GitHub repository
Analyse a public repository or an authorised private repository through the managed runner.
Secure software delivery
Understand the risk in your entire codebase.
MaxiCyber analyses application code as a connected system—not a list of isolated patterns. See how data moves, where controls break, which dependencies matter, and what developers should fix first.
maxicyber-code-analysis-report/v1
- Repository structure, entry points, trust boundaries, and security-sensitive flows
- Evidence-backed findings with severity, confidence, affected files, and line locations
- Dependency and package-security context without duplicating scanner results
- OWASP-aligned remediation steps, validation guidance, and tests to add
- Developer report, executive summary, architecture diagrams, and code graph
From repository access to a remediation plan
Select each stage to see how MaxiCyber turns source code into evidence developers can act on and leadership can prioritise.
Authorise a GitHub repository or choose a controlled CLI/source-handling mode.
Run it where your team works
Select the workflow and source-handling model that fits the repository and your data policy.
Visual Studio Code
Run a full-workspace scan or inspect only current Git changes from the CyberWL Agent extension.
CLI and managed runner
Choose local findings upload, a sanitised cloud snapshot, or deployment-gated deep analysis.
Three analysis lenses, one prioritised report
The Visual Studio Code extension exposes security, functional-quality, and performance/scalability checks. Managed analysis adds deeper repository context and evidence-backed reporting.
- Security
- Authentication, authorisation, injection, secrets, unsafe I/O, supply chain, CI/CD, and platform-specific risks.
- Functional quality
- Correctness, maintainability, failure handling, concurrency, and implementation defects that can escape review.
- Performance and scalability
- Blocking paths, repeated work, inefficient data access, missing bounds, and scale-sensitive design choices.
See what the report gives you
Switch between an illustrative developer finding, its architecture context, and the executive view. Actual reports link these views to the same evidence.
- Concrete file and line evidence
- Exploit scenario and business impact
- Change, test, and validation guidance
ILLUSTRATIVE OUTPUT
HIGHAUTHORIZATION · HIGH CONFIDENCE
Project lookup is not scoped to the authenticated organisation
A route queries a project by user-controlled ID without including the current organisation in the database predicate. An authenticated user could request another tenant's project if an identifier is discovered.
41 const project = await db.project.findUnique({
42 where: { id: params.projectId }
43 })
Recommended change
Scope the query by project ID and authenticated organisation ID, then return the same not-found response for inaccessible records.
Validation
Add a cross-tenant integration test and verify direct object requests cannot disclose record existence.
A typical first review
01
Define scope
Choose repository, branch, analysis areas, and approved source-handling mode.
02
Run analysis
The managed runner performs static, read-only review and package inspection.
03
Triage together
Engineering and security confirm priority, ownership, and remediation sequence.
04
Verify changes
Rerun analysis and retain a durable report for technical and executive stakeholders.