SQL injection in order search
Critical43 WHERE ref = '${req.query.ref}'Use a parameterised query.
Illustrative example
Every model misses something. Several, cross-checked, miss far less.
Several independent AI auditors review your codebase, cross-check each other, and send you one clear, prioritised security report.
- Fixed price
- Read-only access
- Report in about 48 hours
One repo · One-off payment · No subscription required
How it works
- 1
Pay
US$450 per repository, by card. No sales calls, no seat licences.
- 2
Connect a GitHub repo, read-only
Install the Yakiba GitHub App on one repo. It can read code. It can't write, push or change anything.
- 3
Get your report in about 48h
A prioritised, de-duplicated report, with evidence and a suggested fix for every finding.
Several independent AI auditors, cross-checking each other
One model is one opinion. Yakiba runs several different AI models over the same repo, then compares what they found.
Agreement ranks higher. Findings confirmed by more than one auditor rise to the top.
Wider coverage. Different models catch different classes of bugs.
One report, not five. Results are merged and de-duplicated.
What's in the report
yakiba.Security audit · acme/web
- Executive summaryPlain-English risk overview for founders, boards and investors.
- Prioritised findingsRanked by severity and by how many auditors agreed.
- Evidence and locationThe file, the lines, and why it matters.
- Suggested fixesPractical remediation your developers can act on.
- OWASP Top 10 and CWE mappingHandy for security questionnaires.
- One free retestFix the issues, then rescan within 30 days to confirm they're closed.
Yakiba is an automated code review. It is not a penetration test or a compliance attestation.
Your code, handled like it's ours
Read-only access
Our GitHub App only reads the repo you choose. Uninstall any time.
Deleted after the scan
Processed in an isolated environment, deleted when the scan completes.
Never used for training
We don't train or fine-tune any model on customer code. Full stop.
Stay sharp with Monitor
An audit is a snapshot. Monitor keeps watching as your code changes, and catches new issues before they ship.
Monitor Starter
US$149/month
- 1 repository
- Weekly full scan
- Scan of every merged pull request
- Email alerts
- Monthly report
Monitor Team
US$399/month
- Up to 5 repositories
- Every pull request scanned, with GitHub comments
- Slack alerts
- Monthly report
- Quarterly full re-audit
Pay annually and get two months free. Already had an audit? Your first month is on us.
Agency partner programme
Hand over every client project with an independent security review, under your brand or ours.
Become a partnerWhite-label audits. Prepaid packs at partner rates, reports in your branding.
Monitor for clients. Partner pricing to fold into your retainers.
Referral. Earn a share of first-year revenue for every client you refer.
FAQ
Is this a penetration test?
No. Yakiba is an automated source code review. It finds vulnerabilities in your code, but it isn't a human-led penetration test or a compliance attestation. Many teams use it to clean up before a pentest or a SOC 2 audit.
Which languages do you support? Confirm
Most common web and backend languages, including TypeScript, JavaScript and Python. If you're unsure, get in touch before you buy.
Do you support GitLab or Bitbucket? Confirm
GitHub only at launch. GitLab and Bitbucket are on the roadmap.
Is a human involved?
No. The audit is fully automated, which keeps the price fixed and the turnaround fast.
What if the report finds nothing serious?
Great news, and you'll have a dated report showing the review was done. No automated review can guarantee your code is free of vulnerabilities.
How big a repo can you audit? Confirm
One repository per audit. For very large monorepos, contact us first.
Can I get a refund? Confirm
If we can't complete the scan, you get a full refund.