Working with us
Security review scoped to the stack you ship
Application code, cloud configuration, source control and the release pipeline, reviewed by the team behind our public open-source findings.
Review this release before we ship
server: "andesyte"
tool: "andesyte_scope"
arguments: { stack: ["Next.js", "GitHub Actions", "Vercel"] }
Reviewed auth, external fetches, CI permissions, and deployment config
Traced user-controlled sourceUrl into a server-side fetch
Internal network addresses were not blocked
Flagged server-side request forgery · CWE-918 · high
Added the existing outbound network policy before fetch
Ran focused tests and the release build
Report ready with proof, severity, and remediation
fix: validate import source before server-side fetch #284
launch-team wants to merge 2 commits into main
const { sourceUrl } = await request.json();await assertPublicUrl(sourceUrl);const response = await fetch(sourceUrl);return Response.json(await response.json());sourceUrl came directly from the request body and reached a server-side fetch. The shared network policy now rejects loopback, link-local, and private address ranges before the request leaves the application.
This branch has not been deployed
No deployments
All checks have passed
1 successful check
No conflicts with base branch
Merging can be performed automatically.
Review coverage across your stack
A review covers the whole path from a commit to production, because that is the path an attacker takes too.
01
Application
Application security
Authentication, access control, input handling and API exposure across your application layer.
02
Source control
Repos and CI/CD
Branch protection, leaked secrets, GitHub and GitLab Actions, dependency and supply-chain risk.
03
Infrastructure
Cloud and config
Vercel, Supabase and cloud configuration. Environment exposure and risky defaults before they ship.
04
Release
Production readiness
Practical, prioritised findings before you ship and before customers ask.
How the review works
Four steps, agreed up front. You know what is in scope, what comes back and what happens after.
- 01
Scope the stack
You tell us what you're shipping. We agree the surfaces in scope. No vague open-ended retainers.
- 02
Review the system
Hands-on review across code, infrastructure, auth and release pipeline, grounded in how attackers operate.
- 03
Report the risks
A prioritised, severity-rated findings report with reproduction steps where they help and clear remediation guidance.
- 04
Support remediation
A follow-up to walk the team through fixes. For continuous coverage afterwards, Andesyte works alongside your team as the code changes.
Which stack are you shipping?
Answer a short run of questions about what you build on. We scope a review from what you send, and you get a reply from a person.
Security work in the open
Public findings inform the private review
We report vulnerabilities in open-source projects and publish what gets merged. The same research discipline is what we bring to your stack. See the merged fixes, read the customer stories or check the FAQ.
Can you review this patch before I send it upstream?
server: "andesyte"
tool: "andesyte_research"
arguments: { repo: "infiniflow/ragflow", path: "deserialize_b64" }
Confirmed the default branch reached unrestricted pickle.loads
Crafted database content could execute code when a pickled field was read
Classified as CWE-502 · medium severity
Removed the unsafe branch and routed every payload through RestrictedUnpickler
Verified malicious payload rejection and NumPy round-trip
Merged upstream in RAGFlow PR #14803
Find the issues before they ship
Tell us your stack and we'll scope a focused security review.