The scan
It starts with the whole project: read like an attacker.
Kelrova is an AI security scanner that reads your code the way a security reviewer does. Pick how much it reviews, from the files that changed to the whole project. On Pro and above, Adversary scans take an attacker's point of view and report every step an attack would take.
A drawing of the New scan dialog's levels: Quick, Focused, Standard (the default, selected), Extended and Full with their depth meters, then Adversary, Pro and above.
Choose the depth
Quick for changed files. Full for the whole project. Adversary for attack paths.
A drawing of an Adversary scan running on a sample project: 38 attack paths reviewed, 4 deferred, 6 candidates, 2 confirmed findings.
Read like an attacker
The paths an attacker would try, checked one by one.
A drawing of an Adversary finding: “Any signed-in user can trigger refunds for another tenant”, critical, affects all users, with its attack path in three steps: src/routes/refunds.ts:142, refund request accepts any amount from the client; src/auth/tenant.ts:57, tenant check reads the tenant id from the request header; src/jobs/payouts.ts:88, payout job pays the refund without a second check.
Every step on record
Where it starts, what it passes through and who it reaches.
Findings
Every finding comes with proof: the file, the line and the code.
Findings arrive riskiest first. Each one, from broken access control or an injection to a leaked secret, names the file and line, shows the code behind it and keeps its status on record.
A drawing of a project's findings, most severe first: Any signed-in customer can download another customer's invoices; Live payment API key committed in config/prod.ts; Avatar import fetches any URL, internal hosts included; Search filter concatenated into SQL; Session cookie set without Secure in production.
Severity first
Critical to low, the riskiest on top. Filter by severity or kind.
A drawing of the evidence for “Any signed-in customer can download another customer's invoices”: five lines of src/routes/invoices.ts with line 43 marked, where the invoice is loaded by the id in the URL; entry point GET /invoices/:id/pdf, high confidence.
Evidence included
The file, the line and the code behind every finding.
A drawing of three closed findings: Webhook signature compared with ==, fixed (Re-check confirmed on main); Verbose error body leaks stack traces, accepted risk (Internal admin API, behind the VPN); Unbounded page size on /invoices, false positive (The gateway caps page size at 100).
Status on record
Fixed, accepted risk or false positive, with who decided and why.
Fixes
Fix it your way: a pull request or your own agent.
Go Fix, the button on every finding, opens an AI-assisted fix as a draft pull request on GitHub, GitLab or Bitbucket, and your merge gates can review it. Or connect your AI coding agent, such as Claude Code, Cursor, Codex or VS Code, to Kelrova's MCP server and fix findings in your own checkout.
A drawing of Go Fix's draft pull request #418, “Refund at most the captured amount”: three lines added and one removed in src/routes/refunds.ts, linked back to the finding.
Fix it now
A draft pull request with the fix, linked to its finding.
A drawing of a Claude Code session using Kelrova's MCP tools (list_projects, get_finding, report_finding_action, request_recheck) to fix the refund finding, report it fixed and ask for a re-check.
Your agent, your checkout
List, read, fix and report back over MCP. Kelrova then checks the fix again.
A drawing of the finding's Activity: draft PR #418 opened, merge gates 2 of 2 passed, then a re-check: fixed, confirmed on main.
Checked twice
Your merge gates review the fix, then a re-check confirms it on the code that shipped.
Schedule
Then it keeps watching: every run compared with the last.
Scan daily, weekly or every two weeks. Each run is compared with the one before, so what is new stands out, and a finding is checked again once its fix is merged.
A drawing of a schedule for northwind/payments-api: Standard, weekly, first run Mon 09:00, switched on.
Set it once
Daily, weekly or every two weeks, from a first run you pick.
A drawing of four weekly scans, newest first: no new findings, one new high finding, then no new findings twice.
Quiet weeks
Most runs bring nothing new, and the one that does stands out.
A drawing of this week's run compared with last week's: 1 new, 4 known, 2 resolved.
Known, not new
Each run keeps count of what is new, what is known and what was resolved.