Code SAST Secure

Find What Is Exploitable. Fix It Before the Commit.

Code SAST Secure scans your code and dependencies, proves which findings are real, and sends the exact fix to your coding agent before the commit. SAST, SCA and SBOM in one product.

Get Started Read the Data Sheet

Works with any coding agent or IDE

MCP server
CLI
AI coding agents

checkout-service Sorted by what is exploitable SAST SCA SBOM

SAST Exploitable Missing auth check

SCA Reachable xml-parse-lite 2.3.1

AI code Exploitable Hardcoded API key

image-utils 4.2.1 never called · VEX: not affected Not reachable

Selected finding Exploitable

Missing auth check SAST · orders.py:42

- order = Order.get(id=oid) 

+ order = Order.get(id=oid, owner=user) 

Fix sent

Re-verified

Closed

“What used to take multiple tools and teams can now be managed from a single platform.”

Gecko Robotics Security Engineering

Read the Case Study 2024 New Product of the Year, Security Today

The Problem

A Fix Problem, Not a Findings Problem.

Legacy static analysis is very good at producing work for someone else to do. Thousands of findings, ranked by severity instead of what is real, each one a warning rather than a patch.

Volume

Thousands of findings land in the queue, ranked by severity rather than by reachability.
Dead Code and False Positives

Static analysis alone cannot separate a real path from a complaint in dead code.
A Warning, Not a Patch

The tool describes the problem. Writing the fix is still the developer's afternoon.

AI Auto-Remediation

Catch It Before the Commit.

Your agents and developers both write code that should never reach the branch. Code SAST Secure inspects it before the commit, pins the issue to the line and applies the fix right there.

Your agent writes the change

In Claude Code, Cursor, GitHub Copilot or VS Code.

Code SAST Secure inspects it

Before anything is committed.

The issue is pinned to the line

Weakness, location and severity.

The fix is sent to your agent

A remediation brief, over the MCP server.

Your agent reads it and makes the fix

No research, so a small model is enough.

Code SAST Secure re-verifies

The rescan must close the finding.

Clean code is committed

The insecure version never reaches the branch.

Your developer writes code

In any IDE, as they always do.

git commit runs the hook

Through the Code SAST Secure CLI.

Code SAST Secure inspects it

Only the change, in seconds.

The issue is pinned to the line

In the terminal and in the editor.

The fix is offered and accepted

From AI Auto-Remediation, one keystroke.

Code SAST Secure re-verifies

The rescan must close the finding.

The commit goes through clean

Nothing to clean up after merge.

1

Your agent writes the change

In Claude Code, Cursor, GitHub Copilot or VS Code.
2

Code SAST Secure inspects it

Before anything is committed.
3

The issue is pinned to the line

Weakness, location and severity.
4

The fix is sent to your agent

A remediation brief, over the MCP server.
5

Your agent reads it and makes the fix

No research, so a small model is enough.
6

Code SAST Secure re-verifies

The rescan must close the finding.
7

Clean code is committed

The insecure version never reaches the branch.

1

Your developer writes code

In any IDE, as they always do.
2

git commit runs the hook

Through the Code SAST Secure CLI.
3

Code SAST Secure inspects it

Only the change, in seconds.
4

The issue is pinned to the line

In the terminal and in the editor.
5

The fix is offered and accepted

From AI Auto-Remediation, one keystroke.
6

Code SAST Secure re-verifies

The rescan must close the finding.
7

The commit goes through clean

Nothing to clean up after merge.

components/Comment.tsx Inspecting

export function Comment({ comment }) {

const ref = useRef(null);

useEffect(() => {

ref.current.innerHTML = comment.bio;

}, [comment]);

return <div ref={ref} />;

}

Code SAST Secure

Cross-site scripting CWE-79

Comment.tsx:4 · Fix: Render the bio as text, not HTML

Agent session Claude Code

Remediation brief

reports/export.py Inspecting

import json

import pickle

def load_report(request):

data = pickle.loads(request.body)

return build_export(data)

Code SAST Secure

Insecure deserialization CWE-502

export.py:5 · Fix: Parse JSON instead of unpickling input

TERMINAL PROBLEMS OUTPUT zsh

~/app $ git commit -m "add report export"

Code SAST Secure pre-commit check

✗ reports/export.py:5 Insecure deserialization (CWE-502)

Fix available from AI Auto-Remediation. Apply? [Y/n]

Re-verifying the change

✓ Fix applied and re-verified: clean

[feature/export 4f2c1a9] add report export

Token Spend

Fewer Tokens. Faster Fixes. Same Agent.

Code SAST Secure hands your agent the exact fix, so it skips the research and spends its tokens on the change.

Runs on the agents and models you already approved
No added model spend from Data Theorem
A smaller model can apply the fix

See how AI Auto-Remediation closes the loop

Without guidance Your coding agent Large reasoning model Needed to find and reason about the issue

Tokens used 0 Working

Searching the codebase for vulnerable patterns
Run 1: 3 candidate issues results vary run to run
Run 2: 5 candidate issues, a different set
Researching the weakness and advisories
Drafting a fix
Test failed, iterating
Draft 2, test passed
Pull request opened

With Code SAST Secure Your coding agent Small, fast model Enough to apply a known fix

Tokens used 0 Working

Remediation brief received from the MCP server
Applying the fix at ops_agent.py:31
Running the provided test: passed
Pull request opened

Illustrative session. Token use depends on your model, your codebase and the finding.

