Vulnerability triage, path by path. 24/7.
Every alert read as a path through your code, then settled.
shop-apiCybe AnalysisDemo project
CriticalCart price manipulationCWE-472
Business rule: prices come from the catalogue, never from the client.
- POST /checkoutroutes/checkout.ts:18Entry point. The cart arrives from the browser, prices included.
- total = sum(items.map((i) => i.price))checkout.service.ts:57Flaw. The total is computed from the prices the client sent.
- payments.charge(total)payments/stripe.ts:104Sink. The card is charged that total.
ExploitablePriority 92Owner: payments team
It reads your app as a graph.
A flaw is a path through your code. So is its fix.
Your code as a graph
It writes the verdict of a senior analyst.
A real triage, unedited.
90%
of irrelevant alerts filtered out during the scan itself, before anyone reads them.
CybeDefend figure
Cybe Analysisvulpy2026-01-13 18:57- Verdict
- False positive
- Summary
- The reported SQL injection is a false positive: the code is part of a controlled initialization script with hardcoded, trusted values.
- Data flow
db_init_usersgood/db_init.py:22user_creategood/libuser.py:61- Reachability
- Not reachable from untrusted input
Start with one repository.
Connect GitHub, GitLab, Bitbucket or Azure DevOps, pick a repository, and the first scan starts.
In detail
The full verdict
Cybe Analysis reads your code as a graph, filters out the alerts that do not matter and writes a verdict on the rest.
Every function, sink and business rule becomes a node. A flaw is a path through it, and so is the fix.
A real triage session, 12 seconds, no edit: the data flow, the evidence, the reachability, the call.
Cybe Analysisvulpy2026-01-13 18:57- Verdict
- False positive
- Summary
- The reported SQL injection is a false positive: the code is part of a controlled initialization script with hardcoded, trusted values.
- Data flow
db_init_usersgood/db_init.py:22user_creategood/libuser.py:61- Evidence
user_createinserts a new user with predefined, trusted values.- The code is only reachable during database initialization, not from external or untrusted input.
- Sanitizers
- No sanitizers are present.
- Reachability
- Not reachable from untrusted input
- Remediation
- None required: the code is not exploitable in its current context.
- Assigned priority
- Low
Your code stays in your region.
Models we host ourselves, and nothing crosses the regional boundary.
Where your code livesEUUS
- Standard scanCloned into an isolated container, destroyed when the scan ends.
- Cybe Analysis and the Security ChampionKeep a copy of the code, its git history and a knowledge graph in your region, deleted on request.
- ModelsOpen-weight models we host in your region: Scaleway in the EU, Google Cloud in the US.
- Third-party AINo code and no prompt is sent to a third-party AI API.
GDPR compliant. SOC 2 Type II audit under way.
Cybe Analysis, in detail.
How does Cybe Analysis differ from a traditional SAST scanner?
A traditional SAST tool flags every pattern match it sees, leaving developers to filter the 90% of false positives. Cybe Analysis builds a knowledge graph of your application, function calls, taint flow, framework gates, and only surfaces findings that are reachable, exploitable and material in your business context. The 90% of noise is dropped during the scan itself, not after.
Where does my code live? Is anything sent to an external API?
Cybe Analysis runs on our self-hosted AI infrastructure (EU or US region, isolated). It does not call external LLM APIs (OpenAI, Anthropic or otherwise). Your code, vulnerabilities and analysis stay inside the region you pick at signup. To answer from your code, Cybe Analysis keeps a copy of it and its git history in that region, deleted on request. A standard scan runs in a container that is destroyed when the scan ends.
What does 'senior-analyst-level' actually mean?
Each finding ships with: a risk score (exploitability + reachability + blast radius + business impact), a remediation-complexity estimate, a recommended owner, and a written rationale that a junior engineer can act on without escalation. That is the cognitive output we benchmark against a senior AppSec engineer.
Does Cybe Analysis replace my existing SAST / SCA tools?
Cybe Analysis works on what CybeDefend's scanners find: the CybeDefend Engine runs open-source engines such as Opengrep, Gitleaks, Checkov and Trivy with its own rules, for SAST, SCA, IaC, containers and secrets. Cybe Analysis then applies a reachability + business-context layer over their output: the value is that analysis, not the raw scan. Teams that adopt VibeDefend typically replace their legacy SAST/SCA outright; you get one source of truth, one dedup graph, and ~90% fewer false positives.
How fast is the analysis?
Median diff scan completes in seconds. A full-repository first-time scan typically completes in minutes. Subsequent runs only re-analyse changed code paths, so steady-state cost is bounded by your commit cadence, not by repository size.
Where does Cybe Analysis stand on SOC 2 and GDPR?
GDPR compliance is effective today. The SOC 2 Type II audit is under way and we expect the report shortly. We ship the attestation under NDA the day it is issued. Data residency is hard either way: EU customers run on the EU region, US customers on the US region, and findings never cross regions. Self-hosted deployments are available for highly regulated environments.
What is the Security Code Knowledge Graph?
The Security Code Knowledge Graph is CybeDefend's unified representation of your codebase as a queryable property graph. Every source file, function, data flow, dependency, infrastructure resource and secret reference becomes a node; their relationships (call edges, taint-flow edges, import edges, exploit paths) become typed edges. When a scan runs, we query this graph rather than pattern-matching on raw text, which is why we catch multi-file taint paths, cross-service business logic flaws, and reachable CVEs that single-file SAST misses entirely. The graph is computed once per repository and updated incrementally on each agent diff, keeping P95 query time under 1.2 seconds on 100k-LOC repos. It also powers deduplication across SAST, SCA, IaC, container and secret findings, one graph, one source of truth, zero duplicate alerts for the same underlying flaw.