ScopeWise for application security consultants
Scanner output is where a code review engagement starts, not where it ends. ScopeWise turns the findings file into the deliverable: a plain-language register, the exploit chains an attacker would follow, and the smallest set of fixes that breaks every chain.
From raw hits to a report the client can act on
A scanner run on a mid-sized repository returns dozens of raw hits. Most engagements then spend their time deduplicating, verifying, explaining each finding in language a product owner understands, and deciding which fix to recommend first. That work is the deliverable, and it is rebuilt by hand every time.
ScopeWise ingests the findings file and does the structural part: severity ordering, deduplication, plain-language explanations, chain detection and the minimal fix set. Your reviewer spends the time on judgement instead of formatting.
How an engagement runs
Scan where the code lives
Download the kit, run the cost estimate, then the scan, on your own machine or on a jump box inside the client network, on your own API key. Only findings.json leaves.
Register and drawer
Severity-sorted findings with the code location, evidence, verifier verdict and proposed fix, in the browser.
Exploit chains and fix plan
Which findings link together and the fewest fixes that break every chain, ordered for the client.
XLSX tracker and PPTX deck
An editable remediation tracker with owner, target date and notes columns, and a briefing deck with scan coverage, chains and the fix plan.
What the scanner is, and is not
The scanner is Visa's open-source Vulnerability Agentic Harness, an LLM-driven static analysis tool released under Apache-2.0. It threat-models the repository first and uses multi-agent voting, so it can find logic flaws that pattern rules miss. It is not deterministic, it publishes no precision or recall figures, and its findings are triage candidates for your reviewer. It never tests running systems. ScopeWise is not affiliated with or endorsed by Visa, Inc., never runs the scanner on its servers, and calls no AI model after upload.
Your client's code never leaves their network
The scan runs where the code is. ScopeWise receives the findings file only, stores it encrypted, and scopes it to your organization. The kit refuses working folders that contain dependency or build trees, so a scan cannot silently balloon in cost or scope. Read the privacy policy.
FAQ
Who pays for the scan?
The scanner bills your own OpenRouter key, and the kit shows a cost estimate before anything runs. A small repository costs a few dollars; the exact figure depends on repository size and the models you choose.
Can I upload SARIF from another tool?
ScopeWise ingests findings.json and SARIF produced by the supported scanner. Output from other tools is not supported in this version.
Does ScopeWise verify the findings?
The scanner includes its own verifier pass and ScopeWise shows that verdict per finding. Final verification is your reviewer's job; the findings are triage candidates, not a completed assessment.
Can the client run the scan?
Not in this version. The consultant runs the kit and owns the API key and the scan authorization.