BOXWARDEN
Security monitoring for your VPS
Know what's open before someone else does
Why
Most VPS breaches are boring
SSH with a password
Bots try root passwords around the clock. One weak password and the server is theirs.
A database on the internet
Docker publishes ports past ufw. Postgres or Redis ends up open to everyone, and nobody notices.
Packages nobody updated
Known exploits for old versions are public. Attackers scan for them, not for you.
A miner nobody sees
The break-in is quiet. A new user, a cron job, a process from /tmp — and a bill for CPU.
What it checks
Four checks, every 15 minutes
SSH
Root and password logins, weak settings — with the exact fix, and a reminder to add your key first.
Exposed
Every listening port: which process or container owns it, what it is, and whether the internet can reach it.
Vulnerable
Installed packages, on the host and in containers, matched to known CVEs. Actively exploited ones first.
Compromise
New users, SSH keys, cron jobs, services and SUID files since your baseline; processes running from /tmp.
How it works
One line, then it watches
Sign in
With GitHub or email. Add a server and copy the one-line install.
Paste it as root
The installer checks the agent's checksum, connects the server and sets up a systemd timer.
The agent checks
Every 15 minutes, vulnerabilities daily. It only reads the system and sends findings out.
You get an alert
Critical and high findings go to Telegram at once; the rest in a daily digest, with the fix.
In Telegram
What an alert looks like
Trust
An agent you can read
Read-only
The agent never changes your system. Every fix is a command you run yourself.
No open ports
It only connects out. Boxwarden cannot send it commands.
Findings only
No files, logs or secrets leave the server — just what was found and where.
Open source
The agent is AGPL. Read every line, or run it without an account.
Signed releases
Built by GitHub Actions from a tag, with signed provenance. The installer checks SHA-256.
No auto-update
Nothing new runs as root on your server until you decide to update.
Questions
Frequently asked
Does the agent change anything on my server?
No. It reads configuration, packages, processes and sockets, and runs under systemd with a read-only filesystem. Fixes are commands you copy and run yourself.
What leaves my server?
Findings and the list of listening ports: titles, severities, package names and versions. Never file contents, logs, keys or passwords.
What can it check?
Ubuntu and Debian servers, and Debian, Ubuntu and Alpine containers running on them.
Can I use it without an account?
Yes. Download the agent from GitHub and run boxwarden scan. The account adds the schedule, history and alerts.
What if Boxwarden itself is breached?
The agent accepts no commands and opens no ports, so an attacker could read your findings but could not reach your servers through it.
How much does it cost?
Nothing while in beta. Paid plans for more servers will come later, and we will tell you before anything changes.
Free during beta