AI security reviews on every pull request.

Sebastion AI scans your pull requests for real vulnerabilities, injection, hardcoded secrets, broken auth, supply-chain risks, insecure crypto and files findings as a structured GitHub issue with concrete fixes. Free for public repos.

Install on GitHub View example audit

github.com/acme/agents · issue #128live

Sebastion AI · opened just now

Sebastion AI security audit: PR #42

Cloning repository…

CriticalCWE-798

Hardcoded Anthropic API key in src/agents/router.ts:42

The string sk-ant-api03-… is committed in plaintext. Anyone with read access to the repo can drain your account. Rotate immediately and load from process.env.ANTHROPIC_API_KEY.

HighCWE-89

SQL injection via untrusted userId in api/threads/route.ts:87

userId flows from the request body straight into a raw db.query() template. Use a parameterised query or the existing db.threads.findMany({ where: { userId } }) helper.

linked from #PR-42audit completed in 47s

200+

Repositories audited

60s

Median PR review time

Lint-noise findings

0Free

On every public repo

How it works

One install. Security review on every PR.

Step 01

Install on GitHub

One click. Sebastion AI gets scoped, short-lived read access to the repos you choose. No PATs, no SSH keys, no seat invitations.

Step 02

We review every pull request

Sebastion clones each PR into an ephemeral microVM and traces user input across the diff, looking for real, exploitable security bugs, not style nits.

Step 03

Findings land as a GitHub issue

Each audit posts a single, structured issue on the PR with severity, file/line, a concrete fix, and, where relevant, a working proof-of-concept.

Pricing

Pick a tier, not a model.

Free for public repos. $19 / dev / mo for private. $39 / dev / mo for teams. Pro and Team are billed only for developers who author pull requests in the last 30 days.

Free

$0forever

For solo developers and OSS maintainers.