01
Connect selected source
Use the Rorix GitHub App to grant read access only to the repositories you choose.
// PRODUCT · CODE ANALYSIS · PRIVATE BETA
Review vulnerable source paths before they ship.
Rorix Code Analysis uses DeepSec to inspect .NET source, revalidate likely vulnerabilities, and return evidence your team can review. The beta is advisory by design: it never replaces human review or penetration testing.
.NET first · explicit opt-in · advisory findings · maximum three design partners
// WORKFLOW
From exact commit to reviewable evidence.
Every run is tied to a repository, commit, organization, budget, and immutable audit trail. Partial coverage and runtime failures stay visible instead of being presented as clean results.
02
Analyze in isolation
DeepSec evaluates eligible .NET files inside a short-lived sandbox pinned to an exact commit SHA.
03
Revalidate signals
Likely findings pass through a second evidence-focused review before they reach your team.
04
Triage with context
Review source locations, confidence, remediation, run coverage, and normalized JSON or SARIF output.
// REVIEW SURFACE
A finding is a claim with evidence—not a verdict.
Engine output is normalized into a stable lifecycle for triage, recurrence tracking, export, and human adjudication. The original signal and revalidation outcome remain distinguishable.
// RUN CA-1042 · COMPLETEHIGH
Authorization boundary may trust a user-controlled tenant identifier
- Finding
- Authorization boundary may trust a user-controlled tenant identifier
- Evidence
- AccountController.cs · lines 84–97
- Confidence
- Revalidated · 0.91
- Coverage
- 42 of 42 eligible files analyzed
- Export
- Normalized JSON · SARIF 2.1.0
// SAFETY MODEL
Gated because source deserves stricter controls.
The beta stays deliberately small while Rorix measures recall, precision, duration, spend, cancellation, retention, and deletion behavior with real repositories.
✓Explicit organization and project opt-in
✓Read-only source access through the GitHub App
✓Exact-SHA checkout in short-lived sandboxes
✓Encrypted artifacts with bounded retention
✓Per-run spend caps and concurrency limits
✓Advisory PR checks that never block a merge
PRIVATE BETA
Bring one .NET repository. Help shape the evidence model.
Design partners get explicit budgets, opt-in processing, and direct review of coverage and false positives before broader availability.
Request beta access →