01 · Unified pipeline
Four passes. One verdict.
A broad sweep, a structural check, a map of your app and reachability ranking reconcile into a single deduplicated finding — labelled structural, confirmed pattern, or pattern only.
Depth you can verify.
Every capability in SecureVibe exists to answer one question with evidence: can an attacker actually reach this? Scroll for the full tour.
ScrollMost scanners hand you a list of maybes. SecureVibe reads how your code is built, traces from every public route, ranks what an attacker can actually reach — then helps you fix it.
/ The core engine01 / 05
02 · App map
Your codebase, mapped.
Routes, functions, calls, database access and external APIs are mapped from the code. On top sit the public inputs, the risky calls and the paths between them, with no AI involved.
03 · Exploitability scoring
Proof over patterns.
Every public entry point is traced to the risky calls it reaches. Each finding is labelled confirmed, reachable or unknown with a 0–100 confidence and the reason it fired. Unknown means no path was traced, not that it is safe.
04 · AI fix engine
A patch to review, one click away.
For findings with structural evidence, one click streams a proposed patch that you accept or reject hunk by hunk; nothing is written to your repo. Bring your own provider.
AnthropicGeminiOpenRouterZ.AINVIDIALocal
05 · Ask the graph
Interrogate your code.
The same map that ranks findings answers plain-language questions: ask about the code, explain a function, trace how one function reaches another, or list the attack surface.
path from POST /login to db.query
POST /login → authenticate() → db.query()
2 hops · user input reaches the query unsanitised
2 hops · user input reaches the query unsanitised
/ Built for reviewers
Everything a finding needs to be believed
Four layers of context ship with every scan, so triage takes seconds instead of an afternoon.
/ 01
Code map
Every scan ships an interactive view of what the scanner saw, so you can check its coverage before trusting the report.
- Which files were read, and which could not be
- Interactive app map with pan, zoom and focus
- Graph query explorer for ad-hoc questions about the codebase
/ 02
Attack-surface overlay
Public inputs, risky calls and the exploit paths between them, drawn on the app map so risk reads at a glance.
- Inputs: request bodies, params, headers, env
- Risky calls: query builders, exec, file system, template engines
- Exploit paths starting from public routes
/ 03
Evidence per finding
No bare alerts. Each finding carries everything a reviewer needs to accept or dismiss it in seconds.
- Code frames with the exact matched range highlighted
- Source → sink chain, CWE / OWASP tags, confidence reason
- Git blame attribution per finding (opt-in)
/ 04
Risk grading
The whole scan rolls up into one grade you can put in a PR gate — strict mode counts exploitable findings only.
- A–F letter grade over a 0–200 weighted risk score
- Weighted by severity and strength of evidence
- Strict mode for CI: grade on proven-reachable findings
/ Measured, not marketed
Scored on real CVEs
OpenSSF CVE Benchmark: 221 real JavaScript/TypeScript CVEs. A hit is an alert within three lines of the weakness on the vulnerable commit; an alert there after the patch counts as a false positive.
F1 · every alert counted77.3
F1 · 23 disputed cases set aside81.7
F1 · likely/confirmed only67.9
The 23 set-aside cases are ones where the upstream patch leaves the bug in or the label points at the wrong line; they only remove false positives. Harness in benchmark/ossf.
221
real CVEs scored
240
detection rules
101
CWEs covered
<30s
typical scan
/ The index
Jump straight in
001Unified scan pipelineSweep · confirm · map · rank002Coverage across 18 risk classesOWASP Top 10, secrets, cloud misconfig, CI/CD, known CVEs003Ask-the-graph queriesquery · explain · path · attack-surface, in plain language004A–F risk grading0–200 risk score with a strict, exploitable-only CI mode005One-click AI fixesStreamed patches you review, from the provider you choose
Point it at your repo.
Free, no account, no database. A grade in seconds.