Software Composition Analysis

Know Which Dependencies Can Actually Hurt You.

Most of your application is code you did not write. Code SAST Secure finds every dependency, then shows you the few vulnerable ones your code actually uses.

Everything you ship, in one inventory.

Discovering dependencies… 0 found

Dependency Vulnerable Reachable Fixed Illustrative

Continuous, Not Scheduled

Every repository is scanned on every build, natively on GitHub, GitLab, Bitbucket and Azure DevOps, or on-prem.

License and Policy

Flag license and policy violations next to vulnerabilities, with your own rules enforced.

Verified, Not Guessed

Only Proven Findings Reach the Queue.

Two independent checks turn a possible finding into a confirmed one. SAST+ proves it can be exploited. Code Canary shows the code runs.

Code SAST Secure flags the line

A possible weakness, found statically in your code.

Runtime testing proves it

Mobile Secure exploits the running app and captures the evidence.

SAST+ matches the two

Same weakness, same line. The finding is verified, not guessed.

APIs work the same way: API Secure exploits trace back to the line.

ios/Storage/TokenCache.swift

86 func persist(_ token: String) {

87 let defaults = UserDefaults.standard

88 defaults.set(token, forKey: "authToken") CWE-312 · possible Verified exploitable

89 }

Runtime proof Mobile Secure, device build Proven

found authToken in plaintext storage impact readable from a device backup

SAST+

Same weakness, same line: verified exploitable

A finding only matters if the code runs. Code Canary places a marker on each flagged code path, then watches the running application for it. When the canary trips, the path is confirmed reachable and moves to the top of the queue.

Planted on the Flagged Path

Code Canary marks the exact line the static finding points to.

Tripped at Runtime

When the running application executes that path, the canary trips, and the finding is confirmed reachable and moves to the top of the queue.

What your AI can do checkout-service · agents and skills Illustrative

skills/release/SKILL.md Agent skill Can send secrets off the host

AGENTS.md Agent configuration Review

skills/triage/SKILL.md Agent skill Low risk

AI-written code scanned Hallucinated packages caught AI BOM updated

AI Governance

See Every AI Agent Working in Your Repos.

AI now writes code, adds dependencies and runs inside your repositories as agents and skills. AI Governance in Code SAST Secure finds all of it, shows what each agent and skill is allowed to do, and flags the vulnerabilities and exposures they introduce.

Agents, skills and their configuration, found automatically
What each agent and skill can do, from shell and network access to secrets
AI-written code and hallucinated packages scanned before they ship

Pipeline Security and SBOM

Know What Every Merge Changed.

Pipeline Security checks every merge from agents and developers for maliciously merged code and new vulnerable or hallucinated dependencies. SBOM diff records exactly what each merge added, so what reaches main is clean.

Coding agents agent branches

Developers developer branches

feature branch

merged

main

$ git merge

Code SAST Secure merge check

A clean release

Every merge was checked before it reached main.

New vulnerable dependency Upgrade sent Malicious merge Blocked at merge Hallucinated package Blocked at merge 3 new components Recorded in SBOM diff

Coding agents agent branches

Developers developer branches

feature branch

merged

main

$ git merge

Code SAST Secure merge check

A clean release

Every merge was checked before it reached main.

New vulnerable dependency Upgrade sent Malicious merge Blocked at merge Hallucinated package Blocked at merge 3 new components Recorded in SBOM diff

Malicious Merge Detection

Flags code introduced through a merge that hides its behavior or bypasses review.

SBOM Diff

Compare the bill of materials at any two commits: added, removed and changed components, with findings.

AI BOM

A separate inventory of models, AI services and AI-generated components, in CycloneDX or SPDX.

VEX Statements

Vulnerability Exploitability eXchange tells auditors which listed vulnerabilities are actually exploitable.

Core Capabilities

The Code Security Core.

Everything under the AI layer is a complete code security product: static analysis, open source and SDK inventory, and audit-ready exports, across all your code.

SAST Across 20+ Languages

Source, bytecode and compiled artifacts, covering OWASP Top 10, CWE Top 25, injection, cross-site scripting (XSS) and buffer overflows.

Custom Rules and Policy

Your coding standards, security policy and license rules, enforced alongside the built-in checks.

Developer CLI and APIs

The same scanning and remediation, exposed to your own pipelines and LLM-driven workflows.

Attack Path Analysis

Code findings feed Data Theorem attack path analysis across your apps, APIs and cloud.

20+ Languages

Not mobile only. All your code, with custom checks for Swift and Kotlin.

Java
JavaScript
TypeScript
Python
Swift
Kotlin
C
C++
C#
Objective-C
Go
Ruby
Rust
PHP
Perl
R

Integrations

Native to Where Developers Work.

Fixes reach the agent, findings reach the repository and alerts reach the team. Connect your cloud Git platform, or deploy the Code SAST Secure scanner entirely on-prem and scan self-hosted repositories in your own environment.