Contextual AI SAST: follow the data flow, not the regexes.

We cover 19 languages with a taint engine (tree-sitter grammar plus a flow walker), 14 of them in depth: sources, sanitizers and sink rules across several vulnerability classes. The most mature are Python, JavaScript/TypeScript and Java, followed by Go, PHP, Ruby and Kotlin, then C, C++, C#, Rust, Swift, Scala and Bash. On the web-framework side, we recognise the routes and entry points of Django, Flask, FastAPI, Express, NestJS, Next.js, Spring, Laravel, Symfony, Rails and ASP.NET Core, among others. Five languages (Dart, Lua, Perl, PowerShell, R) are parsed but limited to injection and path traversal, with no sanitizers: light support, which we label as such rather than oversell uniform coverage. If your stack is not in the list, write to us: we scope the perimeter before committing to anything.

Two stages. First a deterministic pre-pass: tree-sitter spots the sensitive sinks, then a taint engine walks the data flow from its source to the sink, across the functions and files of the repository. Anything with no attackable source or that passes through a sanitization step is rejected right away, without consuming a validation. Only plausible chains survive, and they then go to verification. Every finding shows its full taint chain (source, intermediate steps, sink): you see why it surfaced, not an opaque verdict.

It's a static analysis agent orchestrated with LangGraph. A supervisor routes the scan to specialised workers (SAST, SCA, IaC, secrets), and a triage agent re-reads the code findings with AST inspection tools to discard false positives. Let's be clear about one thing: SecAI does not do DAST, does not run your application and does not replay a pentest against a live target. Coverage between two human audits comes from continuous static analysis, triggered on every commit or pull request and via scheduled scans (cron per repository). No runtime, so no risk to your production.

Classic pattern-based SAST often stops at the file and drowns the team in noise. Here, multi-file taint tracking walks the real data flow, and an AI verifier kills part of the false positives before they land in your backlog. SecAI also correlates SAST, SCA with reachability, IaC and secrets in a single scan, then rebuilds attack paths. We're less exhaustive than the incumbents on exotic languages; our focus is elsewhere: triage, exploitability and correlation into attack paths. And above all, SecAI fits a pentester's logic: it extends coverage, the human keeps the final decision.

No, and that's not the goal. SecAI provides static coverage continuously between two engagements, where your code moves on every deploy. Human verification remains our pentest offering, separate, run by an OSWE-certified pentester. The SecAI report even states it explicitly: findings must be reviewed by a professional. SecAI and the own2pwn pentest complement each other, they don't substitute for one another.

On GitHub, integration is native: GitHub App plus composite GitHub Action, with Code Scanning-compatible SARIF export, a PR comment and configurable blocking beyond a severity threshold (default: fail on high severity). For GitLab, Jenkins or self-hosted runners, the path is the secai-cli (remote or local scan, SARIF/JSON output, same exit codes). GitLab is also supported as a code source (OAuth/PAT, comments and merge request opening). One limit we would rather state: the Action and the CLI are not published on public marketplaces (GitHub Marketplace, npm), they are installed by direct reference. It blocks nothing, it adds a step. If your CI chain is not on the list, write to contact@own2pwn.fr before subscribing.

Storage stays in the EU (Germany), encrypted at rest, with an implemented GDPR purge (deleting a repository or an account, data included). For analysis, the code is sent to Anthropic's Claude models served through Google Cloud Vertex AI in a European region: Google is a provider with a US parent company, covered by standard contractual clauses (GDPR). Neither Google nor Anthropic uses your data to train their models (Vertex AI data governance). Access to your repository is read-only, limited to the perimeter you define.

Yes. SecAI generates an HTML report, a SARIF export (server and CLI), and pushes the results to where your team works: PR/MR comments, Slack, webhook, email. The SARIF integrates directly into GitHub Code Scanning. If you stop, you export your reports and your data is deletable on request via the GDPR purge routes.

The free tier includes 20 AI validations per month (and up to 10 scans per day). The Pro plan includes 250 per month (up to 200 scans per day), the Team plan 750. A validation covers one unit of AI verification: the deterministic pre-pass consumes nothing, only the LLM verifier burns budget. Beyond the plan, each additional validation is billed €0.30 pay-as-you-go, aggregated on the monthly invoice, which you download along with the full history from your billing area. An estimator gives you the cost before launching a scan (based on code size and entry points), a scan that fails due to an infra incident is refunded, and usage is viewable in real time.

The product is young and the list is short enough to check, so here it is. Already working: the scan engine (deterministic then AI SAST, SCA with reachability, IaC, secrets), the LangGraph orchestration, the dashboard and the API, the validation system with estimator and refunds, the GitHub and GitLab sources, repository upload or private clone, the CLI, SARIF export, scheduled scans, multi-channel notifications, auto-fix by PR/MR, encryption at rest and GDPR purge. What does not exist and what we won't sell you: DAST, replaying a pentest scope against a live target, and pentester-signed reporting directly in the app (that is our pentest offering, separate). The best way to judge is still the free plan: 2 repositories, 20 AI checks a month, no credit card.

No minimum term. The subscription is monthly or annual (annual works out at ten months paid), renewed tacitly at each due date, and you cancel it at any time, with no justification to give: either you do it yourself from your billing area, or you write to contact@own2pwn.fr and the answer comes within 24 hours. No notice period to serve: cancellation takes effect at the end of the current billing period, and you keep access until then. In return, that period is not refunded pro rata. That is not a sales promise, it is article 7 of the terms of sale.

No. The Starter plan opens from the sign-up form, with no payment method: no card to enter, no counter starting after fourteen days. It is not a trial but a free plan with no time limit and its own quotas (2 repositories, 20 AI checks per month, 10 scans per day). A card only comes into play if you move to a paid plan, and payment happens on own2pwn.fr, by card only.

Access opens immediately after the payment is validated. In practice: as soon as the payment is confirmed, the subscription is attached to your account and the plan quotas apply, with no manual step in between. If you subscribe without an own2pwn account yet, the payment creates one and you get an email to set your password: access is live as soon as that is done. If anything gets stuck, write to contact@own2pwn.fr, the answer comes within 24 hours.

Yes, and without starting over: the account, the connected repositories and the scan history stay in place, only the quotas change. You request the change by email to contact@own2pwn.fr, stating the plan you want and the date it should take effect; the answer comes within 24 hours. What is settled on the billing side is that the period already paid for is not refunded pro rata (article 7 of the terms of sale); the exact amount and the effective date of the new plan are confirmed to you in writing before anything is validated.