Get started

Meet Octopoda, security review for apps built with AI

Octopoda tests your code in a private sandbox, reports only what it can prove, and gives you a fix for your AI tool

Start free trialRead the docs
The Octopoda web app: the findings page lists eight proven findings in acme/acme-shop, each with its severity, type and the file and line it is in.
PR Open· acme/acme-shop #212

Add order export

sam-riveramainfeat/order-export12 files changed+8-14
Octopoda's check

Octopoda found 1 high in this pull request. Check failed. Any signed-in customer can read other customers' orders, shipping addresses included.

Proofreproduced in a private sandbox3 steps
The Octopoda web app: the findings page lists proven findings in acme/acme-shop, each with its severity and type.

Security review that keeps up with you

Activity
Proved: No limit on sign-in attempts24:50
Proved: Password reset links work more than once21:05
Proved: Admin refund endpoint accepts requests from any customer17:20
Checking whether customers can reach admin routes14:40
Proved: SQL injection in product search exposes the whole database11:45
Octopoda’s sandboxacme-shop on localhost:3000, two test customers
Testing 3/11
0:34Can one customer read another customer's orders?
0:36Do admin routes check for the admin role?
0:38Does product search pass input into SQL?
0:44Do password reset links work twice?
0:50Rate limits on sign-in
0:56Scripts in product reviews
1:00File names in order export
1:30Paths in the image route
1:44Requests the server makes for you
1:56Dependencies with known CVEs
2:00Secrets in API responses

Proves every issue in a private sandbox

Octopoda runs your app in its own sandbox and tries attacks the way an attacker would. It reports an issue in your code only once it has reproduced it

Search findings
Open
New
Fixed
Risk accepted
Open findings
SQL injection in product search
Customers can read others' orders
Admin refunds open to customers
Order export runs shell commands
Password reset links work twice
Fix prompt
Names the file and the change, ready to paste into your AI tool
AI toolCursor ⌄
SeverityHigh
Filesrc/routes/orders.ts
Re-tested on next scan
CVSS 7.1

Hands you the fix for your AI tool

Every finding comes with a prompt for Cursor or Claude Code that names the file and the change. Paste it in and review the diff

Scansacme
TargetStatusFindings
acme-shopPR #214Testing…
acme-shopPR #212Complete1
acme-shopmain · Web appComplete112
acme-shopmain · CLIComplete21
acme-shopPR #209CompleteAll clear
acme-adminmain · Web appCompleteAll clear

Keeps scanning while you keep shipping

Scans run in the cloud. Start one from your terminal or the web app, and get the result by email

Coding Agent~/acme-shop
You 11:55
Scan this project with Octopoda and fix anything critical or high.
Coding Agent 11:55
octopoda · scan
Octopoda proved 1 high. I applied its fix and added a test.
Changed: src/routes/orders.ts
Scanning again to confirm…

Works inside Cursor and Claude Code

Add the MCP server and your AI tool can start a scan, read each finding, and apply the fix itself

Pull request #212acme/acme-shop
Octopoda — check failed
1 high finding · scanned in 12 min
Octopoda commented 8:05 PM
Found 1 high in this pull request. It was reproduced in a sandbox before being reported.
Any signed-in customer can read other customers’ orders
High · src/routes/orders.ts
View finding

Checks every pull request

Turn on checks and every push to a pull request is scanned, with one comment listing what was proven

Stop shipping blind
Scan it with Octopoda

Start free trialRead the docs