Powered by
Powered by
The AI security reviewer for AI-written code. Vybscan scans every PR, push, and dependency for vulnerabilities, insecure code, secrets, and license risk, right inside GitHub.
Dependencies and first-party code, checked in parallel: no CI to edit, no tokens to manage.
An LLM pass flags injection, auth, SSRF, and insecure crypto.
AWS keys, API tokens, and private keys, before they land.
Flags GPL, AGPL, SSPL copyleft before it taints your code.
npm, PyPI, Go checked against OSV and GitHub Advisory.
Prioritises the vulns your code actually reaches.
Impostor packages via typos, homoglyphs, combosquats.
Infrastructure-as-code and container configuration posture.
Fast pattern-matching for JS, TS, Python, and Go.
Org-wide findings with history, trends, and FP control.
Vybscan runs the whole loop: no gaps between scans.
Deps + code, in parallel.
Your choice, per repo via vybscan.yaml.
New CVEs after merge.
Every finding, one view.
Setup, language coverage, merge behaviour, and what happens to your code.
Vybscan is a security reviewer for AI-written code. It installs as a GitHub App and scans every pull request and push for insecure code, vulnerable dependencies, hardcoded secrets, infrastructure-as-code and container misconfiguration, licence risk, and typosquatted packages. There is no CI pipeline to configure and no tokens to manage.
Vybscan is free to install from the GitHub Marketplace, and the free tier covers one repository. For additional repositories or an organisation-wide rollout, get in touch at contact@dheemai.com.
Code scanning covers JavaScript, TypeScript, Python, and Go today. Dependency scanning covers npm, PyPI, and Go modules, checked against the OSV database and the GitHub Advisory Database. If your team needs a language that is not on that list, tell us and we will add it.
That is your choice, set per repository. Add a vybscan.yaml file at the root of the repository to decide whether Vybscan blocks the merge automatically when it finds an issue, or simply posts its findings as a comment on the pull request and lets the team decide.
Yes, when AI-assisted SAST is enabled. Selected source files and the context around candidate findings are sent to a commercial coding LLM for analysis. Everything else, including dependency scanning, secrets detection, licence checks, and the Semgrep rule pass, runs without sending your source anywhere. If you do not want any code sent to a model, you can turn off the AI review and keep the rest.
For code review: selected file paths, source code with line numbers, up to 100 prioritised files by default, and the source context around candidate vulnerabilities. For dependency analysis: package names, versions, ecosystems, registry metadata, install scripts, and publisher and maintainer information, most of which is public registry data. Findings, remediation text, and check results go back to GitHub.
No. Vybscan uses a commercial coding LLM under API terms where inputs and outputs are not used to train the provider's general models, and are normally deleted within 30 days. Exceptions apply for legal obligations and usage-policy enforcement, and content flagged for policy violations may be retained longer. Teams with stricter requirements should ask us about a zero-retention configuration, or turn off AI analysis entirely.
Yes. Turn off the AI review and Vybscan still runs Semgrep rule-based code scanning, dependency scanning against OSV and the GitHub Advisory Database, secrets detection, infrastructure-as-code and container checks, licence compliance, and typosquat detection. You lose the AI code review pass, not the rest of the product.
Vybscan stores your GitHub organisation and repository identifiers, installation and scan metadata, your package inventory, findings and remediation details, and pull-request information such as number, title, branch, requester, and commit SHA. Source code copied temporarily to run Semgrep is deleted once the scan finishes. On the pull-request path Vybscan generally keeps finding metadata only and fetches code snippets from GitHub when you open the report. Ask us for current retention details.
Findings can be dismissed, and a dismissal is remembered so the same finding does not reappear on later scans of that repository. Reachability analysis also reduces noise up front by prioritising the vulnerabilities your code actually reaches over ones sitting in parts of a dependency you never call.
Vybscan rescans daily, so a vulnerability disclosed after your code merged still surfaces. A scanner that only runs at merge time cannot catch an advisory published the following week.
Yes. Slopsquatting is when an attacker registers a package name that AI models invent, so that the next developer whose model suggests the same name installs the attacker's code. Vybscan screens the package names in every pull request and push for invented and typosquatted names, and checks the dependencies themselves against OSV and the GitHub Advisory Database. We explain the attack, the research behind it, and the documented cases in What is slopsquatting, and how do I protect against it? on the Dheemai blog.
On a small repository, reviewing your own code, a frontier model with repository access is competitive with Vybscan and sometimes better. What it cannot do is check dependencies against advisory data it does not have, read a codebase bigger than its context window with a disclosed selection, keep findings persistent across runs, or run on every pull request without anyone asking. We measured this on our own scans, including an experiment that went against us, in Why not just use the model? on the Dheemai blog.
On the XBOW validation benchmarks, in the version ZeroPath prepared and published with its own scores, Vybscan found 82.9% of the technical vulnerabilities, ahead of ZeroPath (80.0%), Semgrep (57.1%) and Snyk (40.0%). On business-logic vulnerabilities it found 87.5%, level with ZeroPath, where rule-based tools find almost none. Only findings the Vybscan dashboard shows as confirmed are counted. The full results are in Vybscan on independent security benchmarks on the Dheemai blog.
On the open RealVuln benchmark, with missing labels corrected for all ten scanners, Vybscan ranks 3rd of 10 on precision for the community apps and 4th for the SaaS apps, at about one-eighth the cost of the leaders. Three scanners find more of RealVuln's labelled bugs. On real code, Vybscan found 33 of 36 known bugs in Cal.diy and 68 of 80 in OWASP Juice Shop. The full results are in Ten security scanners on RealVuln, scored fairly on the Dheemai blog.
We wrote a detailed comparison of eleven SCA and SAST platforms, covering pull-request workflow, dependency risk, code scanning depth, and the operational work each one creates. It is on the Dheemai blog and links from the foot of this page.
Tested on benchmarks built by others: 82.9% of technical bugs found, 87.5% of business-logic bugs.
Precision, recall and cost for ten scanners, with missing labels corrected.
Why we favour recall, and how it measures on three codebases.
Install in 30 seconds. The free tier covers one repository.