Skip to content
winfunc
Triager
Available

Ask your codebase about its security.

A repository-aware assistant that knows your code, your findings, and your architecture. Ask in plain language, inspect the evidence it cites, and decide faster.

See public findings
  1. acme
  2. /billing-api
  3. /Triager
You2m

Which open findings are reachable without logging in?

Triagernow3
  • list_findings · status=open
  • trace_reachability · from=public routes
  • read_file · routes/index.ts

Two of the six open findings are reachable before authentication:

  • WF-0877Webhook preview fetches internal addresses
  • WF-0931Password reset token reused across requests

The admin export needs a session, so I would fix the webhook first. Want a patch?

Ask about findings, code, or fixes
AI triager · conversationIllustrative data
What it does

Capabilities.

  • Natural-language security questions about your repository
  • Answers grounded in code, findings, and architecture context
  • Streaming responses with citations to the code
  • Live code-analysis tools during a conversation
  • Links to referenced findings
  • Multiple conversations with retained history
  • Code-level explanations of each vulnerability
  • Triage recommendations and prioritization guidance
  • Findings from third-party scanners and inbound disclosures consolidated and verified against code
Why it matters

Built for decisions, not queues.

01

Grounded in your repository

The assistant draws on the code, architecture notes, and finding history of the repository in scope, so its answers are specific to your application.

02

Faster triage

Ask which prerequisites matter, request a deeper look at a suspicious path, or explore remediation options. Evidence and uncertainty are always shown.

03

Decisions that persist

Conversations keep their history and link to findings, so the reasoning behind a decision stays with the decision.

04

Tools, not guesses

The assistant can run code-analysis tools and read scan history during an investigation, then cite what it found.

Start with one repository

Bring us your hardest codebase.
We'll bring the proof.

Scope a first audit with our security engineers. You get findings with traces, reproduction evidence, and patches ready for review.

See public findings