AI STATIC APPLICATION SECURITY TESTING

Find what's
wrong in the
code you wrote.

Traditional SAST tools flood your backlog with thousands of findings, most of which are false positives or unreachable dead code. 00felix scans your first-party code, traces whether user-controlled input can actually reach each vulnerable function, and validates every finding with AI before it becomes a ticket. Only real, reachable, exploitable vulnerabilities make it through.

sast scan: acme-corp/payments-service
files analyzed4,312
raw findings847
user input can reach64
AI-validated findings19
false positives dismissed783
FIRST-PARTY CODE SCANNING

Vulnerabilities in
the code you ship.

00felix performs static analysis directly on your source code across Java, JavaScript, Python, and .NET, without instrumentation, without agents, and without production access. It parses the abstract syntax tree of every file and traces data flows through your functions, classes, and modules to identify where unsanitized data can reach dangerous operations.

Every finding is anchored to the exact file, class, and line number where the vulnerability exists, not a vague category. SQL injection in UserRepository.java at line 84 is a different finding from SQL injection in OrderService.java at line 211, and 00felix treats them that way.

sast scan · payments-service/src
// files parsed: 4,312
AST constructed · data flow graph built
taint sources identified: 312 entry points
 
// findings by category
SQL injection      · 14 locations
XSS               · 23 locations
Hardcoded secrets  · 8 locations
Path traversal     · 6 locations
Insecure deserialization · 3 locations
 
847 raw findings · 4,312 files · 0 false assumptions
FINDING TYPES

Every class of vulnerability
in your own code.

SQL Injection
User input flowing into raw SQL query construction without parameterization, traced from HTTP request to database call.
Cross-Site Scripting
Unsanitized user-controlled data rendered into HTML responses, including reflected, stored, and DOM-based patterns.
Hardcoded Secrets
API keys, passwords, tokens, and private keys embedded directly in source code, configuration files, or test fixtures.
Path Traversal
File system operations using user-controlled input without sanitization, allowing directory traversal outside intended boundaries.
Insecure Deserialization
Deserialization of untrusted data using unsafe patterns or gadget-chain-vulnerable libraries in first-party code.
Command Injection
User input passed to shell execution functions, system calls, or process builders without escaping or allowlisting.
taint flow analysis · OrderController.java
IN
TAINT SOURCE
request.getParameter("orderId") · line 34
user-controlled HTTP query param
PROPAGATES THROUGH
OrderService.getOrder(orderId) · line 41
passed unmodified, no sanitization
PROPAGATES THROUGH
OrderRepository.findById(id) · line 87
id concatenated into query string
!
TAINT SINK
jdbcTemplate.query("SELECT * FROM orders WHERE id=" + id) · line 91
raw SQL execution with tainted input
CONFIRMED: SQL injection · user input reaches raw SQL sink without sanitization
TAINT FLOW ANALYSIS

Trace every path from user input to vulnerable function.

00felix builds a taint flow graph of your entire codebase. Every source of user-controlled input (HTTP parameters, request bodies, headers, file uploads, environment variables) is marked as tainted. 00felix then follows that taint through every function call, assignment, and branch until it either reaches a dangerous sink or is sanitized.

If user-controlled input cannot reach the vulnerable function, the finding is deprioritized. Most raw SAST findings fail this test. Only findings where a real user, sending a real request, can trigger the vulnerability are surfaced.

AI-VALIDATED FINDINGS

Tainted doesn't always mean exploitable.
AI validates the difference.

Taint analysis tells you that user input can reach a dangerous function. It doesn't tell you whether the specific input path is actually exposed to an untrusted caller, or whether there's existing validation logic in another layer that 00felix's static view can't see. 00felix runs an AI validation pass on every tainted finding to evaluate real-world exploitability: is this endpoint publicly reachable? Does the input get validated at the API layer before it arrives here? Is there an ORM or prepared statement one layer above that the raw query below it never actually executes with user data?

Findings that clear AI validation are confirmed and queued for fixing. Findings that don't are dismissed with a specific, readable reason, not silently dropped, not sent to a black hole. Every decision is visible and can be overridden.

ai validation pass
SQL injection AI reviewed
OrderRepository.java:91 · user param to raw query
● CONFIRMED
XSS AI reviewed
CommentController.java:44 · unescaped render
● CONFIRMED
Path traversal AI reviewed
FileService.java:113 · filename from request
✕ DISMISSED · input validated at API gateway
SQL injection AI reviewed
ReportService.java:67 · internal scheduler only
✕ DISMISSED · no user-controlled input reaches sink
Hardcoded secret AI reviewed
PaymentConfig.java:12 · API key in source
● CONFIRMED
THE SAST PIPELINE

From source code to
confirmed finding in one pass.

01
Parse source and build the AST
00felix parses every source file and constructs an abstract syntax tree. This is the foundation for all data flow analysis: every function, variable, branch, and call site is represented as a node in the graph.
02
Identify taint sources
Every entry point where user-controlled data can enter the application is marked as a taint source: HTTP parameters, request bodies, headers, cookies, file upload content, environment variables, and external API responses.
03
Trace taint flow to dangerous sinks
00felix follows tainted data through function calls, assignments, and control flow branches until it reaches a sink: SQL execution, HTML rendering, file system operations, shell commands, or deserialization functions. Paths that include proper sanitization are cleared.
04
AI validates every tainted finding
Each finding where taint reaches a sink is evaluated by AI for real-world exploitability: is the endpoint publicly exposed? Does upstream validation exist that static analysis could not see? Findings are confirmed or dismissed with a visible, auditable reason.
05
Deliver a confirmed, prioritized list
What comes out is a short list of confirmed, taint-reachable, AI-validated vulnerabilities with exact file and line locations. No false positives from dead code. No findings on endpoints that aren't exposed. No noise.
WHAT HAPPENS NEXT
00felix confirmed it.
Now it fixes it.
Verified Upgrade takes every confirmed SAST finding and patches it at the source: the vulnerable code is rewritten, the fix is verified against your build, and a PR is opened for your team to review and approve.
SEE HOW VERIFIED UPGRADE WORKS →
GET STARTED TODAY · FREE ON ANY REPO

Find out what's actually
exploitable in code you wrote.

Run 00felix SAST on any GitHub repo in minutes.
No setup. No sales call. No credit card.