Static code, live behaviour, mobile builds, and on-device runtime — tested together so a finding is confirmed across the whole path, and shipped apps defend themselves after release.
SAST · source & dependencies
Atlas parses your repository to a real AST across six languages, maps the architecture and data flow, and reasons about trust boundaries — then flags what's actually reachable, not every theoretical match.
Unlike regex-and-grep linters, Atlas builds a call graph and follows tainted data from a source (a request parameter, an env var) to a dangerous sink (a query, a shell, a template). A finding is only raised when a real path connects the two, which is why the noise floor is a fraction of a typical SAST tool. Every result carries the exact file:line, the reachability path, a CWE, and a concrete fix.
Python, JavaScript, TypeScript, Go, Java and Ruby parsed with Tree-sitter — single-pass and fast.
Routes, data stores, integrations and auth, plus a deterministic STRIDE threat model.
Hardcoded secrets with redacted evidence, plus insecure Docker/K8s/Terraform config.
Dependency vulnerabilities matched against the live OSV database, CWE-mapped.
Detects & covers
DAST · source-aware · aggressive
Ares gets both sides of the application: its connected GitHub source and its DNS-verified running staging URL. Specialist agents then validate exploitable paths with reproducible evidence.
Atlas remains the repository-only scanner. Ares is a combined autonomous pentest: it uses source context to understand routes, authentication and data flow, then performs aggressive live testing against the authorized host. It can submit forms, create test data and exercise state-changing paths, so it must run against a disposable staging environment—not production.
Repository access supplies source context; DNS TXT verification authorizes traffic to the live host.
Specialist agents correlate code, routes, authentication and data flow before probing.
Findings include the live evidence produced while validating the exploitable path.
Ares is intentionally aggressive and may change state; use an isolated, disposable environment.
Detects & covers
Mobile · APK
Shield inspects APKs against OWASP MASVS and — on request — applies reversible hardening transforms, then rebuilds, zipaligns and re-signs, preserving the original with a full change report.
Upload a build and Shield decompiles it, audits the manifest, permissions, native libraries and signing config against the MASVS checklist, then — only when you ask — applies hardening transforms at the bytecode level and hands back a rebuilt, zipaligned, re-signed APK. The original is never mutated, and every change is written to a diffable report so you can see exactly what shipped.
Manifest, permissions, native libs and signature: debuggable, backup, cleartext, exported.
Pin certificates via network-security-config to defeat proxy interception.
Root, anti-debug, emulator and hook detection plus integrity checks at bytecode level.
apktool build → zipalign → apksigner, original preserved, every change logged.
Detects & covers
RASP · post-compile
Aegis hardens a built app after compilation and before your signing step, injecting defenses that run on the device itself — so a shipped app detects and reacts to tampering, hooking and interception in the field. Verified on a real device: the checks actually fire and respond.
Where Shield audits a build, Aegis arms it. It runs post-compile — inside your CI, before your own signing step — so the artifact that reaches the store carries your signature and Aegis never holds your key. There is no SDK to embed and no code change: you upload a build (or drop the GitHub Action in) and get back a protected one. The injected checks evaluate live device state and can report, warn, redirect or terminate, and because a phone can't be trusted, protected builds attest their findings to your backend for a server-side decision.
Root, debugger, emulator, hook, tampering, proxy and MITM-CA checks that evaluate live device state at runtime.
Each check can report, warn (a flag your app reads), redirect, or terminate — you choose per threat.
Screen-capture and screen-recording blocking via FLAG_SECURE, applied app-wide.
The phone can't be trusted; protected builds report events and your backend verifies them server-side before sensitive actions.
Detects & covers
Free covers three engines; paid plans add Aegis runtime protection — plus the capabilities most vendors sell separately.
A single-pass AST scans large codebases in seconds and parallelises across cores in the cloud.
A dependency-free CLI fails builds on severity thresholds and exports SARIF 2.1.0 into your security tab.
CWE + OWASP mapping with HTML, JSON, PDF and SARIF output for audits and customer reviews.
Ares will not dispatch without both connected source and DNS ownership of the staging host.
Track severity counts down release over release in one dashboard, across all four engines.
No training on your data, region-aware processing, and deletion on request.
Run Atlas on a repository, pair it with a verified staging app for Ares, or upload an APK—no agents.