Code and data flows
Injection, command execution, unsafe deserialization, XSS, paths and other vulnerable patterns. Rules and data tracking within a file, with locations and context to review each finding.
Code Security
Your code moves forward. So does your security.
From your editor to your entire team. Find risks, understand their impact and prepare AI-assisted fixes without breaking your workflow.
AVAILABLE NOW
ORYON CODE SECURITY
Detect earlier. Decide with more context.
Code, dependencies and configuration connected with the context your team needs to fix, review and keep moving.
- Code
- Packages
- Configuration
Oryon Code
- Findings with context
- AI-assisted changes
- History and reports
Everything around a line of code.
From the first finding to the fix. One analysis connects risks in code, packages, credentials and configuration with your team's work.
Dependencies and updates
Package inventory, known vulnerabilities, CVE/GHSA identifiers and fixed versions. Distinguishes patch, minor and major changes and prepares guidance for migration review.
Secrets and infrastructure
Exposed credentials and unsafe settings in Terraform, Bicep, Kubernetes, Docker and pipelines. Review what your repository declares before it reaches production.
AI applications and MCP
Rules for prompt injection patterns, model outputs reaching execution, dangerous tools, exposed keys and agent permissions. Also reviews MCP configurations, hooks and instruction files.
Quality and compatibility
Correctness, maintainability, performance and deprecated API patterns. Compatibility review notes for configured targets and additional guidance when a dependency changes major version.
From context to change
AI-assisted explanations and proposed fixes, shared suppressions, issue drafts and reports. Your team reviews the change and decides when to apply it.
Languages and formats
Coverage depends on the language, rules and profile. Templates and configuration may use generic rules; the analysis shows limitations and partial results.
- Code
- JavaScript / JSX · TypeScript / TSX · Python · Java · C# / .NET · Go · PHP · Ruby · Rust · Kotlin · Swift · Scala · C / C++ · Apex · Solidity · Bash · Elixir · Clojure · OCaml
- Templates
- Vue · ERB / RHTML · EJS · Handlebars / HBS · Mustache · Nunjucks / NJK · Pug / Jade · Jinja / Jinja2 / J2 · FreeMarker · Velocity · Liquid · Twig · JSP / JSPX · PHP / Blade · EEx / HEEx
- Configuration
- Terraform (AWS / Azure / GCP) · Azure Bicep · AWS JSON · Kubernetes · Dockerfile / Containerfile · Compose · GitHub Actions · GitLab CI · Azure Pipelines · Bitbucket Pipelines · CircleCI · CI / Jenkins · Argo · OpenAPI / Swagger · Nginx · Gradle · Visualforce
- Package ecosystems
- npm / Yarn / pnpm · Python / pip / Pipenv / Poetry / uv · Ruby / Bundler · PHP / Composer · Rust / Cargo · Go · JVM / Maven / Gradle / Leiningen · .NET / NuGet · Dart / Pub · Elixir / Mix
What it analyzes. Which engine does it.
OpenGrep and OSV provide detection. Oryon's layers add context, compatibility, assistance and a shared view of the results.
Specialist engines. Shared power.
-
OpenGrep
-
OSV-Scanner
-
MDN
Oryon
Code, secrets and configuration
Local detection across the project's files.
-
OpenGrep + Oryon rules
- Static analysis of code, secrets, infrastructure, pipelines and AI/MCP security. Combines patterns with data tracking within each file. Profiles and exclusions adapt the scan to the repository.
Packages and versions
From inventory to affected versions and their fixed alternatives.
-
OSV-Scanner / OSV-Scalibr
- Extends the inventory of packages and their relationships from the repository, including Maven projects. Automatically attempted in the extension and CI; native analyzers provide a fallback when it is unavailable.
-
Oryon analyzers + OSV API
- Extract packages and versions and check them against OSV security advisories. Connect CVE/GHSA identifiers, severity, descriptions and fixed versions to give each finding a concrete next step.
-
Oryon update analysis
- Classifies advisory fixed versions as patch, minor or major updates. Highlights large jumps and prepares migration review steps, without automatically changing dependency files.
Context and decisions
Help to understand, review and communicate the work ahead.
-
OpenAI · fix assistance
- Explains causes, risk and impact and proposes changes, diffs, effort and verification checks. Available according to plan and configuration; the user reviews and applies the proposal in the editor.
-
Oryon AI triage · two-stage review
- Optional and off by default. A first review proposes dismissing false positives and a second checks the evidence. Findings are retained on uncertainty or failure. Uses OpenAI models.
-
MDN Browser Compat Data + Oryon catalog
- Looks up browser support for String.replaceAll and supplies review notes for APIs, runtimes, frameworks and tools based on configured targets. Checks are specific to each rule.
-
Pro report synthesis · OpenAI
- Turns stored results into executive priorities, business exposure and an action plan in the Pro PDF. Summarizes evidence and assessment limits; it does not run another scan.
Static analysis runs locally. Dependency inventories and lookups may use external services; AI features send requested code context to the configured provider.
Oryon Dashboard
One shared view. Clearer decisions.
Engineering and security work from the same context. Compare scans, follow risk over time and share audit reports from one platform.
0:00
The video could not load. Reload the page to try again.
Explore the platform in detail
Audit Traceability
Scan history, suppressions with author and date, and API operation logs to review project activity.
Workspace Access
Google, Magic Link, and SSO flows tied to company-scoped roles.
Multi-Tenant Isolation
Projects, scans, and findings stay partitioned by company by design.
Bulk Ingest API
Create projects and scans or sync findings and dependency data from IDE or CI.
Editor, CI and platform. Shared context.
One workflow for the person fixing the code, the person reviewing a release and the person tracking the team's security progress.
In the editor
- Scan as you edit or save, or start a file or repository scan; configure profiles and exclusions.
- Filter results, open their locations and review severity, context and CWE/OWASP where supplied by the rule.
- Review AI explanations and proposed fixes and explicitly apply the change.
- Mark or restore shared false positives; export JSON/CSV and prepare GitHub or GitLab issues.
- Link the repository to a project and switch organization or workspace.
With every delivery
- Run the same analysis core from GitHub Actions and Azure Pipelines, with OIDC and a project token.
- Publish JSON results and a Markdown summary; export code findings in SARIF.
- Configure a severity threshold to stop the pipeline when your team chooses; it is off by default.
- Reuse project suppressions and control result uploads and AI use.
For the whole team
- Organize projects and review results by severity, technology and status.
- Compare scans to distinguish introduced, resolved and persistent findings, and severity or version changes.
- Review history, false positives and complete, partial, failed or unverified coverage states.
- Download PDF audit reports and CSV exports of code and dependency findings.
- Manage invitations, administrator, manager, developer or viewer roles and SSO/OIDC options according to configuration.
In the tools you already use.
Editor, repository and platform connected to your workflow.
VS CodeCursorAntigravityVSCodiumWindsurf
GitHub
GitLab
Each integration has its place.
Extension for VS Code-compatible editors. GitHub and GitLab let you open issue drafts with the finding's context.
GitHub Actions and Azure Pipelines run analysis in CI. Docker, Kubernetes, Terraform and other pipeline files are analyzed as part of the repository.
