GDPR · NIS2 · EU AI Act · DORA · PCI DSS · SOC 2 · ISO 27001

bryxe — deep scan

$ bryxe scan ./my-app --deep

Layer 1 · static patterns (20+ languages)

CRITICAL SQL injection via $queryRawUnsafe (api.ts:42)

CRITICAL Python pickle.loads on user data (worker.py:17)

CRITICAL Stripe live key in source (lib/pay.go:8)

Layer 2 · offensive AI audit

HIGH SSRF → IMDS chain on /api/preview

HIGH IDOR → admin escalation via mass-assign role

HIGH JWT alg confusion — no algorithms whitelist

Layer 3 · CVE database (300,000+)

HIGH log4j-core@2.14.1: CVE-2021-44228 (Log4Shell)

Layer 4 · EU compliance

MISSING GDPR Art. 17: erasure endpoint

MISSING NIS2 21(2)(j): MFA required

Done in 47s · 52 findings · GDPR 41% · NIS2 38%

The security
scanner built
for code shipped
by AI.

Four detection layers across 20+ languages: 350+ vulnerability patterns including a dedicated pack for the vibe-coding stack (Supabase RLS, Next.js, Stripe, Vercel AI SDK, Clerk, Drizzle, Expo), 300,000+ CVEs, an offensive-security AI auditor, and 7 EU compliance frameworks. One scan, under a minute.

Cursor · ChatGPT · Claude · v0 · Lovable · Copilot

Scan my code free How it works

Detect. Fix. Re-scan.

Concrete patterns Bryxe detects and the minimal patch it generates. Every fix is a real diff you can preview before applying.

criticalSQL injection via string concatenation

Rule SQL-TEMPLATE · OWASP A03:2021

Detected

app.post('/login', async (req, res) => {
  const { email, password } = req.body;
  const user = await db.query(
    `SELECT * FROM users
     WHERE email = '${email}'
     AND password = '${password}'`
  );
});

Patch

app.post('/login', async (req, res) => {
  const { email, password } = req.body;
  const user = await db.query(
    'SELECT * FROM users WHERE email = $1',
    [email]
  );
  const valid = await bcrypt.compare(
    password, user.password_hash
  );
});

User input interpolated into a SQL template literal. Bryxe detects the pattern and rewrites the query with parameter binding plus bcrypt password compare.

Try it on your own code

Try it now — no signup required

Paste your code. See vulnerabilities.

Drop any code snippet below and watch Bryxe find security issues in real-time. This is a preview — the full scan runs 4 layers: 350+ regex patterns, AI deep audit, 300K+ CVEs, and 7-framework EU compliance.

Live Scanner

Issues Found

Paste code or load example
to start scanning

Threat Atlas

Every attack vector.
One scanner.

Bryxe maps your codebase against 350+ vulnerability patterns plus an offensive-security AI auditor that reasons about attack chains, not just flat findings. From the obvious mistakes to multi-step exploits no regex catches.

55+

patterns

Injection

Every shape AI emits — concatenated SQL, template strings, eval()-on-model-output, pickle, ObjectInputStream, command, NoSQL operators, XXE.

SQL · NoSQL
Command
XSS variants
Deserialization
Template / SSTI
Path traversal

25+

patterns

Access Control

The single biggest class of AI-generated bugs — auth checked on GET but not PATCH, ownership predicates missing, role checks in the wrong layer.

IDOR
Mass assignment
tRPC public mutations
Client-side auth
Server actions w/o auth
Horizontal escalation

40+

patterns

Secrets

Live API keys committed to repos, NEXT_PUBLIC_ leaks, service_role in client bundles, weak/default JWT secrets ('supersecretkey').

AWS · Stripe · OpenAI
Anthropic · Google
GitHub · GitLab · npm
Slack · SendGrid · Resend
PlanetScale · Supabase
Weak/default values

10+

patterns

AI / LLM

Emerging class — prompt injection via user input, missing max_tokens (LLMjacking), API key in browser, agent tools wrapping exec/eval.

Prompt injection
No max_tokens (cost DoS)
Key in client bundle
Missing rate limit
Agent tool → RCE
eval(model output)

patterns

SSRF

fetch/axios/got/ky/needle/superagent with user-controlled URLs, file:// / gopher:// smuggling, cloud-metadata IPs, DNS rebinding, stored webhook URLs.

fetch / axios / got
file / gopher / dict
169.254.169.254
DNS rebinding
Stored webhook URLs
Redirect-chain bypass

35+

patterns

Vibe Stack

Dedicated pack for the AI-builder stack — what Cursor / v0 / Lovable / Bolt actually ship that other scanners miss.

Supabase RLS · service_role
Stripe webhook · price-from-body
Next.js server actions
Drizzle / Prisma footguns
Clerk / Auth.js gaps
Vercel AI SDK / OpenAI

Plus 300,000+ CVEs via OSV.devAST taint analysis across JS / TS7 EU compliance frameworks20+ languages

4-Layer Detection

From code to certification

One scan. Four detection layers. Seven EU compliance frameworks. Ship secure code, prove it to your customers, and pass your audit without hiring a consultancy.

Layer 1 · Static Pattern Engine

320+ hand-curated patterns across 20+ languages: JS/TS, Python, Go, Rust, Java, C/C++, PHP, Ruby, .NET, Swift, Kotlin, Shell, plus IaC (Docker, Terraform, K8s, GitHub Actions). Includes a dedicated vibe-stack pack: Supabase RLS, Next.js App Router, Stripe webhooks, Vercel AI SDK, Clerk, Drizzle, Expo.

