Skip to content
Opsec

Code & application security

The code agent follows untrusted input from the edge of your application to the sink, across services and frameworks, and only reports paths it can actually walk.

Request accessHow validation works

Coverage

  • TypeScript
  • Python
  • Go
  • Java
  • Kotlin

What it finds

Vulnerability classes, confirmed.

  • Confirmed class

    Broken authorization

    Missing ownership checks, tenant leaks and privilege escalation through overlooked routes.

  • Confirmed class

    Injection

    SQL, NoSQL, command and template injection traced through ORMs and helper layers.

  • Confirmed class

    Server-side request forgery

    Outbound requests built from user input that can reach metadata endpoints or internal services.

  • Confirmed class

    Unsafe deserialization

    Gadget chains and type confusion in serializers, message queues and caches.

  • Confirmed class

    Secrets & crypto misuse

    Hard-coded keys, weak randomness, unauthenticated encryption and token handling mistakes.

  • Confirmed class

    Business logic flaws

    Race conditions, replayable actions and state machines that can be driven out of order.

Validation

Nothing is reported until it is proven.

  1. Step 1 / 3

    Build a replica

    Opsec boots the affected service from your build definition with synthetic data and test credentials.

  2. Step 2 / 3

    Drive the path

    The agent issues the requests an attacker would, recording each hop from entrypoint to sink.

  3. Step 3 / 3

    Prove impact

    A finding is kept only when the replica returns data or performs an action it should not.

Example finding

What lands in your queue.

Each finding carries the exploit path the validator walked and the repair it verified.

TSR-2342billing-apisrc/routes/invoices.ts
High

Missing ownership check on invoice download

CWE-639 · Code & application agent · Exploitability 8.6

Exploit path

GET /invoices/:id loads the invoice by primary key only. Any authenticated user can enumerate IDs and download invoices that belong to other tenants.

Why the fix works

Scopes the lookup to the caller’s organization so a foreign ID returns 404 instead of the record. No response shape changes.

Generated repair
router.get('/invoices/:id', async (req, res) => {
  const invoice = await db.invoice.findUnique({ where: { id: req.params.id } })
  const invoice = await db.invoice.findFirst({
    where: { id: req.params.id, orgId: req.session.orgId },
  })
  if (!invoice) return res.sendStatus(404)
  • Cross-tenant request now returns 404
  • Route test suite passes (98)
  • No added queries per request

Other solutions

See what's exploitable in your environment.

Opsec is available to a limited number of security teams. Request access and we'll scope a private deployment with you.

Request accessBook a briefing