AI-powered application security testing

Scan your code for security vulnerabilities.

Q: How much code can I scan for free?

The Free plan includes up to 10,000 protected Lines of Code (LOC) and 5 security scans per month for 1 protected project. No credit card is required to register.

Q: What counts toward protected LOC?

Protected LOC measures active application source code lines. It includes executable statements and logic files. It automatically strips blank lines and comments, and excludes third-party dependencies (node_modules, vendor, .venv), build artifacts (dist, build, target), minified files, test mock data, and compiled binaries.

Q: What happens if my repository exceeds the free limit?

If your repository exceeds 10,000 protected LOC, the upload is safely staged in your dashboard as a pending upload. Cyfendo reports your codebase size and presents clear options: upgrade to a paid tier with sufficient capacity (such as Starter at $99/mo for up to 100K LOC), or select a smaller subdirectory to stay within the free allowance. Staged scans can be resumed immediately after upgrading.

Q: How is my source code processed and retained?

Your code is processed in ephemeral, isolated sandboxes that are created on demand and destroyed immediately upon scan completion. Under our enterprise Zero Data Retention (ZDR) policy, customer code is never used to train or fine-tune AI foundation models. All data in transit is encrypted using TLS 1.3, and findings are stored with AES-256 encryption. For zero-egress environments, the Cyfendo CLI Private Scan mode keeps all code and findings strictly on your local machine.

Q: Are fixes included in the free plan?

The Free plan includes full vulnerability details, severity ratings, evidence paths, and actionable remediation instructions, along with limited sample patch evaluation. Full automated, review-ready patch generation across all detected findings is included in paid plans (Starter, Growth, and Scale).

Scan your application source code for actionable vulnerabilities, validate flaws with deterministic AST taint tracking, and resolve verified risks with review-ready remediation patches.

Start Free See a sample finding

Free tier: 10,000 protected LOC • 5 security scans/month • 1 project

No credit card required Instant Web or CLI setup Zero model training guarantee

CWE-89: SQL Injection via Parameter

src/controllers/user_controller.py:16

CRITICAL • 9.8

Taint Reachability Proof

SOURCE request.args.get('user_id') (HTTP Query Param)

TAINT query = "SELECT * FROM users WHERE id=" + user_id

SINK db_cursor.execute(query) (Unsanitized SQL execution)

Review-Ready Patch Diff (Unified Git Format) Python 3 • psycopg2

16 - query = "SELECT * FROM users WHERE id=" + user_id

17 - db_cursor.execute(query)

16 + query = "SELECT * FROM users WHERE id = %s"

17 + db_cursor.execute(query, (user_id,))

Project Compatibility & Onboarding

Will this work with my code?

Cyfendo is engineered specifically for application source-code security. It supports modern programming languages, flexible code submission options, and requires no heavy runtime agents or complex pipeline changes.

Verified Supported Programming Languages

• Python

• JavaScript

• TypeScript

• Java

• Go (Golang)

• Rust

• C / C++

• PHP

• Ruby

• C# / .NET

• Swift

• Kotlin

• Scala

• Shell / Bash

• SQL

Benchmark Scope Notice: Java and Python have been evaluated comprehensively on standardized OWASP Benchmark test suites. Additional languages are parsed using AST grammar extractors and semantic taint analyzers.

3 Ways to Submit or Connect Code

Web Folder or Zip Upload

Drag and drop your project directory or upload a .zip or .tar.gz archive directly in your browser. Dependencies (node_modules/, vendor/, .venv/) and build artifacts are stripped automatically before scanning.

Zero Configuration • Instant Analysis

Git Repository (HTTPS)

Connect repositories from GitHub, GitLab, Bitbucket, Azure DevOps, or custom Git servers via HTTPS. Supports specific branch targets, subdirectory scoping (e.g. apps/backend), and Personal Access Token (PAT) authentication for private repos.

Public & Private Repositories • Monorepo Friendly

Cyfendo CLI (Terminal & CI/CD)

Run cyfendo scan . from your terminal or CI/CD pipeline. Includes SARIF export (--sarif) for GitHub Security tabs and optional Cyfendo Private Scan (--private) mode for zero source code egress on local hardware.

POSIX One-Liner • Zero Source Egress Option

Create Free Account

Sign up in 30 seconds with your work email. No credit card, phone number, or billing information is required to access your 10,000 protected LOC allowance.

