixel-art command centre shows it live. Team KAGE LEGION, Challenge 1 — Blast Radius Zero.