Urrbn

What it catches

• Hard-coded secrets

  Credentials committed to source, reported by file and line, never by value, and flagged critical so they cannot merge.

• Supply-chain tricks

  GlassWorm catches invisible-unicode, homoglyph and trojan-source code that reads clean to a human.

• Vulnerable dependencies

  Lockfiles matched against the OSV database, with the advisory and the fixed version named.

• Code-level issues

  Static analysis and the model find problems such as SQL injection or a missing authorization check, each with a file, a line and a reason.

How it works

1. Scanners run first: secrets, static analysis, dependency CVEs and supply-chain checks, before a single model call.
2. Claude reads the diff in context and proposes findings, each with a file, a line, a severity and a reason.
3. The verdict is recomputed from the findings, not trusted from the model. If the model returns nothing, you still get the scanner results.
4. Findings post inline on the pull request, and GitHub's own required check blocks the merge when something is critical. Triage on the dashboard reflects back to GitHub.

Built to be trusted with your code

• Never trained on your code

  Inference runs on Claude through AWS. Your source is reviewed, then discarded.

• In your region, in your cloud

  AWS-native and in-region by default; for enterprise, Urrbn deploys into your own AWS account.

• Fails safe, not open

  If the model refuses or errors, the scanner results still post. A review is never silently skipped.