Connect Your Codebase

Choose your preferred method: drag and drop a folder, provide a Git repository URL, or execute a one-line scan command in your local terminal.

Review Findings & Fixes

Inspect prioritized vulnerability findings, trace complete source-to-sink evidence, and evaluate review-ready proposed code patches before applying them.

Core Security Outcomes

What you receive with every scan

Cyfendo focuses strictly on actionable source-code security. We help engineering teams identify real risks, understand why they matter, and resolve them efficiently without drowning in unverified alerts.

Step 01 • Detection

Find: Source Code Flaws

Identify potential vulnerabilities in application source code using Abstract Syntax Tree (AST) parsing and multi-file symbol indexing across your repository.

Injection flaws: SQLi, Command Injection, LDAP, XPath
File security: Path Traversal, Arbitrary File Read/Write
Logic & memory: Insecure Deserialization, SSRF, Broken Auth
Cryptographic weaknesses & hardcoded sensitive keys

Step 02 • Verification

Validate: Real Evidence

Review deterministic evidence and understand why a finding matters before writing code. Reachability analysis validates whether untrusted data actually reaches execution sinks.

Source-to-sink data-flow reachability tracing
Adversarial verification to suppress non-exploitable dead code
Exact file paths, line numbers, and CWE references
Transparent notice: minimizes noise; no tool guarantees 0% false positives

Step 03 • Remediation

Fix: Review-Ready Patches

Receive actionable remediation instructions and synthesized code diffs. Paid plans include automated patch generation, while developers always maintain 100% review authority.

Clear remediation guidance for every discovered vulnerability
Unified Git diffs (.patch format) matching repository style
Developers review, test, and approve before merging
Included in paid plans; sample patch evaluation on free tier

Interactive Product Sample

Sample finding and remediation dossier

Explore a sanitized example modeled after our OWASP Benchmark test cases. Inspect the vulnerability breakdown, the source-to-sink reachability proof, and the review-ready patch diff.

SQL Injection via Unsanitized HTTP Parameter

Target Location: src/controllers/user_controller.py:16 • Common Weakness: CWE-89

CRITICAL • CVSS 9.8

Severity Rating Critical (9.8)

CWE Family CWE-89: SQLi

Attack Vector Network (Remote)

Confidence High (Verified Taint)

Vulnerability Description: The application extracts the user_id query parameter directly from the incoming HTTP request and interpolates it into a raw SQL query string via string concatenation. An external attacker can provide crafted input containing SQL meta-characters (such as ' OR 1=1 --) to bypass access controls, extract database records, or execute arbitrary database commands.

Vulnerable Code Context: src/controllers/user_controller.py Lines 14-19 • Python (psycopg2)

14 def get_user_profile(request, db_cursor):

15 user_id = request.args.get('user_id')

16 ! query = "SELECT * FROM users WHERE id=" + user_id # Unsanitized concatenation

17 ! db_cursor.execute(query) # Dangerous sink reached

18 user = db_cursor.fetchone()

19 return render_template('profile.html', user=user)

Plan Scope Note: All findings—including complete vulnerability summaries, CWE details, CVSS ratings, affected code lines, and root-cause explanations—are fully visible on the Free tier. Automated review-ready patch generation across all findings is included with paid plans.

Deterministic Source-to-Sink Evidence Path

Cyfendo doesn't flag potential findings based on pattern-matching keywords alone. It traces the Abstract Syntax Tree (AST) to verify that unvalidated external input flows uninterrupted into a dangerous execution sink.

STAGE 1: SOURCE

Untrusted External Input Ingestion
request.args.get('user_id') at line 15 receives caller-controlled input over HTTP without type coercion or regex validation.

STAGE 2: TAINT

Variable Assignment & String Interpolation
Variable user_id carries the tainted payload into expression "SELECT * FROM users WHERE id=" + user_id. No sanitization routines detected in the call chain.

STAGE 3: SINK

Dangerous Database Sink Reached
db_cursor.execute(query) at line 17 executes the tainted string against the SQL engine. Static reachability confirmed from HTTP input to database sink without runtime validation or dynamic exploit execution.

Confidentiality Notice: This evidence trace illustrates a sanitized synthetic test case. In production scans, customer proprietary code and findings remain strictly confidential and partitioned in your workspace.

