AI-powered SAST with vulnerability validation.
Enterprise static application security testing that traces untrusted data flow from source to sink, reduces alert fatigue with AST taint verification, and accelerates developer remediation.
src/controllers/user_controller.py:16
request.args.get('user_id')
Untrusted HTTP query input entered via controller handler
query = "SELECT * FROM users WHERE id=" + user_id
String concatenation propagates tainted string without sanitizer AST node
cursor.execute(query)
Unsanitized SQL execution sink reachable without parameterized binding
- 16 query = "SELECT * FROM users WHERE id=" + user_id
- 17 cursor.execute(query)
+ 16 query = "SELECT * FROM users WHERE id = %s"
+ 17 cursor.execute(query, (user_id,))How Cyfendo performs SAST with validation
Traditional SAST tools generate hundreds of syntactic alerts. Cyfendo pairs deep static AST data-flow analysis with reachability validation to deliver high-confidence, actionable findings.
Analyze source code & data flows
Parses full application source code into high-fidelity Abstract Syntax Trees (ASTs). Constructs inter-procedural Control Flow Graphs (CFGs) to track tainted user input from entry points through variable assignments, transforms, and sinks across multiple files.
- Full AST syntactic & semantic parsing
- Cross-file data flow & variable tracking
- Automatic sanitization node identification
Investigate & provide evidence
Every flagged pattern is evaluated for actual reachability. Cyfendo builds a verifiable trace connecting the untrusted source to the vulnerable sink. Where execution criteria permit, secondary validation engines verify whether input boundaries can trigger the flaw.
- Source-to-sink reachability verification
- Elimination of dead code & mitigated paths
- Transparent evidence trace for developer review
Actionable findings & review-ready fixes
Findings include exact lines of code, CWE classification, CVSS v3.1 scoring, and remediation rationale. Paid tiers include context-aware unified Git diff patches that developers can review, test, and merge into their repositories via standard pull requests.
- Full finding details & sample patch on Free tier
- Context-aware unified Git diffs on Paid plans
- Strict developer approval required before merging
Technical fit & capability matrix
Direct answers on language support, ingestion methods, evidence formats, and operational boundaries for engineering evaluators.
| Evaluation Dimension | Cyfendo SAST Implementation | Evaluator Verification Note |
|---|---|---|
| Supported Languages | 16 Languages: Python, JavaScript, TypeScript, Go, Java, Rust, C, C++, PHP, Ruby, C#, Swift, Kotlin, Scala, Shell/Bash, SQL. | Multi-Language AST 16 languages parsed; deep taint tracking on backend stacks; Java & Python benchmarked |
| Code Ingestion Methods |
3 Supported Ingestion Vectors:
|
Released No invasive IDE extensions required |
| Scan Triggering Workflows | On-demand manual scans via Web UI, automated terminal CLI executions, or pipeline automation in CI/CD environments (GitHub Actions, GitLab CI, Jenkins) using standard CLI exit codes. | Standard CLI Deterministic non-zero exit on criticals |
| Analysis Depth & Evidence | Inter-procedural AST taint paths connecting untrusted sources to sinks. Each finding provides exact file and line numbers, vulnerability category (CWE), CVSS v3.1 score, and explanatory rationale. | Evidence-First Source-to-sink reachability trace |
| Remediation Patch Availability |
Tier-specific:
|
Developer Gated Zero automatic unreviewed merges |
| Code Privacy & Retention | Zero Retention & Zero Training: Scanned files are processed inside isolated, ephemeral gVisor sandboxes and destroyed immediately upon scan completion. Enterprise Zero Data Retention (ZDR) guarantee ensures code is never used to train or fine-tune models. | Contractual ZDR Private CLI available for zero egress |
| On-Premise / Zero-Egress |
Cyfendo CLI supports local execution (cyfendo scan --private .) with zero source code sent to Cyfendo. When paired with local models (Ollama, vLLM), code never leaves your local perimeter. External model APIs (OpenAI, Anthropic, Gemini) connect directly under customer enterprise terms.
|
Zero Egress Mode Local AST parsing & rules |
Inspect a verified finding dossier
See how Cyfendo documents a confirmed vulnerability from taint origin to proposed remediation patch. Modeled after standardized benchmark test cases.
