Decompile binaries. Read the code. Check it for known weakness types.

def _0x1a(v, k):
    b = v[:4]
    n = int.from_bytes(b, "little")
    if n != 0x04034B50:
        raise ValueError(_0x2c)
    return _0x3d(v[4:], k)

def read_zip_entry(buffer, key):
    header = buffer[:4]
    magic = int.from_bytes(header, "little")
    if magic != 0x04034B50:
        raise ValueError(BAD_HEADER_MSG)
    return _0x3d(buffer[4:], key)

Python

Bytecode equivalence. The renamed version must compile to identical bytecode.

C, C++, Java

Structural equivalence via Tree-sitter. The syntax tree after renaming must match.

Every language

Per-proposal accept and reject tracking, surfaced in the report, including which gate rejected each proposal.

These are gates, not proofs. A gate checks equivalence under the rules of one language. It is not a claim of semantic understanding, and the report says where understanding stops.

Your releases

Check a build before it ships, from the binary rather than the repository.

Mobile apps

APK, AAB and IPA. Android packages also get component export, WebView and cleartext traffic checks.

Supplier software

Review a vendor binary you are authorised to assess, when there is no source to read.

void load_device_name(const char *src)
{
    char name[64];
    strcpy(name, src);
    set_label(name);
}

int apply_config(const struct config *cfg)
{
    if (cfg->device_name == NULL)
        return -1;
    load_device_name(cfg->device_name);
    return 0;
}

title        Unbounded C string copy
             requires a proven
             destination bound
cwe          CWE-120
severity     HIGH (CVSS 8.1)
confidence   PROBABLE
component    libexample.so,
             load_device_name
cve_ids      none claimed
conditions   copy is in a reachable
             build; src can exceed
             the destination
impact       memory past name may
             be overwritten
limitations  text-pattern rule;
             destination bound,
             callers, reachability
             not established;
             target not executed
remediation  bound the copy to
             sizeof(name)
evidence     sha256:0000...0000
             (placeholder)

Sources

CVE List V5, NVD and CISA KEV (Known Exploited Vulnerabilities), with the source of every record kept.

Past fixes

Past CVE fixes are studied as vulnerable and fixed code pairs, taken only from the exact fix commits named in advisories. The fix code is never checked out or run.

Similar cases

Similar past vulnerabilities are pulled in to guide analysis. Similarity alone never creates or confirms a finding.

New patterns

A pattern from a confirmed finding is promoted only after the same weakness is confirmed independently in separate targets. Rerunning one target cannot confirm it. Free-tier patterns enter only under the data condition set out below, and paid work never does. No gain in detection is claimed until one is measured on held-out cases.

Exploit code

Exploit code is never downloaded or run.

A clean result is not a clearance. Zero matches do not mean zero vulnerabilities. On the free tier you see severity counts. Finding details, remediation and downloads require a paid plan. Analyse only what you have the authority to analyse.

1. Vulnerability findings, with their limits

   Weakness class (CWE), severity, a confidence level, the affected component, the conditions required to reach it, an impact assessment, remediation guidance and evidence hashes. Each finding also states what the analysis could not verify.

2. Both source files ship

   Two files per unit: the raw decompiler output and the Violet reconstruction. Neither is the developer's original source code. Both are readable, and transformation records and rejection logs ship alongside them.

3. Nothing is renamed quietly

   The report counts accepted proposals and rejected proposals, and names the gate that rejected each one.

4. Browser, PDF, ZIP

   A browser report for triage, a PDF for people who were not in the room, and a content-addressed ZIP whose contents are fixed by contract: the report, the manifest, and the paired source trees. Nothing else is permitted inside it.

• PE
• ELF
• Mach-O
• WebAssembly
• APK
• AAB
• IPA
• Archives

Format and architecture detection is automatic. Supported extension labels are not guarantees that a particular target can be recovered, and the report says so when coverage is partial.

• Not a sandbox. Targets are never executed on the public tier. No dynamic analysis, no network callbacks, no sandbox escape surface. Public work is bounded and static.
• Not an exploit generator. Nothing is run, so nothing is proven exploitable. Findings state the conditions required to reach a weakness, and confirmation stays with you.
• Not a name generator. The deobfuscation engine is over 7,000 lines of dedicated code: bytecode-equivalence gates for Python, Tree-sitter structural validation for C, C++ and Java, and per-proposal accept and reject tracking.

Prices, paid-plan allowances and the commercial terms are published at launch. Anything quoted before then is provisional.