rorixrorix
sign in →

Code Analysis Beta

Rorix Code Analysis is a gated, automated source-security product beside Supply Chain and Pentesting. It uses DeepSec to identify and revalidate likely vulnerabilities in .NET source code. The beta is advisory: results can be incomplete or incorrect, never block a merge, and do not replace human review or penetration testing.

Consent and eligibility

An organization must be explicitly enrolled by Rorix, and no more than three organizations are admitted to the initial beta. An administrator then enables each eligible .NET project separately and accepts the source-processing disclosure. Pull-request analysis is a second opt-in toggle. Disabling the project stops new runs without publishing the product on public marketing or pricing pages.

When enabled, selected source content is processed through Vercel AI Gateway using a model-provider path that Rorix has confirmed for zero data retention and no training. Each run receives a short-lived AI Gateway key with a hard spend cap. The key is revoked when the run completes, fails, times out, exhausts its budget, or is cancelled.

Data flow

  1. The Rorix control plane accepts a run idempotently, reserves its maximum cost, and starts durable orchestration.
  2. A separate Node 24 analysis service claims the Postgres job and obtains a GitHub App installation token.
  3. The service checks out one exact 40-character commit SHA with hooks, credential helpers, LFS, submodules, and repository-supplied configuration disabled.
  4. Trusted DeepSec configuration and Rorix .NET matchers are mounted outside the untrusted checkout.
  5. DeepSec local matching runs first. AI work runs through official Vercel Sandbox process/revalidation commands in small bounded waves.
  6. Encrypted artifacts go to S3-compatible object storage in production. Postgres retains metadata and normalized findings, not a fallback copy of source or raw state.
  7. Rorix validates the bounded result schema and artifact checksums before updating finding lifecycles and the advisory GitHub check.

Repository scripts are never executed and dependencies are never installed. Customer .deepsec files and repository instructions are ignored. The checkout is rejected above 500 MiB or 50,000 entries, for escaping symlinks, and for analyzed text files above 2 MiB.

Baselines and pull requests

A full baseline is started manually from the project’s Code Analysis tab. It processes up to 10 files per wave with one sandbox, batch size 2, and inference concurrency 2. Only a fully completed baseline becomes canonical and only that outcome can resolve findings that disappeared.

Opted-in same-repository pull requests use the canonical state, analyze eligible changed .NET files only, and are capped at 50 changed files. PR waves process up to 5 files with one sandbox, batch size 1, and concurrency 1. Fork pull requests and unsupported repositories are skipped. A new head SHA supersedes the previous run for the same PR.

The GitHub check is named Rorix Code Analysis (Beta). It is successful only for complete, clean coverage. Findings, partial coverage, budget exhaustion, runtime failures, and timeouts are neutral. Up to 50 source annotations are attached; the beta does not post PR comments.

Findings and exports

Rorix stores stable fingerprints that exclude line numbers, so findings survive normal code movement. Each observation is classified as new, recurring, regressed, or resolved. DeepSec revalidation verdicts and adjusted severity are normalized before display; BUG and HIGH_BUG records are excluded from the security-finding surface.

The dashboard exposes normalized JSON and SARIF exports. Raw DeepSec state, prompts, and source artifacts are not downloadable through customer APIs.

Cost and incomplete outcomes

The initial per-organization defaults are a $100 UTC calendar-month allocation, $50 maximum per baseline, and $10 maximum per pull request. Rorix reserves the full applicable cap before accepting a run, permits only one active run per organization, and treats provider HTTP 402 or quota exhaustion as a preserved partial result rather than silently retrying beyond the cap.

Baseline runs time out after six hours; PR runs time out after 30 minutes. Infrastructure failures may retry twice after the original attempt. Cancellation is cooperative and partial normalized findings already produced are retained.

Retention and deletion

Encrypted baseline/raw state is retained for 30 days. Pull-request state and redacted diagnostic logs are retained for 7 days. Normalized findings remain until the project or organization is deleted so their lifecycle can be tracked. A retention worker deletes expired objects and their metadata. Project deletion fails closed if Rorix cannot delete its Code Analysis objects first.

Every enablement, run, triage change, artifact lifecycle event, and short-lived gateway-key lifecycle is recorded in the Code Analysis audit stream. Operations monitoring covers queue depth and age, 24-hour failures, budget outcomes, and unreconciled gateway keys.

PentestingIntegrations