Security you can read.
- Role
- Product, design and development
- Year
- 2026
- Tools
- Next.js, TypeScript, Supabase, Docker, Opengrep, OSV-Scanner, Trivy, gitleaks
- Type
- Self-initiated
The studio’s own security and quality scanner. Every codebase we ship is checked for vulnerable dependencies, leaked secrets, risky code and configuration, then graded A to F in plain language.
- 01
Challenge
We created Verax Grade to make sure the products we ship are as secure as we can make them, and to be able to prove it. The paid scanners cost more than a small studio should pay, and the free ones raise alarms that aren’t real. We wanted one tool that checks every repository the same way, says exactly how serious each finding is and how to fix it, and gives a grade anyone can read.
- 02
Approach
Run proven engines and our own rules together, in isolated containers with no network access, against a private advisory mirror that refreshes itself, and publish every grading formula. Treat the tool’s own security as its first feature: it holds source code and a map of its weaknesses, so sign-in needs an authenticator, tokens are short-lived and signed, and every answer is checked before it is trusted.
- 03
Solution
Each scan checks for known vulnerable dependencies, secrets leaked into code or its history, insecure patterns across eleven languages, misconfigured settings and build pipelines, and code quality: complexity and duplication. Every finding gets a severity, a fix and a plain-language note, and each area and the project as a whole get a grade from A to F. Connected to GitHub, it scans repositories automatically and emails alerts, and the Walker Interactive client portal is built to read each project’s grade into its Quality page and handover report.
- 04
Outcome
Every Walker Interactive project, this site included, is scanned with it before it ships. Clients get a graded report they can read without a security background, and the grade the studio holds itself to is the one they see.