Self-hosted secret scanning used to mean a trade: a thin CLI tool that matched regexes and dumped a list of "maybe" findings on an engineer's desk. The real capabilities — AI triage, credential verification, dashboards, governance — lived in hosted platforms, because vendors kept them there. That trade is no longer forced. A modern self-hosted platform can ship every feature in one repository, run its AI on models you control, and even operate with no outbound network at all. This guide explains what self-hosted secrets detection should look like in practice, what to look for when choosing one, and how to get Vooda running on your own hardware.
Why teams self-host secrets detection
The reasons differ by organization, but they converge on one thing: control over where code and credentials go.
- Data residency. Source code is intellectual property; embedded secrets are worse. Some teams cannot send either across a border or into a third-party cloud, by regulation or by policy.
- Air-gapped networks. Defense, manufacturing, and critical-infrastructure environments have no outbound connectivity to SaaS platforms — and no exceptions for "it's just for scanning."
- Audit posture. When every outbound call appears in cloud audit logs, hosted verification calls become evidence to explain. Running locally keeps the boundary simple: nothing leaves.
- Cost predictability. Per-seat or per-repo pricing grows with your company. Self-hosting fixes the cost of scanning at the cost of a server.
- No lock-in. A scanner you can't leave is a scanner you can't trust. Source-available means the exit is always open.
What a self-hosted scanner should actually include
Self-hosting the shell of a product while the interesting parts stay cloud-side is the old trick — the "community edition" with the ee/ directory locked away. When you evaluate a self-hosted secrets platform, the questions below separate a real product from a hosted demo that runs on your hardware.
- Is every feature in the repository? Detection engine, AI triage, verification, SSO, compliance reporting, NHI governance — the whole product, not a subset. If a capability requires a license key, it isn't self-hosted; it's rented.
- Can the AI layer run without their cloud? This is the one that catches most "self-hosted" claims. If AI triage calls a vendor's model, your code still leaves the building. Look for bring-your-own-model support — local servers like Ollama or vLLM, or an OpenAI-compatible endpoint you run.
- Can verification be switched off? Credential verification pings provider APIs to confirm a key is live. That's valuable — unless your environment forbids egress. A genuinely self-hostable tool makes it a configuration flag, not a deal-breaker.
- Does it cover more than git? Secrets leak beyond repositories — chat, tickets, wikis, storage, logs. A self-hosted platform should scan those sources with connectors you control.
- Is the license honest about what "free" means? Read it. Some licenses are open-source-but-only-for-non-commercial, others are free-as-in-demo. The license should let you run production workloads at any company size without paying.
Running Vooda self-hosted
Vooda is built for exactly this. Every feature is in the repository — the full scan engine with 900+ rules across 53 detector modules, AI triage with confidence scoring, credential verification, NHI governance, SSO, compliance reporting. There is no ee/ directory and no license key. You need Docker. That's it.
The installer brings up the web UI, API, and CLI. Prefer scanning from the command line? The CLI ships as a container — build it once, alias it, and scan your working tree, full git history, or emit SARIF for CI:
AI triage without sending code anywhere
AI triage is the difference between a queue of findings and a queue of decisions. It reads each hit in context and classifies it as a true or false positive with a confidence score, then learns from your team's triage to suppress the noise patterns you've already seen. The question for self-hosters is where that model runs. Vooda answers with bring your own model:
- Fully local. Ollama, vLLM, LM Studio, LocalAI — or any OpenAI-compatible server you host. Zero API spend, zero egress. Mistral Small 24B is the local model we've evaluated most heavily and where we'd start; it handles triage classification well on consumer hardware.
- Frontier APIs. Claude, OpenAI, or Gemini called natively, pay-as-you-go, configured by environment variable.
- Compatible endpoints. Azure OpenAI, AWS Bedrock, OpenRouter, or your own gateway — whatever your compliance team has already signed off on.
If Vooda runs in Docker and your model runs on the same host, reach it as http://host.docker.internal:11434, not localhost — a small detail that saves an afternoon of debugging.
Going fully air-gapped
For a genuinely isolated deployment, two settings matter. First, point triage at a local model, as above. Second, switch off outbound credential verification:
Verification is a real capability — a revoked key and a live production key are not the same emergency — but in an air-gapped network, no outbound call is the correct default. The scanner still detects; the findings just carry an honest "not validated" label until a human (or a jump box) confirms them.
The license, in plain terms
Vooda is source-available under FSL-1.1-ALv2 — the Functional Source License 1.1 with an Apache 2.0 future grant. We don't call it open source because technically it isn't, and pretending otherwise would be dishonest. What it actually means:
- Use it at work, in production, for free? Yes. Any company, any size, no seat limits, no license key.
- Modify and fork it? Yes — just don't call your fork "Vooda."
- Use it for client consulting or research? Yes.
- Resell it or offer it as a hosted service? No — that's a Competing Use and needs a commercial license.
- Does it become open source? Yes. Every release converts to Apache 2.0 two years after publication, irrevocably.
Self-hosting is a legitimate way to use Vooda forever — free, in production, at a company of any size. What's sold is the operational burden of running it: managed hosting, continuously delivered detection updates, hosted verification at scale, and SLA-backed support.
Frequently asked questions
Can secret scanning run fully self-hosted?
Yes. A self-hosted secrets platform runs detection, AI triage, and verification on infrastructure you control. With Vooda, every feature ships in one repository — there is no crippled community edition — and AI triage can run against a model you host, so no code leaves your network.
Can secrets detection work in an air-gapped environment?
Yes, with two configuration choices. Point AI triage at a locally hosted model such as Ollama or vLLM, and set VERIFICATION_ENABLED=false so the scanner makes no outbound credential checks. Scans still complete; findings are marked as not validated.
What is bring-your-own-model secrets detection?
BYOM means the AI layer that classifies findings runs on a model you choose and host — Ollama, vLLM, LM Studio, LocalAI, or any OpenAI-compatible server — instead of a vendor's cloud model. Frontier APIs and gateways such as Azure OpenAI or AWS Bedrock are also supported.
Is self-hosted secret scanning actually free?
With Vooda, yes. The FSL-1.1-ALv2 license allows use at work, in production, at any company size, for free, forever. Commercial licenses apply only to reselling it or offering it as a hosted service. Every release converts to Apache 2.0 two years after publication.
What do I need to run Vooda self-hosted?
A machine with Docker. Clone the repository, run the install script, and the platform is up: web UI, API, and CLI. For AI triage you can connect a local model such as Mistral Small 24B through Ollama, or a frontier API key.