Proposed Code Remediation Patch

Unified Git Diff format • Parameterized SQL binding (psycopg2)

Illustrative Sample • Developer Review Required

The proposed patch replaces dynamic string concatenation with database driver parameterized placeholders (%s), separating SQL structure from user data.

diff --git a/src/controllers/user_controller.py b/src/controllers/user_controller.py --- a/src/controllers/user_controller.py +++ b/src/controllers/user_controller.py

14 def get_user_profile(request, db_cursor):

15 user_id = request.args.get('user_id')

16 - query = "SELECT * FROM users WHERE id=" + user_id

17 - db_cursor.execute(query)

16 + query = "SELECT * FROM users WHERE id = %s"

17 + db_cursor.execute(query, (user_id,))

18 user = db_cursor.fetchone()

19 return render_template('profile.html', user=user)

Developer Authority Principle: Cyfendo never automatically commits or merges code changes into your Git repositories. Every proposed diff is designed to be inspected, tested, and approved by your developers before merging.

Measured Evidence & Trust

Measured accuracy & code protection

We evaluate our detection accuracy on standardized security benchmarks and enforce strict data privacy protections for your proprietary software.

OWASP Benchmark Java v1.2

2,740 Standardized Test Cases • August 2026 Evaluation

Full Suite Tested

83.96% Youden’s J (Pooled)

97.31% Recall (TPR)

13.36% False Positive Rate

Detected 1,377 of 1,415 actual true vulnerabilities with 88.61% precision. Category-averaged Youden's J score measured at 83.01% across 11 OWASP vulnerability categories.

Measured and verified by Cyfendo on standardized OWASP Benchmark v1.2 suites.

View full benchmark scorecard → Read technical white paper →

OWASP Benchmark Python v0.1

1,230 Standardized Test Cases • Preliminary Release

Full Suite Tested

86.57% Youden’s J (Pooled)

90.04% Recall (TPR)

3.47% False Positive Rate

Identified 407 of 452 vulnerable cases with 93.78% precision and 96.53% specificity on negative controls (751 of 778 safe benchmark cases correctly left unflagged).

Measured and verified by Cyfendo on OWASP Benchmark Python v0.1 in August 2026.

View Python evaluation → Benchmark methodology →

Synthetic Benchmark Limitations: The OWASP Benchmark test suites evaluate taint tracking, syntactic discrimination, and reachability validation under standardized, labeled conditions. While empirical benchmark results are valuable for comparing tool capabilities, synthetic tests cannot guarantee real-world vulnerability coverage across complex bespoke business logic, nor do they represent a formal security certification.

Strict Source Code Privacy & Data Security Commitments

Zero Model Training

Your source code is never used to train, retrain, or fine-tune public or shared AI models. Governed by enterprise Zero Data Retention (ZDR) agreements.

Ephemeral Isolation

Analysis sandboxes are spun up on demand in isolated execution namespaces (gVisor/microVMs) and wiped immediately after scan completion.

TLS 1.3 & AES-256

All data in transit is encrypted using modern TLS 1.3 with Perfect Forward Secrecy. Stored finding summaries are encrypted at rest with AES-256.

Local Zero-Egress CLI

With Cyfendo CLI Private Scan (cyfendo scan --private .), AST parsing runs locally with zero code sent to Cyfendo. When using local models (Ollama/vLLM), zero code leaves your infrastructure. External model APIs connect directly under customer enterprise terms.

Read Cyfendo's complete Privacy Policy & Security Architecture →

Predictable LOC Capacity

Free evaluation and transparent paid plans

Cyfendo prices transparently based on protected Lines of Code (LOC) and monthly scan allowances—not seat licenses or artificial per-finding fees.

How Protected LOC is Calculated

Protected LOC measures the active application source code volume in your workspace. You only pay for proprietary code, never for third-party packages or generated output.

• Counted: Executable application code, business logic, templates, and configurations. • Automatically Excluded: Blank lines, whitespace-only lines, and comments (single-line, block, docstrings). • Excluded Directories: Third-party packages (node_modules/, vendor/, .venv/, site-packages/). • Excluded Artifacts: Minified bundles (.min.js), build/dist output (build/, dist/, target/), test mock data, and compiled binaries.

What if my repository exceeds the free limit?

If an uploaded codebase exceeds the Free tier limit (10,000 LOC), it is safely staged as a pending upload. We calculate your exact LOC count and present clear options: upgrade to a tier with sufficient capacity (e.g. Starter at $99/mo for up to 100K LOC), or select a specific subdirectory or module to scan. Your code is never deleted or partially run without your consent.