OWASPCWE-2520+ langsVibe-stackSecrets

Layer 2 · AST Taint Tracker + Offensive AI

Real dataflow analysis on JS/TS via @babel/parser — tracks user input from req.body / searchParams through variables into SQL / shell / fetch / eval sinks. Combined with Claude primed as a senior offensive-security engineer hunting attack chains: SSRF→IMDS→AWS takeover, IDOR→admin escalation, prompt injection, OAuth flaws.

AST taintAttack chainsIDORSSRFPrompt-inj

Layer 3 · CVE Database

Every dependency matched against 300,000+ known CVEs from OSV.dev. npm, PyPI, RubyGems, Go, Maven, NuGet, crates.io — all covered.

300K+ CVEsOSV.devAll ecosystems

Layer 4 · EU Compliance

Readiness scores for GDPR, NIS2, EU AI Act, DORA, PCI DSS, SOC 2, and ISO 27001 — 64 mapped requirements with article references.

GDPRNIS2AI ActDORASOC 2

AI Auto-Fix

Claude generates minimal patches. Preview the diff, ship the fix, or open a PR straight to GitHub. Critical issues fixed in one click.

Diff previewBatch fixGitHub PR

Your Own Rules + External Engines

Add custom regex rules from /settings/rules and they run on every scan alongside the 320+ built-in patterns. Opt-in plug-in for Semgrep (5000+ community rules) and Trivy (container CVE scans) via a small companion worker — Dockerfile shipped in the repo.

Custom regexSemgrepTrivyCompanion worker

Certified Output

PDF audit report. Embeddable security badge. Public profile. Article-by-article compliance evidence for your auditor or VC.

PDF reportSVG badgeAudit-ready

How it works

Four steps from vulnerable code to verified security. Under 60 seconds.

Upload

Drop a .zip, paste a GitHub URL (public or private), or scan a live URL. 20+ languages supported: JS/TS, Python, Go, Rust, Java, C/C++, PHP, Ruby, .NET, Swift, Kotlin, Shell, plus IaC.

Scan

4 detection layers in parallel: 280+ static patterns, offensive AI auditor (attack chains + logic flaws), 300K+ CVE check, EU compliance grading.

Fix

AI generates minimal patches. Preview diffs, apply one-by-one or batch-fix all critical issues into a GitHub PR.

Certify

PDF audit report, public security badge, and 7-framework EU compliance evidence — ready for VCs and auditors.

Built for code shipped from

CursorChatGPTClaudev0LovableBoltCopilotReplit

Detection

350+ patterns

OWASP Top 10 · CWE Top 25 · vibe-stack pack

Languages

20+ languages

JS · TS · Python · Go · Rust · Java · C/C++ · PHP · Ruby · .NET · Swift · Kotlin · Shell · SQL · IaC

CVE database

300,000+ CVEs

via osv.dev — npm, PyPI, Go, Maven, Cargo, NuGet, RubyGems

Compliance

7 frameworks

GDPR · NIS2 · AI Act · DORA · PCI · SOC 2 · ISO 27001

Pricing

Pay once. Or get continuous support.

One-time scans for one-time problems. Monthly subscription only if you want continuous monitoring and alerts.

One-time

Free Scan

See what's wrong. No signup for the first scan.

145 regex patterns + 300,000+ CVEs
First 10 issues visible
Security score + severity breakdown
Public security badge

Start Free Scan

Audit

$49

Full audit — see every issue. One project.

Everything in Free
All findings unlocked
AI Deep Audit (logic flaws)
OWASP / CWE references
PDF security report

Get Audit

Audit + FixMost popular

$199

Audit + AI auto-fix the issues for you.

Everything in Audit
AI auto-fix all issues
Diff preview before apply
Re-scan after fixes
Embeddable security badge

Get Audit + Fix

EU Compliance

$349

Audit + Fix + audit-ready compliance report.

Everything in Audit + Fix
GDPR · NIS2 · AI Act · DORA
PCI DSS · SOC 2 · ISO 27001
Article-by-article evidence
Export bundle for your auditor

Get Compliance

Ongoing support

Ongoing Shield

$79/ month

Continuous protection on every git push.

Auto-scan on every push / PR
Auto-fix critical issues via PR
New CVE alerts in Slack / Discord
Monthly compliance drift report
Cancel anytime

Start 14-day Trial

Enterprise

Custom

For teams of 10+ developers.

Everything in Ongoing Shield
SAML / Okta SSO + RBAC
Dedicated workspace + custom rules
API access · CI/CD integration
99.9% SLA · priority support

Talk to Sales

All one-time purchases include 30-day money-back guarantee. Subscriptions cancel anytime.

Scan your code now

First scan is free. ZIP, GitHub URL, or paste a snippet. See exactly what your AI shipped — and how to fix it.

Start free scan See pricing

Source code processed in memory · deleted after the scan completes.

The securityscanner builtfor code shippedby AI.

Detect. Fix. Re-scan.

Paste your code. See vulnerabilities.

Every attack vector.One scanner.

Injection

Access Control

Secrets

AI / LLM

SSRF

Vibe Stack

From code to certification

Layer 1 · Static Pattern Engine

Layer 2 · AST Taint Tracker + Offensive AI

Layer 3 · CVE Database

Layer 4 · EU Compliance

AI Auto-Fix

Your Own Rules + External Engines

Certified Output

How it works

Upload

Scan

Fix

Certify

Pay once. Or get continuous support.

Scan your code now

The security
scanner built
for code shipped
by AI.

Every attack vector.
One scanner.