proof of exploitation,
not probability.
point it at your repo. 52 tools, 14 agents, six phases, one critical chain — all without a human in the loop.
six specialized agents. fifty-plus tools. every scan runs the same deterministic sequence — from recon through to proof-of-exploit.
scroll to trace each phase ↓every scan runs through six phases. scroll to trace one.
White-Box + SAST
Seven SAST engines plus a whitebox LLM reviewer read the repo, emit hypotheses, and seed every later phase with ground truth.
- agentwhitebox-reviewer— reads diffs + whole-repo context, emits ranked hypotheses with file:line anchors
- toolsemgrep— taint + pattern rules (p/owasp-top-10, p/python, p/javascript)
- tooltrivy— dependency + container + IaC scanning
- toolbandit— python AST · weak crypto, subprocess, yaml.load
- toolgosec— go AST · hardcoded creds, unsafe exec, TLS config
- toolcheckov— terraform / cloudformation / k8s manifests
- toolnjsscan— node.js + express insecurity patterns
- toolgitleaks— commit-history secret scan (depth=500)
1Finding {2 id: "F-01",3 kind: Vuln::SqlInjection,4 verdict: Verdict::Hypothetical,5 source: Source::Whitebox,6 anchor: "payments/query.py:142",7 evidence: "semgrep ▸ tainted-sql-format",8 cvss_est: 7.5,9}
most scanners report individual vulnerabilities. sekura maps how they chain together — because a breach is never just one thing.
scroll to reveal the chain ↓the chain is the finding.
sast and dast stop at the hypotheses. sekura keeps walking — and turns a handful of medium findings into the thing that actually keeps a ciso up at night.
stop reading. start scanning.
paste a public github repo. we'll run phase 1 — whitebox + sast, seven engines, zero traffic to your target — and stream findings as they land.