SQL injection in order search
Critical42 const q = `SELECT * FROM orders
43 WHERE ref = '${req.query.ref}'`;44 await db.raw(q);Fix: use a parameterised query.
Illustrative example
Every model misses something. Several, cross-checked, miss far less.
Yakiba puts several independent AI auditors on your codebase, has them cross-check each other, and sends you one clear, prioritised security report. Fixed price. Read-only access. Report in about 48 hours.
One repo · One-off payment · No subscription required
How it works
Pay.
One fixed price of US$450 per repository, paid securely by card. No sales calls, no seat licences.
Connect a GitHub repo, read-only.
Install the Yakiba GitHub App on the one repo you want audited. It can read code. It can't write, push or change anything.
Get your report in about 48h.
A prioritised, de-duplicated report lands in your inbox, with evidence and a suggested fix for every finding.
Several independent AI auditors, cross-checking each other
One model reviewing your code is one opinion. Yakiba runs several different AI models over the same repo independently, then compares what they found.
- Findings confirmed by more than one auditor are ranked higher, so the real issues rise to the top.
- Different models catch different classes of bugs, so the combined review covers more ground.
- Results are merged and de-duplicated, so you read one report, not five.
What's in the report
- Executive summary
- A plain-English overview of your risk, for founders, boards and investors.
- Prioritised findings
- Each issue ranked by severity and by how many auditors agreed. CriticalHighMediumLowInfo
- Evidence and location
- The file, the lines, and why it matters.
- Suggested fixes
- Practical remediation guidance your developers can act on.
- OWASP Top 10 and CWE mapping
- Findings mapped to recognised standards, handy for security questionnaires.
- One free retest
- Fix the issues, then rescan within 30 days to confirm they're closed.
Yakiba is an automated code review. It is not a penetration test or a compliance attestation.
Your code, handled like it's ours
- Read-only access
- Our GitHub App only requests permission to read the repo you choose. Uninstall it any time.
- Deleted after the scan
- Your code is processed in an isolated environment and deleted when the scan completes.
- Never used for training
- We don't train or fine-tune any model on customer code. Full stop.
Stay sharp with Monitor
An audit is a snapshot. Monitor keeps watching as your code changes, and catches new issues before they ship.
Monitor Starter
US$149/month
- 1 repository
- Weekly full scan
- Scan of every merged pull request
- Email alerts
- Monthly report
Monitor Team
US$399/month
- Up to 5 repositories
- Every pull request scanned, with GitHub comments
- Slack alerts
- Monthly report
- Quarterly full re-audit
Pay annually and get two months free. Already had an audit? Your first month is on us.
Agency partner programme
Build software for clients? Hand over every project with an independent security review, under your brand or ours.
- White-label audits
- Prepaid audit packs at partner rates, with reports carrying your branding.
- Monitor for your clients
- Partner pricing on Monitor, to fold into your care and maintenance retainers.
- Referral
- Prefer not to resell? Earn a share of first-year revenue for every client you refer.
FAQ
Is this a penetration test?
No. Yakiba is an automated source code review. It finds vulnerabilities in your code, but it isn't a human-led penetration test or a compliance attestation. Many teams use it to clean up before a pentest or a SOC 2 audit.
Which languages do you support? Confirm
Most common web and backend languages, including TypeScript, JavaScript and Python. If you're unsure, get in touch before you buy.
Do you support GitLab or Bitbucket? Confirm
GitHub only at launch. GitLab and Bitbucket are on the roadmap.
Is a human involved?
No. The audit is fully automated, which keeps the price fixed and the turnaround fast.
What if the report finds nothing serious?
Great news, and you'll have a dated report showing the review was done. No automated review can guarantee your code is free of vulnerabilities.
How big a repo can you audit? Confirm
One repository per audit. For very large monorepos, contact us first.
Can I get a refund? Confirm
If we can't complete the scan, you get a full refund.