↑
Request a pilot
Beta release · Available now

agentred/code

Every file. Every dependency.

AI-assisted security review that follows risk from your code into its dependencies and CI/CD pipelines, with coverage you can measure.

Request a controlled pilot How deep it goes
lookup/runner.py.github/workflows/release.ymlrequirements.txtIllustrative finding
12def run_lookup(username: str):13    timeout = settings.LOOKUP_TIMEOUT−    cmd = ["lookup", username, "--timeout", timeout]+    cmd = ["lookup", "--timeout", timeout, "--", username]15    return subprocess.run(cmd, capture_output=True)

CASE / Sherlock, open-source OSINT platform

37/37files reviewed
6,386lines of code
31review batches

The review followed critical paths into CI/CD supply-chain exposure and argument injection, not just the primary code paths.

Depth

Five layers deep.

Most code review stops at the application. Agent Red keeps going until it reaches the release.

  1. L1Code

    Your application logic, reviewed in tracked batches so every file is accounted for.

  2. L2Dependencies

    Vulnerable and risky packages, weighed against how your code actually calls them.

  3. L3Secrets

    Keys, tokens, and credentials committed to source, config, or history.

  4. L4CI/CD

    Workflow definitions checked for injection, over-privileged tokens, and unsafe triggers.

  5. L5Supply chain

    Build and release paths that could let an attacker reach your users through your own tooling.

Questions

Code review, answered.

Which languages are supported?

Tell us your stack when you request a pilot. Language and framework support is confirmed during scoping, before any review starts.

Do you need write access?

No. Read access to the repositories in scope is enough. Findings and suggested fixes are delivered in the report.

How is coverage measured?

Every file in scope is tracked through review, so the report states exactly what was and wasn’t analyzed.

One platform

Explore every surface.

01

Web & APIs

Application and API penetration testing across the paths attackers actually use.

02

Source code

AI-assisted security review that follows risk across code, dependencies, and CI/CD.

03

Cloud

Cloud posture and misconfiguration assessment across AWS, Google Cloud, and hosts reached over SSH.

  • AWS
  • Google Cloud
  • SSH
04

Mobile

Static and dynamic mobile security analysis aligned to real application behavior.

Put your repository under review.

Request a controlled pilot