Toolchain / Kolega DevSec

SECURE

Kolega DevSec

Nothing ships unscanned.

Deep semantic analysis that catches the SQL injection, the broken auth and the race condition, then writes the fix, tests it, and opens the pull request. It runs on every system we build, and on the estate you already have.

Security is not a phase at the end of our delivery. It is a gate every branch passes through.

// what a finding arrives with

The reproduction

The issue is reproduced, not just flagged.

The fix, tested

A patch that has been through your test suite.

The reasoning

Why the fix is the fix, written for the reviewer.

A human on the merge

It arrives as a pull request, reviewed and merged by your team.

// how it works

Finding the bug is the easy half.

A scanner that only produces findings hands your team a backlog. DevSec closes the loop, and closing it is the part that reduces risk.

01

Find it

Semantic analysis over the code, rather than pattern matching across it.

02

Reproduce it

The issue is demonstrated, so triage is not an argument about whether it is real.

03

Fix and test it

A patch is written and put through the tests before anyone is asked to look at it.

04

Open the PR

Your engineers review and merge. The agent proposes; it never decides.

1,153

Repos scanned

5,572

Vulnerabilities found

1,457

Autofixes generated

92%

Autofix PRs merged

As of Q3 2026 Platform figures, restated each quarter rather than left to age.

Merge rate is the number we watch. Ninety-two percent of the pull requests DevSec opens get merged, which is the only metric that says the work actually got done.

// what it catches

Beyond pattern matching.

Data-flow and control-flow analysis follows untrusted input through the code, which is how it reaches the classes of bug that regex-based tools miss.

Injection

Untrusted input reaching a query or command, traced from where it enters.

Broken authentication and authorisation

Access paths that hold in isolation and fail once the layers are read together.

Concurrency

Race conditions that only appear under interleaving a reviewer will not simulate by hand.

TAINT TRACECWE-89 · critical
SOURCEroutes/report.ts:18
req.query.filter
PROPAGATESReportBuilder.ts:31
buildWhere(filter)
STOREDReportBuilder.ts:39
this.clause
SINKReportBuilder.ts:47
db.raw(`… ${this.clause}`)
✓ Reproduced end to end — not pattern-matched.

// the product

Review, fix, merge.

A finding arrives with the vulnerable path, the CWE, and a proposed patch. Approve it and the agent opens the pull request with regression tests attached. The finding closes itself.

Kolega DevSecservicing-api · maindeep-ai scan · 12 findings

FINDINGS · 3 CRITICAL · 5 HIGH

CRITSecond-order SQL injection

ReportBuilder.ts:47

CRITJWT audience confusion

auth.ts:112

CRITUnsafe deserialization

Loader.ts:89

HIGHMissing rate limit on reset

password.ts:64

HIGHPath traversal in export

exporter.ts:21

HIGHSSRF via webhook target

webhooks.ts:73

HIGHWeak randomness in token

tokens.ts:29

HIGHVerbose error leaks schema

errors.ts:44

+ 4 medium and low

Second-order SQL injection

CWE-89fnd_8a2c

A filter stored on the builder is interpolated into a raw query on a later call. The two halves are safe read alone, which is why pattern matching misses it.

PROPOSED PATCH · ReportBuilder.ts

  buildWhere(filter: Filter) {

-   this.clause = `status = '${filter.status}'`;

+   this.clause = { sql: 'status = ?', bindings: [filter.status] };

}

  run() {

    const where = this.buildWhere(this.filter);

-   return db.raw(`SELECT * FROM loans WHERE ${where}`);

+   return db('loans').whereRaw(where.sql, where.bindings);

}

✓ 14 regression tests added✓ suite green✓ no behaviour change

Approve & open PRDismisslast approved → PR #482

// realvuln leaderboard

The scores, in public.

Engine Score

Kolega DevSec Max 86.5

Kolega DevSec Core 69.9

Kolega Scan (OSS) 65.2

GPT-5.5 56.7

SonarQube 14.4

Semgrep 7.4

// methodology

66 repositories, 133,782 lines of code, scored under strict F3. We initiated the benchmark and publish the methodology so the numbers can be reproduced rather than taken on trust.

Figures are pinned to a benchmark version and snapshot date; they move when the benchmark does, and we republish rather than quietly restate.

realvuln.com ↗

// noise

A tool your team stops reading is a tool that isn't working.

Scanner fatigue is the reason most security programmes stall. Four mechanisms keep the queue small enough to act on.

Won't-Fix memory

A finding your team has judged and dismissed stays dismissed. It doesn't come back next scan wearing a new ID.

Logical grouping

Fifty instances of one root cause arrive as one ticket, with the instances attached, not as fifty tickets competing for the same fix.

Context-aware filtering

A pattern that's only exploitable in a path your code never reaches doesn't get reported as though it were.

Priority intelligence

Ordering reflects reachability and blast radius, so the top of the queue is genuinely the thing to fix first.

// cli

The whole thing, in your terminal.

The CLI exposes the full API: authenticate, scan, triage findings, generate fixes, and open pull requests without leaving the shell. Which is what makes it a CI gate rather than a dashboard someone remembers to check.

$ npm i -g @kolegaai/cli 

zsh — kolega

$kolega auth login
paired with org · token stored 0600
$kolega repos list
servicing-api   default   main
$kolega scans start default --type deep-ai --wait
⠿deep-ai scan running
✓scan complete
12 findings · 3 critical · 5 high

npm · @kolegaai/cli · requires Node.js 22+

// trust

"You want us to send you our source code."

It's the first question in every regulated procurement, and it deserves a straight answer rather than a badge on a trust page.

Controls aligned with SOC 2 and ISO 27001; certification in progress.

Scanning is ephemeral

Analysis runs in a workspace that is destroyed when the scan ends.

Your code is never stored at rest

Findings and evidence persist. The source does not.

Self-hosted runners

Where policy requires it, the engine runs inside your perimeter and nothing crosses the boundary.

Every fix PR carries a regression test

The issue cannot silently return, and the reviewer can see why.