Vybscan
by Dheemai
Vybscan
by Dheemai
The AI security reviewer for AI-written code. Vybscan scans every PR, push, and dependency for vulnerabilities, insecure code, secrets, and license risk, right inside GitHub.
Dependencies and first-party code, checked in parallel: no CI to edit, no tokens to manage.
An LLM pass flags injection, auth, SSRF, and insecure crypto.
AWS keys, API tokens, and private keys, before they land.
Flags GPL, AGPL, SSPL copyleft before it taints your code.
npm, PyPI, Go checked against OSV and GitHub Advisory.
Prioritises the vulns your code actually reaches.
Impostor packages via typos, homoglyphs, combosquats.
Infrastructure-as-code and container configuration posture.
Fast pattern-matching for JS, TS, Python, and Go.
Org-wide findings with history, trends, and FP control.
Vybscan runs the whole loop: no gaps between scans.
One click. No CI, no tokens.
Deps + code, in parallel.
Your choice, per repo via vybscan.yaml.
New CVEs after merge.
Every finding, one view.
Setup, language coverage, merge behaviour, and what happens to your code.
Vybscan is a security reviewer for AI-written code. It installs as a GitHub App and scans every pull request and push for insecure code, vulnerable dependencies, hardcoded secrets, infrastructure-as-code and container misconfiguration, licence risk, and typosquatted packages. There is no CI pipeline to configure and no tokens to manage.
Vybscan is free to install from the GitHub Marketplace, and the free tier covers one repository. For additional repositories or an organisation-wide rollout, get in touch through the form on this page.
Code scanning covers JavaScript, TypeScript, Python, and Go today. Dependency scanning covers npm, PyPI, and Go modules, checked against the OSV database and the GitHub Advisory Database. If your team needs a language that is not on that list, tell us and we will add it.
That is your choice, set per repository. Add a vybscan.yaml file at the root of the repository to decide whether Vybscan blocks the merge automatically when it finds an issue, or simply posts its findings as a comment on the pull request and lets the team decide.
Yes, when AI-assisted SAST is enabled. Selected source files and the context around candidate findings are sent to a commercial coding LLM for analysis. Everything else, including dependency scanning, secrets detection, licence checks, and the Semgrep rule pass, runs without sending your source anywhere. If you do not want any code sent to a model, you can turn off the AI review and keep the rest.
For code review: selected file paths, source code with line numbers, up to 100 prioritised files by default, and the source context around candidate vulnerabilities. For dependency analysis: package names, versions, ecosystems, registry metadata, install scripts, and publisher and maintainer information, most of which is public registry data. Findings, remediation text, and check results go back to GitHub.
No. Vybscan uses a commercial coding LLM under API terms where inputs and outputs are not used to train the provider's general models, and are normally deleted within 30 days. Exceptions apply for legal obligations and usage-policy enforcement, and content flagged for policy violations may be retained longer. Teams with stricter requirements should ask us about a zero-retention configuration, or turn off AI analysis entirely.
Yes. Turn off the AI review and Vybscan still runs Semgrep rule-based code scanning, dependency scanning against OSV and the GitHub Advisory Database, secrets detection, infrastructure-as-code and container checks, licence compliance, and typosquat detection. You lose the AI code review pass, not the rest of the product.
Vybscan stores your GitHub organisation and repository identifiers, installation and scan metadata, your package inventory, findings and remediation details, and pull-request information such as number, title, branch, requester, and commit SHA. Source code copied temporarily to run Semgrep is deleted once the scan finishes. On the pull-request path Vybscan generally keeps finding metadata only and fetches code snippets from GitHub when you open the report. Ask us for current retention details.
Findings can be dismissed, and a dismissal is remembered so the same finding does not reappear on later scans of that repository. Reachability analysis also reduces noise up front by prioritising the vulnerabilities your code actually reaches over ones sitting in parts of a dependency you never call.
Vybscan rescans daily, so a vulnerability disclosed after your code merged still surfaces. A scanner that only runs at merge time cannot catch an advisory published the following week.
We wrote a detailed comparison of eleven SCA and SAST platforms, covering pull-request workflow, dependency risk, code scanning depth, and the operational work each one creates. It is on the Dheemai blog and links from the foot of this page.
Install in 30 seconds, or tell us about your team and we'll reach out.