Products
Two ways to put an agent on your codebase.
Run full audits and continuous review in winfunc Scanner, or bring the same analysis into your AI editor with Winfunc MCP.
WorkspaceAvailable
- acme
- /billing-api
- /Patches
- /WF-1042
Validated
src/services/invoices.ts+2−1
| @@ -39,6 +39,7 @@ export async function getInvoice | ||
| 39 | export async function getInvoice(req: Request) { | |
| 40 | const id = req.params.invoiceId; | |
| 41 | − return repo.findInvoice(id); | |
| 41 | + const tenantId = req.auth.tenantId; | |
| 42 | + return repo.findInvoice(id, { tenantId }); | |
| 43 | } | |
Checks3 / 3
- Test suite214 passed
- Exploit re-runrejected · 404 for tenant A
- Lint and formateslint · prettier
View proofOpen pull request
- Minimal change, written in the repository's own style.
- The original exploit is run again against the patched build.
winfunc Scanner
Audits, pull-request review, dependency scanning, validation, autofix, and analytics for your repositories.
ExploreEditorsAvailable
- acme
- /billing-api
- /PR reviews
- /#2481
1 finding
Add admin export endpoint
#2481 · feat/export → main · +48 −6
- Diff scoped
- Traced
- Reproduced
src/routes/admin/export.ts+5−0
| @@ -9,0 +10,6 @@ router | ||
| 10 | +router.get( | |
| 11 | + "/admin/export", | |
winfuncHighCWE-862 This admin route has no role check. Any signed-in user can export every customer's invoices. Reproduced with a member account. + requireRole("admin"), Commit suggestionDismiss | ||
| 12 | + async (req, res) => { | |
| 13 | + const rows = await exportAll(req.query); | |
| 14 | + res.csv(rows); | |
Winfunc MCP
Security review of snippets, files, and changes from Cursor, Claude Desktop, Windsurf, and Cline.
ExploreStart with one repository
Bring us your hardest codebase.
We'll bring the proof.
Scope a first audit with our security engineers. You get findings with traces, reproduction evidence, and patches ready for review.