AI-assisted code security review that never sees your client's code
The scanner runs on your machine, on your own API key. Only the findings file is uploaded. ScopeWise turns it into the deliverable: a severity-ranked register with plain-language explanations, the exploit chains that link findings together, and the fewest fixes that break every chain.
The problem
A manual internal penetration-test engagement typically costs $7,000 to $35,000 and runs for weeks (Bright Defense, penetration testing pricing guide). The average data breach now costs $4.99M globally and $11.5M in the United States (IBM, Cost of a Data Breach Report 2026).
Scanner output is not a deliverable. A client cannot act on a JSON file of a hundred raw hits; they need the verified findings, what an attacker could chain them into, and where to start.
How it works
- 1
Download the scan kit from ScopeWise. It installs the scanner in a sandbox on your machine.
- 2
Run the estimate, then the scan, on your own OpenRouter key. The cost estimate is shown before anything is spent.
- 3
Upload the findings.json zip the kit produces. No source code leaves your network.
- 4
Work the register in the browser, open the drawer for any finding, review exploit chains, and export the XLSX tracker and PPTX briefing deck.
What a real scan looks like
Golden benchmark: OWASP NodeGoat (Apache-2.0), a deliberately vulnerable training application, scanned with the ScopeWise kit on 2026-09-11. A small repository costs a few dollars and takes 30 to 120 minutes.
What you get
Findings register
Severity-sorted, deduplicated, each with a plain-language explanation and the code location.
Finding drawer
Evidence, exploitability notes, verifier verdict, proposed fix.
Exploit chains
Which findings an attacker links together, with the smallest set of fixes that breaks every chain.
XLSX tracker
Owner, target date and notes columns for the remediation plan.
PPTX briefing deck
16 slides, scan coverage, chains and fix plan.
Built on an open-source scanner
Built on Visa's open-source Vulnerability Agentic Harness (Apache-2.0). ScopeWise is not affiliated with or endorsed by Visa, Inc.
The scanner is LLM-driven static analysis. It reads source code at rest, threat-models the repository first and uses multi-agent voting, so it can find logic flaws that pattern rules miss. It is not deterministic, it has no published precision or recall figures, and its findings are triage candidates for a human reviewer, not a completed security assessment. It never tests running systems: it is not a DAST, vulnerability-management or network scanner.
ScopeWise never clones a repository or runs the scanner on its servers. Everything after upload is deterministic code: no AI model is called anywhere in this module.
FAQ
Does my code leave my network?
No. The scanner runs where the code is, on your machine or on a jump box inside the client's network. Only the findings file is uploaded to ScopeWise.
What does a scan cost?
The scanner bills your own OpenRouter key. The kit runs a cost estimate before the scan starts. The NodeGoat benchmark, 63 files, cost about $4 and took 103 minutes; a large repository with dependency folders left in the scan path can take hours, which is why the kit refuses folders that contain them.
Which languages are supported?
Whatever the scanner can read as source code; the run manifest reports lines scanned per language, and the deck shows that breakdown so the client sees exactly what was and was not covered.
Can the client run the scan themselves?
Not in this version. The consultant runs the kit and owns the API key and the scan authorization. Client-run scanning is not offered.