Skip to main content

Get a free FHIR vulnerability scan, funded by Cantina.

Application Security

Find and fix security defects before code merges

Apex reviews repositories and pull requests for exploitable vulnerabilities, generates patches, and checks the fixes. Engineers get the findings in their code review process.

Book a code review demo

Review how a change affects the security of the application

A small code change can alter who gets access or how the application handles untrusted input. Apex examines the changed code in the context of the repository to find security defects that depend on how different parts of the application interact.

Change under review

TemplateController.java 
  @RequestMapping("/render")
  String render(@RequestParam String tpl) {
-   return renderer.parse(escape(tpl));
+   return renderer.parse(tpl);
  }

Trace through the repository

  • tpl (request param)

    untrusted input

  • TemplateController.render

    escape() removed

  • SpEL expression evaluator

    evaluates raw string

Finding & patch

Expression injection → RCE

confirmed · CVSS 9.8

Patch restores input validation

proposed change

Submitted to your PR review

Trace the vulnerability and propose the code change

  1. 01

    Review the repository or pull request

    Examine the relevant code and the paths that reach it.

  2. 02

    Validate the finding

    Determine whether an attacker can exploit the issue and what the impact would be.

  3. 03

    Prepare a patch

    Generate a fix and submit it for review according to your policy.

  4. 04

    Check the remediation

    Retest the original finding against the patch.

Make security findings useful during code review

Repository reviews

Examine security assumptions across the codebase.

Pull request scans

Review changed code in CI and post checks and comments on the PR.

Exploitability checks

Establish whether the suspected defect can be reached and exploited.

Fix reviews

Check whether the patch resolves the finding and introduces other issues.

Case study

See how Apex found and patched a Spring AI vulnerability

Apex traced unvalidated input into an expression evaluator, confirmed a path to remote code execution, and generated a patch.

Read the Spring AI case study

What security teams say about Cantina

Trend Health Partners Security leadership
Cantina is the first platform we have used that carries the work through from finding an issue to driving the fix, and it lets my team operate like one far larger than it is. We keep finding new uses for it across our security program.

Matt Mock

Chief Information Security Officer

Review a code change with Apex

See the finding, proposed patch, and fix review in a demo.

Book a code review demo