Everything a security review should hand you.
CodeAuditAgent reads your code the way a senior application-security auditor would, then gives you a report you can act on in the same afternoon.
Vulnerability detection that cites its evidence
Every finding quotes the exact lines it is about. If the model cannot point at code, it does not get to raise the finding.
- Injection: SQL, NoSQL, command, template and LDAP
- Broken access control, IDOR and missing ownership checks
- Hard-coded secrets, weak crypto and insecure randomness
- SSRF, open redirects, XSS and unsafe deserialization
- Logic flaws, race conditions, memory and resource leaks
- Insecure defaults in configuration and infrastructure code
A report built for the person who has to fix it
Findings are sorted by exploitability, not by how scary the category sounds.
- Severity from critical to info, with a confidence level on each finding
- CWE identifier and file:line location
- A realistic exploit scenario in plain language
- A corrected snippet written against your actual code
- Positive observations and a prioritized list of next steps
- An overall risk score from 0 to 100
Fits the way you already work
No agents to install and no pipeline to rewrite. Sign in, paste a repository URL, read the report.
- Sign in with GitHub; audit any public repository by URL
- Paste a snippet when you only want one function reviewed
- Audits run in the background, so large repositories never time out
- Copy or download any report as structured Markdown
- Export every finding as CSV for your tracker
Track posture over time, not just one scan
Security is a trend. The dashboard shows whether each repository is getting safer.
- Tracked repositories with one-click re-audits
- Risk-score trend per repository
- Audit history filtered by repository, status, severity and period
- Side-by-side comparison with the previous audit
- A findings explorer across every repository, filterable by severity and CWE
- Live usage meter against your plan limits
Languages it reads
The auditor reads source in the languages below, plus shell scripts and configuration such as YAML, TOML and Terraform. The interface itself is available in 16 languages.
- TypeScript
- JavaScript
- Python
- Go
- Rust
- Java
- Kotlin
- PHP
- Ruby
- C#
- C / C++
- Swift
- SQL
- Terraform
Honest limits
- Public repositories only, for now
- Repository audits read the default branch of public GitHub repositories. Private repositories need a GitHub App, which is on the roadmap. You can always paste private code as a snippet.
- Audits are bounded
- Each audit reads up to 20, 40 or 80 source files depending on your plan, skipping files over 60 KB. Partial snapshots are labeled as partial in the report.
- AI output needs a human
- Findings are strong leads, not proof. Review every patch before you merge it; the report tells you how confident it is.
On the roadmap
These are not built yet. We list them so you can plan, not so you can buy them.
- Automatic review comments on pull requests
- Private repository access through a GitHub App
- Fix pull requests opened for you
- Team workspaces with shared repositories
Find the bug before an attacker does.
Sign in with GitHub and run your first audit in under a minute. The free plan needs no credit card.