SQL Injection via Unsanitized HTTP Parameter
Vulnerability Description & Impact
The application extracts user-controlled input (user_id) directly from an incoming HTTP request query parameter and interpolates it into a raw SQL query string via string concatenation. An external attacker can provide crafted payloads containing SQL meta-characters (such as ' OR 1=1 --) to bypass access controls, extract database records, or execute arbitrary database commands.
def get_user_profile(request, db_cursor):
user_id = request.args.get('user_id')
query = "SELECT * FROM users WHERE id=" + user_id
db_cursor.execute(query)
user = db_cursor.fetchone()
return render_template('profile.html', user=user)Source-to-Sink AST Taint Trace
Cyfendo tracks data flow across AST nodes to establish that untrusted user input reaches the database execution sink without traversing an appropriate sanitizer or parameterized boundary.
request.args.get('user_id')src/controllers/user_controller.py:15 • AST Node: Call[Attribute(request.args.get)]TAINT_EXTERNAL_INPUT is assigned to symbol user_id.query = "SELECT * FROM users WHERE id=" + user_idsrc/controllers/user_controller.py:16 • AST Node: BinOp[Add]query. No escaping, cast, or sanitization detected.db_cursor.execute(query)src/controllers/user_controller.py:17 • AST Node: Call[Attribute(db_cursor.execute)]query as direct SQL statement argument without parameter tuple. Reachable tainted input verified. (Static data flow establishes that unvalidated input flows to this sink; dynamic exploitability depends on DBMS configuration, permissions, and database driver behavior.)Proposed Code Remediation Patch
The proposed patch replaces dynamic string concatenation with database driver parameterized placeholders (%s), separating SQL commands from untrusted user data.
--- a/src/controllers/user_controller.py
+++ b/src/controllers/user_controller.py
@@ -14,7 +14,7 @@ def get_user_profile(request, db_cursor):
14 def get_user_profile(request, db_cursor):
15 user_id = request.args.get('user_id')
-16 query = "SELECT * FROM users WHERE id=" + user_id
-17 db_cursor.execute(query)
+16 query = "SELECT * FROM users WHERE id = %s"
+17 db_cursor.execute(query, (user_id,))
18 user = db_cursor.fetchone()
19 return render_template('profile.html', user=user)Standardized benchmark results
We evaluate our detection accuracy on standardized security suites and publish our exact recall, precision, false positive rates, and Youden's Index scores.
OWASP Benchmark Java v1.2
2,740 Standardized Test Cases • August 2026 EvaluationDetected 1,377 of 1,415 actual true vulnerabilities with 88.61% precision (1,377 / 1,554 flagged cases). Pooled Youden's J score measured at 83.95% (category-averaged 83.01% across 11 OWASP categories).
OWASP Benchmark Python v0.1
1,230 Standardized Test Cases • Preliminary ReleaseIdentified 407 of 452 vulnerable cases with 93.78% precision and 96.53% specificity on negative controls (751 of 778 safe benchmark cases correctly left unflagged).
Developer workflow & code privacy
How Cyfendo fits into your engineering pipeline, and how we protect your proprietary source code with hardened isolation and contractual guarantees.
Connect & Submit
Connect a repository via Git HTTPS clone, upload a project archive via browser, or trigger scans directly in your CI pipeline using cyfendo scan ..
AST Taint Analysis
Source code is parsed into abstract syntax trees in ephemeral micro-sandboxes. Data flows are mapped from untrusted entry points to database, command, and web sinks.
Evidence & Validation
Reachable paths are isolated and packaged with full AST evidence traces. Potential findings lacking path reachability or mitigated by existing controls are pruned.
Review & Merge
Developers inspect verified findings alongside context-aware Git unified diffs. The proposed patch is reviewed and merged via standard Git pull request workflows.
Ephemeral Isolation (Zero Retention)
Scans execute inside hardened, ephemeral sandboxes (gVisor container isolation). Source code is held only in memory during static analysis and completely purged upon scan completion. No permanent copy of customer code is retained.
Zero Model Training Guarantee
Your proprietary intellectual property is protected under enterprise Zero Data Retention (ZDR) agreements. Customer source code, variable names, and findings are strictly never used to train, tune, or evaluate foundational AI models.
CLI Private Scanning & Local Execution
For teams requiring on-premise execution, the Cyfendo CLI provides a private scan mode (cyfendo scan --private .) where no source code is sent to Cyfendo. When configured with local inference engines (Ollama, vLLM), code never leaves your local machine or corporate perimeter. When using external LLM APIs (OpenAI, Anthropic, Gemini), requests route directly to that provider under your enterprise agreement.
Free evaluation and transparent paid plans
Cyfendo prices transparently based on protected Lines of Code (LOC) and monthly scan allowances—not seat licenses or artificial per-finding fees.
How Protected LOC is Calculated
Protected LOC measures the active application source code volume in your workspace. You only pay for proprietary code, never for third-party packages or generated output.
- Counted: Executable application code, business logic, templates, and configurations.
- Automatically Excluded: Blank lines, whitespace-only lines, and comments (single-line, block, docstrings).
- Excluded Directories: Third-party packages (
node_modules/,vendor/,.venv/,site-packages/). - Excluded Artifacts: Minified bundles (
.min.js), build/dist output (build/,dist/,target/), test mock data, and compiled binaries.