Free

Evaluate on your codebase

$0 / month

10,000 protected LOC
5 scans per month
1 protected project
Actionable finding details
Limited sample patch evaluation
No credit card required

Start Free

Starter

Lowest-friction paid entry

$99 / mo ($82.50/mo annual)

100,000 protected LOC
100 scans per month
Unlimited projects & members
Full review-ready patches
CLI & Git repository support

Choose Starter

Growth

For growing engineering teams

$299 / mo ($249/mo annual)

500,000 protected LOC
300 scans per month
Unlimited projects & members
Full review-ready patches
Priority scan queue

Choose Growth

Scale

Multi-repo architectures

$799 / mo ($666/mo annual)

2,000,000 protected LOC
1,000 scans per month
Add-on units allowed ($200/mo)
Full review-ready patches
Priority technical support

Choose Scale

Need custom enterprise capacity or on-premise deployment? View all plans →

Frequently Asked Questions

Answers to common technical questions

Everything you need to know about supported languages, protected LOC accounting, code privacy, and patch handling.

Which languages and input methods are supported?

Cyfendo supports source-code security scanning for Python, JavaScript, TypeScript, Go, Java, Rust, C, C++, PHP, Ruby, C#, Swift, Kotlin, Scala, Shell/Bash, and SQL. Code can be submitted via:

Browser Upload: Drag-and-drop project folders or upload .zip or .tar.gz archives.
Git Repository Connection: HTTPS clone for GitHub, GitLab, Bitbucket, Azure DevOps, or custom Git servers (supports public or private repos with Personal Access Tokens).
Cyfendo CLI: Run cyfendo scan . from your terminal or CI/CD pipelines on macOS and Linux.

How much code can I scan for free?

The Free tier includes up to 10,000 protected Lines of Code (LOC) and 5 security scans per month for 1 protected project. Registration requires only your work email—no credit card or billing details are required.

What counts toward protected LOC?

Protected LOC represents active application source code lines. We count executable statements, logic files, and configurations. We automatically exclude blank lines, whitespace, and comments (single-line, block, docstrings). In addition, dependencies (node_modules/, vendor/, .venv/), minified bundles (.min.js), build/dist directories, test fixtures, and binaries are excluded automatically.

What happens if my repository exceeds the free limit?

When an upload exceeds the 10,000 protected LOC limit, the code is safely staged as a pending upload in your workspace. Cyfendo reports your exact calculated LOC count and presents clear options: upgrade to a tier with sufficient capacity (starting with Starter at $99/mo for up to 100K LOC), or select a smaller subdirectory to scan. Your code is not discarded or partially scanned without your direction.

Can false positives still occur?

Yes. Like all automated application security testing tools, false positives can still occur. Cyfendo is designed to minimize triage noise by validating AST data-flow reachability from sources to sensitive sinks and testing candidate flaws in isolated sandboxes. Every finding provides complete source-to-sink proof so your team can verify findings quickly.

How is my source code processed and retained?

For cloud scans, your source code is processed inside ephemeral, isolated sandboxes (gVisor/microVMs) that are created on demand and wiped immediately upon scan completion. Under our enterprise Zero Data Retention (ZDR) policy, customer code is never used to train or fine-tune public or shared AI models. All data in transit is encrypted using TLS 1.3, and findings are stored using AES-256 encryption.

For strict data sovereignty, the Cyfendo CLI Private Scan mode (cyfendo scan --private .) performs AST parsing and rule evaluation locally with zero code sent to Cyfendo. When combined with local inference (Ollama/vLLM), zero code leaves your environment. If you configure external model APIs, the CLI communicates directly with your provider under your enterprise terms.

Are fixes included in the free plan?

The Free plan includes full finding details, severity rankings, evidence paths, and actionable remediation instructions, along with limited sample patch evaluation. Automated review-ready patch generation across all detected findings is included in paid plans (Starter, Growth, and Scale).

Does Cyfendo automatically merge patches?

No. Cyfendo never automatically commits or merges code into your repositories. Generated patches are presented as unified git diffs for developer review, testing, and approval. Developers always maintain full authority over code changes.

Get Started in 2 Minutes

Scan your code for security vulnerabilities.

Discover real flaws in your source code, verify reachability with source-to-sink evidence, and evaluate review-ready remediation guidance.

Start Free

Includes 10,000 protected LOC • 5 security scans/month • No credit card required