Andesyte Code Security

Security that runs where your code already lives

Secrets, injection and vulnerable dependencies, caught on the changed lines before anyone merges them. Free on public repositories, for good.

Open Connect Open app

Everywhere you work

One agent across desktop, CLI, and your team tools

Desktop

Manual and agentic review in one familiar editor surface.

Install MCP

Are we safe to ship?

server: "andesyte"

tool: "andesyte_review"

arguments: { pr: "current", scope: "deps" }

Resolved 214 dependencies to exact versions

Matched cross-spawn@7.0.3 against the CVE database

Traced the vulnerable parser to src/jobs/run-task.ts:42

Confirmed reachable: job payload reaches cross-spawn unsanitised

Flagged ReDoS via CVE-2024-21538 in cross-spawn <7.0.5

Severity: high · CWE-1333 · CVSS 7.7

Confirmed no other unsanitised call paths

Bumped cross-spawn to 7.0.5 and relocked

Ran install + test suite against the patched version

Opened PR #482 against main

Done. Vulnerable dependency patched, no known CVEs remain.

∞

CLI

Run the same checks from any terminal, script, or CI step.

Run from CLI

Check for any issues before I merge this PR

server: "andesyte"

tool: "andesyte_review"

arguments: { pr: "current", scope: "deps" }

~/repo/acme · package.json · 214 dependencies

Resolved lockfile to exact versions 0.4s

Checked 214 packages against the CVE database 1.2s

Traced cross-spawn to src/jobs/run-task.ts:42 0.6s

Job payload flows into cross-spawn unsanitised reachable

cross-spawn@7.0.3 via CVE-2024-21538 (ReDoS, high) flagged

CWE-1333 · Inefficient Regular Expression Complexity cvss 7.7

No other unsanitised call paths found 0.3s

Bumped cross-spawn to 7.0.5 and relocked 0.8s

Ran install + test suite against the patch 3.1s

Opened PR #482, no known CVEs remain patched

Follow-up

Other Surfaces

Trigger reviews from GitHub, GitLab, and the tools your team already uses.

Add to GitHub

Open

fix: bump cross-spawn to patch CVE-2024-21538 #482

andesyte-code-security wants to merge 2 commits into main

andesyte-code-security [bot]reviewed 2m ago

package.json

11 "dependencies": {

12 "commander": "^11.1.0",

13 "cross-spawn": "7.0.3",

13 "cross-spawn": "7.0.5",

14 "execa": "^8.0.1",

src/jobs/run-task.ts +2 -1

andesyte-code-security [bot]high

CVE-2024-21538 affects cross-spawn <7.0.5, which is vulnerable to ReDoS via crafted arguments. Traced the call path to src/jobs/run-task.ts:42, where job payloads reach it unsanitised, confirming this is exploitable, not just present in the lockfile. Bumped to 7.0.5, the patched release.

This branch has not been deployed

No deployments

All checks have passed

1 successful check

No conflicts with base branch

Merging can be performed automatically.

Squash and mergeor merge from the command line

Connect once, then leave it running

01
Connect your source host
Open Connect and install once. Connect supports GitHub and GitLab SaaS.
02
Security review runs as code changes
On each review open and push, Andesyte runs AI code audit plus dependency CVE and verified secret checks, then posts a fast walkthrough with pre-merge sanity checks.
03
Fixes and blockers appear inline
Findings land on the exact changed line with severity and MITRE CWE context. Small patches include one-click suggestions; critical findings can block auto-merge.

In your terminal, and in your agent

The same checks that review your pull requests run locally. Your source code stays on your machine. Dependency scanning sends package names and versions to OSV, and nothing else.

npm install -g @andesyte-oss/cli

andesyte check code --changed

~/repo/acme · 2 files changed · not yet committed

Loaded local rules, no registry call 0.2s

Query built by concatenation at src/db/users.ts:42 0.4s

req.query.email reaches the query unsanitised reachable

SQL injection · CWE-89 flagged

Severity: critical 1 finding

Fix: use a parameterised query exit 1

Follow-up

Open

feat: add user search endpoint #291

lewiswigmore wants to merge 1 commit into main from lewiswigmore/user-search

andesyte-code-security [bot]reviewed 1m ago

src/db/users.ts

40export async function findByEmail(email: string) {

41 const sql =

42 "SELECT * FROM users WHERE email = '" + email + "'";

43 return db.query(sql);

41 const sql = "SELECT * FROM users WHERE email = $1";

42 return db.query(sql, [email]);

44}

src/routes/search.ts +1 -1

andesyte-code-security [bot]critical

SQL injection. The email value arrives from the request query string and is concatenated into the statement, so a crafted value can end the string literal and append its own SQL. Bind it as a parameter instead. The driver then sends the value separately from the statement, and the database never parses it as code.

This branch has not been deployed

No deployments

All checks have passed

1 successful check

No conflicts with base branch

Merging can be performed automatically.

Squash and mergeor merge from the command line

Learning loop

Answer it once and it remembers

Reply to any finding with @andesyteoss and it answers in the same thread, suppresses the rule on that file, or both. The next audit honours what you taught it, and reuses the instruction files already on your base branch.

andesyte · pr thread

reply on any finding

@andesyteoss help list what it can do

@andesyteoss ignore suppress this rule here

@andesyteoss suppress legacy code …with a reason

@andesyteoss why is this exploitable? answers in-thread

What lands on the pull request

Every check reports into the same thread. These are the shapes they come back in.

Dependency CVEs via OSV.dev

andesyte · dependencies

requirements.txt 1 additions · 1 removals

+ pyyaml==5.1

osv.dev · known advisory on the added version

unsafe load reachable from the new import

a patched release exists — bump before merge

Verified secret detection on diff additions

andesyte · secrets

src/config/staging.ts:12 2 additions

+ const KEY = "sk_live_…"

Verified against the provider not a fixture

the credential is live and in the diff

rotate it, then read it from the environment

AI code audit (SAST) over the diff

andesyte · code audit

~/repo/RAGFlow · database read path

severity: MEDIUM · CWE: CWE-502

a value read back from the database reaches pickle

reported, fixed upstream, written up

Read the RAGFlow write-up

Pre-merge sanity checks

andesyte · pre-merge

~/repo/ACME · before review

title describes the change

description empty

linked issue #482

walkthrough posted on the thread

Point it at a repository and see what it finds

Public repositories are free, with no card and no trial clock. Private repositories run the same checks.

Open Connect Compare plans See where it already ships How it compares