If an uploaded codebase exceeds the Free tier limit (10,000 LOC), it is safely staged as a pending upload. We calculate your exact LOC count and present clear options: upgrade to a tier with sufficient capacity (e.g. Starter at $99/mo for up to 100K LOC), or select a specific subdirectory or module to scan. Your code is never deleted or partially run without your consent.
Free
Evaluate on your codebase
- 10,000 protected LOC
- 5 scans per month
- 1 protected project
- Actionable finding details
- Limited sample patch evaluation
- No credit card required
Starter
Lowest-friction paid entry
- 100,000 protected LOC
- 100 scans per month
- Unlimited projects & members
- Full review-ready patches
- CI/CD integration & CLI
Growth
For growing engineering teams
- 500,000 protected LOC
- 300 scans per month
- Unlimited projects & members
- Full review-ready patches
- Priority queue & email support
Scale
Multi-repo architectures
- 2,000,000 protected LOC
- 1,000 scans per month
- Add-on units allowed ($200/mo)
- Full review-ready patches
- Priority technical support
Frequently asked questions
Direct, factual answers regarding SAST capabilities, validation mechanics, benchmark methods, privacy guarantees, and plan limits.
Static Application Security Testing (SAST) analyzes source code for vulnerabilities without executing the program. Cyfendo uses SAST by parsing application codebases into Abstract Syntax Trees (ASTs) and modeling inter-procedural Control Flow Graphs (CFGs). This allows Cyfendo to trace tainted user input from entry points (sources) to sensitive execution routines (sinks), identifying high-risk weaknesses (such as SQL Injection, Cross-Site Scripting, Command Injection, and Path Traversal) early in development.
Traditional static analysis frequently overwhelms developers with noisy false positives caused by naive regex rules and syntactic pattern matching that ignore real execution context. Cyfendo complements static parsing with a validation layer that verifies whether a tainted data path is genuinely reachable and whether sanitizers or type coercions neutralize the risk. This evidence-based approach ensures engineers review verified flaws backed by concrete source-to-sink reachability traces.
Cyfendo currently supports source-code security analysis for 16 languages: Python, JavaScript, TypeScript, Go, Java, Rust, C, C++, PHP, Ruby, C#, Swift, Kotlin, Scala, Shell/Bash, and SQL. Code can be submitted via:
- Browser Upload: Drag-and-drop project folders or upload
.zipor.tar.gzarchives. - Git HTTPS Clone: HTTPS repository clone for GitHub, GitLab, Bitbucket, Azure DevOps, or custom Git hosts.
- Cyfendo CLI: Run
cyfendo scan .from local developer workstations or automated CI/CD pipelines.
Yes. While Cyfendo achieves industry-leading benchmark results (including an 88.61% precision rate on OWASP Benchmark Java v1.2 and a 3.47% False Positive Rate on OWASP Benchmark Python v0.1), no static code scanner can guarantee zero false positives or identify 100% of security flaws across dynamic execution contexts. Static analysis is a vital layer in defense-in-depth, but does not eliminate the need for secure architectural design and runtime testing.
All benchmark scores were measured by Cyfendo in August 2026 across standardized evaluation suites: the full OWASP Benchmark Java v1.2 (2,740 test cases) and the OWASP Benchmark Python v0.1 suite (1,230 test cases). Metrics are calculated using pooled Youden's Index J (Recall minus False Positive Rate). Benchmark suites test standardized, synthetic vulnerability patterns under controlled conditions; they provide comparative rigor but do not constitute an official certification or endorsement by OWASP.
Cloud-analyzed code is processed inside isolated, ephemeral gVisor sandboxes and purged immediately upon scan completion. Under enterprise Zero Data Retention (ZDR) agreements, your source code is strictly never used to train or fine-tune AI models. For organizations with sensitive policies, the Cyfendo CLI supports local private scanning (cyfendo scan --private .) where no source code is sent to Cyfendo. When paired with local models (Ollama, vLLM), code never leaves your local machine or corporate perimeter. When using external LLM APIs (OpenAI, Anthropic, Gemini), requests route directly to that provider under your enterprise agreement.
The Free tier includes 10,000 protected Lines of Code (LOC), 5 monthly security scans, and 1 project with no credit card required. Free plan users receive full vulnerability details, severity classifications, and source-to-sink reachability proofs, alongside sample patch evaluation. Automated review-ready patch generation across all findings is included in paid plans starting at $99/month (Starter tier for 100K LOC).
No. Cyfendo generates unified Git diff patches formatted for human review, but never commits or merges code into your repositories automatically. Developers inspect the proposed patch diff, verify the fix against internal coding standards, and approve merges via standard pull request workflows.
Experience AI-powered SAST with validated evidence.
Discover real vulnerabilities in your source code, inspect inter-procedural taint reachability proofs, and evaluate review-ready remediation patches on your own terms.
Start Free