VirQaraUnder development

Detection licensing / access approval for code changes

See the risk.
Decide what's next.

EdgeXene is developing two product lines under VirQara: one for the licensing evidence behind your YARA and Sigma rules, and one that keeps code changes within the boundaries your team approves.

AI moves fast. Control can't fall behind.

Detection Licensing AuditorAI Badge

See what the evidence says

Four use scenarios drawn from recorded evidenceEvidence recorded at the repository, file and rule level feeds four separate scenarios: internal use, hosted or managed service, redistribution, and modification. Each carries its own outcome.Recorded evidenceRepositoryFileRuleInternal usePermitted subject to conditionsCompliance unverifiedHosted or managedserviceNot permittedRedistributionUnresolvedModificationPermitted subject to conditionsCompliance unverified
Illustrative report layout. These sample outcomes do not assess any rule or license.

Detection Licensing Auditor

The engine reads the YARA and Sigma rules you hold or are acquiring, the license each one declares, and the evidence at the repository, file and rule level. For security leadership, legal teams and M&A diligence.

Four scenarios, evaluated separately

Internal use, hosted or managed service, redistribution and modification each carry their own finding. Permission for one use does not establish permission for another.

A reviewer decides what it establishes

Every finding names the evidence it rests on. Unknown licenses stay unresolved, and missing evidence never reads as a pass. The engine exists. The service around it is not built.

Approve new access deliberately

Illustrative example: a pull request checkThe payments folder is approved to connect to its payment provider and to read one secret. A change adds a connection from the notify helper to collector.example.net, which is not approved, so the check flags it for a designated reviewer.Pull request checkApproved for payments/Website: api.payments.exampleSecret: PAYMENTS_API_KEYcheckout.tscharge()notify()Payment providercollector.example.netNot approved: flagged for review
Illustrative example of AI Badge, which is in development. A change adds a connection the payments folder is not approved for, so the check flags it for review before merge.

In development: AI Badge

AI Badge keeps code changes within the boundaries your team approves. You define what each part of your application may access: the websites and services it may connect to, the secrets and credentials it may read, and the programs and commands it may launch.

It reads the change without running it

AI Badge reads code changes and checks them against those rules. When it detects access outside the approved boundaries, it flags the change and can block merging until a designated reviewer approves it.

It runs in your CI

AI Badge runs in your own continuous integration (CI) environment, the system that checks code before it's accepted. Analysis happens there, without uploading your source code to AI Badge. It works with code written by people or AI assistants. Your team stays in control.

Where this stands

Neither product line is generally available yet. Nothing on this site is for sale today.

The Detection Licensing Auditor engine exists. Its service is not built. AI Badge's analyzer reads JavaScript and TypeScript today and has been run against the commit history of 14 public repositories. The pull request check, merge blocking, the organization dashboard, and the features in the intended plans are in development. Support for Go, Rust, Python, and C# is planned.

If you evaluate detection content, or review code changes written with AI assistants, we would like to hear how you work.

contact@edgexene.io

The Detection Licensing Auditor's report is an engineering analysis of license text and evidence. It is not legal advice and does not substitute for counsel.