Security assessment platform
Find security weaknesses
before attackers do.
Scan your source code for risky patterns, leaked secrets and configuration mistakes, on your own device. Get clear, actionable reports to protect what you build.
No ZIP to hand? with planted flaws to see a full report.
- 54Deterministic rules
- 0 bytesUploaded from your device
- 100 MBLargest archive accepted
- 3 formatsMarkdown, JSON, SARIF
- No AI model.
Rules you can read.
Security coverage
Security coverage in one platform.
From code to deployment, uncover risks, harden your software and reduce your attack surface.
Source Code Security Active
Flags eval, injection sinks, unsafe deserialisation and disabled TLS checks.
Reverse-Engineering Planned
Exposure, debug artifacts, symbols and weak protection in release builds.
Exposed Secrets Active
Finds API keys, tokens, passwords and private keys, always redacted.
Dependencies Active
Lists packages and flags unpinned or off-registry ones.
Infrastructure Active
Docker, Kubernetes, Terraform and CI configuration risks.
Website Security Planned
Misconfiguration checks for sites you are authorised to assess.
AI-Agent Security Planned
Agent integrations, exposed tools and unsafe permissions.
The report
Every finding, mapped at a glance.
Severity, category, coverage and the files that need you first. Each chart comes from rule matches you can trace back to a line of code.
Kyber Repo
Sample report
How it works
From ZIP to fix plan, without leaving your browser.
- 01
Drop a project ZIP
The archive is read in browser memory. Unsafe paths, links and oversized entries are rejected before anything is opened.
- 02
Rules run on your device
A Rust engine compiled to WebAssembly checks each text file. No project code is executed and nothing is sent anywhere.
- 03
Review and export
Every candidate has evidence, a rule ID and a fix. Download the report as Markdown, JSON or SARIF.
Privacy by design
Your code never leaves this tab.
Kyber Repo is a static page and a WebAssembly engine. The archive is opened in memory, checked and released. There is no account and no server to send it to.
-
0 network requests for your code
The page's security policy only lets it talk to its own origin, and the engine has no network access at all.
Nothing executed
Files are read as text. Scripts, builds and installers in the archive never run.
Secrets redacted
Matched keys and tokens are masked in the report and in every export.
No AI model
Every candidate comes from a readable rule with an ID, so results are repeatable.
Report formats
Reports that fit your workflow.
- .md
Markdown
Paste into a pull request, an issue or a security review.
- .json
JSON
Every field the engine produced, for your own scripts and dashboards.
- .sarif
SARIF
The standard static-analysis format, readable by code-scanning tools.
Questions
Before you scan.
Is my project uploaded anywhere?
No. The ZIP is read in your browser's memory and checked by a Rust engine compiled to WebAssembly. Closing the tab discards it.
Does "no findings" mean my project is secure?
No. It means no rule matched in the files that were checked. The report lists which checks ran, which were partial and what was skipped.
Which projects are recognised?
JavaScript and TypeScript, Python, Rust, Go, Java and Kotlin, PHP, Ruby and container setups are detected from their manifests. Rules run on source, configuration, CI and infrastructure files.
What are the size limits?
Archives up to 100 MB and 20,000 entries. Each text file is checked up to 1 MB, and up to 32 MB of text per scan.
Can I assess a website?
Not yet. The address field checks the format only and never sends a request. Remote checks will be limited to sites you own or are authorised to assess.
Scan your first project in under a minute.
Drop a ZIP, read the fix plan, export the report. No sign-up.