Live webinarWebinar with Jason Lee, Tue, Oct 13Your newest insider is an AI agent.Jason LeeFormer CISO, Zoom & SplunkRegister

Talk to your repo. Ship the safe version.

Ask a security question in your IDE; your own code answers.

Try the CloudBook a 30-min walkthrough
  • Claude Code
  • Cursor
  • Windsurf
  • Visual Studio Code
  • JetBrains
  • GitHub Copilot
  • OpenAI Codex
  • GitHub
Cybe Championstorefront main

you: What is the riskiest flaw in /api/auth right now?

HighRefresh token lands in localStorage
Reachable findings only

Three questions, answered in your code.

api/login.tsCybe Champion
  res.cookie("sid", session.rotate(user));  res.json({ refresh: token.issue(user) });

Cybe ChampionCWE-352A01

  • Session: rotates SID on login. Solid.
  • CSRF: no double-submit on POST /api/login.
  • Refresh token persisted in localStorage on the SPA.

Start with one repository.

Connect GitHub, GitLab, Bitbucket or Azure DevOps, pick a repository, and the first scan starts.

Try the CloudBook a 30-min walkthrough

In detail

Your rules, mined from your own code.

It drafts the rules your code already follows. You approve them.

  1. 01It reads your code.
  2. 02It drafts the rules.
  3. 03You accept, edit or reject.
Rules drafted from your codestorefront
  • 01 Multi-tenancyEvery query on db.orders filters by tenantIdAccepted42 of 43 occurrences, 16 files, confidence 94%src/handlers/export.ts:17does not comply
  • 02 Authorisation ceilingRefunds over €300 require the role finance.managerEdited7 of 8 occurrences, 4 files, confidence 87%src/handlers/refund.ts:22does not comply
  • 03 Audit loggingEvery payment mutation writes audit.log(actor, amount)Waiting for review31 of 34 occurrences, 11 files, confidence 91%src/handlers/payouts.ts:54does not comply
The three answers in full

Ask a security question in your IDE, and the answer comes from your own code, with the line and the fix.

Ask, and watch what the Champion does with it.

Cybe Championstorefront main

you: What are the top 3 risks in /api/auth this month?

Searched the knowledge graph/api/auth

Three reachable risks, the most severe first.

HighRefresh token lands in localStorageapi/login.ts:15CWE-922reachable from POST /api/login
MediumNo CSRF check on the login formapi/login.ts:12CWE-352reachable from POST /api/login
LowPassword reset reveals which emails existapi/auth/reset.ts:19CWE-204reachable from POST /api/auth/reset

Show the patchapi/login.ts

Reachable findings only

  • Is this login handler safe?

    It reads the graph, not the diff. The session rotates, the CSRF check is missing, the refresh token lands in localStorage. It points at line 15.

  • Fix it for me.

    It rewrites the line in your idioms: an httpOnly, SameSite cookie, and the test that proves it. You accept the diff.

  • Make sure it never comes back.

    The fix becomes a rule, enforced in Claude Code, Cursor and CI on every next turn.

Zero YAML. Your rules, mined from your own code.

The Champion reads your repo, drafts the rules your code already follows and points at the lines that break them.

Already live in Cybe Champion.

Not AI bolted onto a 2015 SAST.

  • Risk surfaced before the PR

    Hot spots, drifting controls, missing tests. The Champion flags them in the IDE while the code is being written.

  • Patch suggestions the agent can apply

    Every finding ships with a working fix the agent can stage. One-click PRs, signed by your bot, gated by your CI.

  • Org-wide security intelligence

    Every accepted fix and every confirmed verdict feeds the graph. The org builds compounding security IP, not a stack of policies.

From training calendar to learning by doing.

Annual OWASP workshops don't move the needle. Inline explanations on every PR do.

  • Every dev gets the senior treatment

    Plain-English rationale on every finding, OWASP/CWE references one click away. Junior or staff, same depth, same patience.

  • Security context inside the loop

    No more 'wait for the security team to weigh in'. The Champion answers in the IDE, with a working fix, before the dev moves on.

  • Lessons land in the editor, not in a calendar invite

    The 'why' is explained inline, with a working example, the moment the dev would have shipped the bug. No quarterly workshop catches up to that timing.

One question, one rule

  • You ask, in the IDE

    Vulnerabilities, fixes, threat models, OWASP. In your own words.

  • It answers in context

    It reads the knowledge graph and points at the line, with a fix.

  • The answer becomes a rule

    Every accepted fix is enforced in the agent, on every next turn.

Your code stays in your region.

Models we host ourselves, and nothing crosses the regional boundary.

Where your code livesEUUS
  • Standard scanCloned into an isolated container, destroyed when the scan ends.
  • Cybe Analysis and the Security ChampionKeep a copy of the code, its git history and a knowledge graph in your region, deleted on request.
  • ModelsOpen-weight models we host in your region: Scaleway in the EU, Google Cloud in the US.
  • Third-party AINo code and no prompt is sent to a third-party AI API.

GDPR compliant. SOC 2 Type II audit under way.

Security and privacy, engineered in.

Privacy by default. Self-hosted AI models, no third-party LLM API, the EU or US region you pick at install, VPC or air-gapped deployment available.

  • EU + US data regions

    Your code stays in your region. EU customers run on EU infrastructure end-to-end, US on US.

  • No training on your code

    Models are self-hosted. Customer code is never used to train shared models. Ever.

  • On-premise & air-gapped

    Regulated industries can pin the entire stack inside their own infrastructure. The same Champion runs in your VPC or fully air-gapped, with the model weights bundled, no outbound calls.

What teams ask before they install

Does Cybe Security Champion replace our human security team?
No. It replaces the bottleneck the human team has become. Champion handles the per-PR review, the in-IDE 'is this safe?' question, the OWASP explanation. The security team focuses on architecture, threat modelling, incident response. The work that needs human judgement.
How is this different from GitHub Copilot or generic AI coding assistants?
Copilot writes code. The Champion is the senior engineer who reviews it. It reads your code knowledge graph (taint flows, owners, framework conventions) instead of guessing from a generic LLM. Same prompt, very different answer.
Which IDEs and agents are supported?
Native plugins: VS Code, Cursor, Windsurf, JetBrains, Antigravity. Native MCP server: Claude Code, Gemini CLI, Cline, Continue.dev, Zed. Generic MCP for everything else. One install per dev, one license per team.
Will VibeDefend ever train models on our code?
Never. Models are self-hosted, weights are owned by CybeDefend, and your code is processed in your tenant only. No customer code is used to train shared models. That's a contractual commitment, not a setting.
What does it take to get our team running?
Three steps for the first developer: SSO sign-in, install the IDE plugin, point it at the repo. The Champion produces its first contextual review on the next save. No YAML, no playbooks to write.