VICE

What it is

VICE (npm package vice-security), a CLI security auditor from Webba Creative Technologies. This covers the operational details the summary omits: version requirements, install/run commands, the workflow permissions the GitHub Action needs, and the AI/RAG scan config — plus a fix note in v3.4.1.

Preconditions

• Node.js 22.12 or later required.
• Chromium is optional for local audits but needed for full remote-scan coverage. If it falls back to plain HTTP, VICE reports the result as incomplete coverage.
• SARIF upload to Code Scanning on private repos requires GitHub Advanced Security; public repos get it free.
• For the ai-rag module: the audited endpoint must share the scanned origin; auth comes only from env vars (literal secrets in the config file are rejected).

What to do

Install and run:

npm install -g vice-security
vice scan          # remote black-box scan
vice audit .       # local white-box audit
vice audit . --ci  # exit code 0 or 1

GitHub Action workflow needs exactly three permissions — contents: write (commit the badge file), pull-requests: write (post/update PR comments), security-events: write (upload SARIF). Score gating fails the workflow below min-score (default 70). Pin @v3.1.0 for an exact version or @v3 for latest 3.x; the action version always matches the CLI version.

AI/RAG scan — pass tokens via env, reference them by secretEnv in the config:

export VICE_AI_USER_A_TOKEN="token for test user A"
export VICE_AI_USER_B_TOKEN="token for test user B"
vice scan https://app.example.com --ai-rag-config vice.ai-rag.json

Disable SARIF with upload-sarif: false if you only want PR comments.

Upgrade ordering (v3.4.1)

Version 3.4.1 updates the browser dependency to remove a vulnerable archive extractor. The page states an explicit ordering constraint:

flowchart LR
    A[Upgrade Node to 22.12+] --> B[Update VICE to 3.4.1]
    B --> C[Vulnerable archive<br/>extractor removed]
    D[Skip Node upgrade] -.-> E[Update may not run]

Upgrade Node before updating VICE.

Caveats

The ai-rag module runs only when an AI/RAG configuration is provided — a normal scan won't exercise it. Reports omit credentials and captured response content, so findings there may lack the raw evidence you'd want for triage. Deeper RAG and tool checks require optional fixtures.