BulwarkSecure your Linux desktop or server

Built for everyone running Linux — and especially for developers and AI users navigating an increasingly AI-driven world. Bulwark checks your machine's real configuration, explains every finding in plain language, and keeps watching after the scan ends.

Read the architecture

View on GitHub

Research

Bulwark's Dashboard showing a scan's findings by severity and category

Native CLI and desktop GUI

One Rust engine (bulwark-core), two thin front-doors. Scan from a terminal over SSH on a headless box, or run the Tauri GUI on your desktop — both share the same rule pack and the same local scan history.

Declarative, extensible rules

57 rules across 11 categories — SSH hardening, persistence, sudoers, kernel/sysctl hardening, file permissions, logging, rootkit indicators — each a plain YAML file with a condition, a plain-language explanation, and a fix. No Rust required to add one.

Explains findings, doesn't just list them

Every finding names the exact file, directive, or process involved, in plain language, with a concrete fix — not a bare rule ID you have to go look up.

Real ClamAV integration, not a reimplementation

Streams live per-file scan progress, reports the installed engine/database version and age, and shows a distro-aware install command when ClamAV isn't present at all.

Continuous, not just on-demand

A background monitoring loop re-scans on a schedule and reconciles findings across runs, so switching tabs or closing the window (to the system tray) never loses in-progress state.

Fully local, no telemetry

No network calls from bulwark-core, ever. Scan history lives in a local SQLite database under ~/.local/share/bulwark — nothing leaves the machine.

Screenshots

Dashboard

Antivirus

Compliance