Static application security testing

Every scanner says possible. This one says what it proved.

Every finding carries one of two labels, and they are never blended. One matched a pattern. The other traced attacker data from source to sink and prints every hop it walked, so you can audit the claim instead of believing it.

$  npx github:Sikkuumi/Defuse scan .
no install · no account · AGPL-3.0
flow-verifieda path that was walked
signature-baseda shape that matched
Before anything is claimed

This is one finding,
printed whole.

Nothing below is summarised. The label, the path, and the limits of what the engine could establish all ship together, because a claim without its working is just a louder guess.

defuse scan .
CRITICAL  cmdi.c:44
Attacker-controlled data from argv[1]
reaches a shell, which runs the string
command-injection  ·  CWE-78
[flow-verified] — 3 hops, printed below
limitations
confirms the data flow, not exploitability
in production. Does not model memory
safety in C: it tracks values, not sizes.
The path it walked
argv[1]
a command-line argument — the source
sprintf(cmd, …)
written into cmd, unescaped
system(cmd)
arrives at the shell — the sink

Three hops, every one printed. Where a hop rests on something the engine could not follow, that hop says so rather than being smoothed over.

Two labels, never blurred

A guess and a proof are
not the same sentence.

Most tools report everything at one confidence and leave the triage to you. The word they hide behind is possible — and it covers both a traced data path and a lucky-looking regex.

A rule cannot set its own confidence. Only a printed path earns the filled label — and that is enforced by the type system, not by a style guide.

Measured, and published whole

What the filled label
is actually worth.

Scored against OWASP BenchmarkJava, 1210 labelled test cases, on engine 0.5.0 (2026-10-15). Each label is scored separately, because one blended figure would be the same averaging this tool refuses to do inside a single finding.

tier precision found wrong
flow-verified
100.0%
5620
signature-based
70.1%
8235
both combined
94.8%
64435

The filled label is worth 29.9 points of precision over the hollow one. That gap is the entire claim this tool makes, and it is measured here rather than asserted.

The footnote, printed rather than buried

No false positive wears the filled label on this benchmark: all 562 flow-verified claims are real vulnerabilities. That is a fact about these 1,210 test cases, not a promise about your code — a proof means the path exists in the source, and the ways it can still be wrong are in the limitations below, which a synthetic benchmark does not exercise.

The part nobody ships

It prints what it
didn’t check.

Every run ends with the rule and language combinations this engine does not implement — currently 22 of them — each with the real reason, not a placeholder. In C it states outright that it does not model memory safety: no buffer overflows, no use-after-free. It tracks values, not sizes.

A gap you can read is a gap you can plan around. A gap you can’t see is the one that gets you.

8languages
10rules
2766files scored
AGPL3.0 · or commercial
JavaScriptTypeScriptPythonJavaPHPGoCC++
What it costs

Free, and specific
about what that means.

The scanner is AGPL-3.0. Pointing it at your own code — closed-source, proprietary, commercial, any of it — puts no obligation on you whatsoever, and running it unmodified inside a company is free and unencumbered.

The one obligation attaches if you modify it and then serve your modified version to other people over a network, in which case those users are owed your source. If those terms do not work for your company, and for some they genuinely do not, the copyright sits in one place and a commercial licence can be discussed.

The scanner is the whole of the free plan, not a trial of it. Tools for working through findings over time, and across a team, are paid - see plans and pricing.

If you would rather not run it yourself

Your code, scanned
and read by a person.

Sikkuumiii, who builds Defuse, runs it on your code, reads every finding, and hands back the report in a form your team can act on. The same two labels apply: what was proven comes with its path, what was only matched is said to be unproven, and what was not checked is written down.

From ₹9,999 per project, for code up to about 25,000 lines. Larger projects are quoted before any work starts.
What you get
  1. The client report. Proven problems with the path behind each, what to review, what was checked and cleared, and what was not checked - one file that prints to PDF.
  2. A written summary. Which findings matter first, which matched lines are false alarms and why, and what to fix.
  3. A 30-minute call to walk your team through it.
What it is not
  • Not a penetration test. Defuse reads source code; it does not attack the running application, so neither label proves a problem can be exploited in production.
  • Not a dependency audit. The libraries your project uses are not checked for known vulnerabilities.
  • Not a guarantee of safety. Section 4 of every report lists what was not checked, and that list is part of the answer.
Request a check on GitHub

The request form is public. Write only the language, the rough size and how to reach you privately - never code, keys or company details.