NEW — Codebase Health Scanner
Detect security vulnerabilities in your codebase before they ship
ORA Bug Hunt scans for 50+ vulnerability patterns — the same class that caused Lovable's CVE-2025-48757 breach in April 2026. Static analysis. No live HTTP requests. No risk to your production systems.
No credit card required · 10 free scans · Connect GitHub in 30 seconds
What Bug Hunt detects
Every pattern. Every category. Every commit.
Pure regex static analysis. Zero LLM cost on the scan path. Findings ship with file:line + severity + plain-English explanation.
Secret Types (15)
- AWS access keys
AKIA... - GCP service account keys
AIza... - Stripe live keys
sk_live_... - GitHub PATs
ghp_... - JWT secrets hardcoded in source
- RSA private keys
-----BEGIN RSA - SendGrid API keys
SG. - Slack tokens
xox... - Twilio auth tokens
- Mailgun API keys
- Cloudflare API tokens
- Heroku API keys
- npm tokens
- MongoDB connection strings with credentials
- .env values committed in non-.env files
Vulnerable Code Patterns (20)
- Log4Shell — ${jndi: in any string
- eval() with user input
- exec() with user input
- pickle.loads() on untrusted data
- yaml.load() without Loader (use safe_load)
- subprocess with shell=True + user input
- os.system() with user input
- XML parsing without defusedxml
- dangerouslySetInnerHTML in React
- document.write() with user data
- innerHTML with user data
- SQL string concatenation (f"SELECT...{var}")
- NoSQL operator injection ($where/$expr in input)
- Path traversal (../ in file operations)
- SSRF (fetch/requests with user-supplied URL)
- Prototype pollution in JS
- Command injection via template literals
- Regex catastrophic backtracking
- Insecure random (Math.random for security)
- Hardcoded cryptographic keys
Exposed Endpoints (10)
- /debug route without authentication decorator
- /console route without auth
- /admin route without auth check
- /actuator endpoint exposed
- /metrics with sensitive data
- Stack traces returned to API clients
- API keys in URL query parameters
- /swagger or /docs in production without auth
- /.env file accessible via web
- /phpinfo.php or debug pages
CVE-Vulnerable Dependencies (11)
- requests < 2.31.0 — SSRF (CVE-2023-32681)
- flask < 2.3.3 — multiple CVEs
- django < 4.2.4 — SQL injection
- pillow < 10.0.1 — buffer overflow
- cryptography < 41.0.3 — multiple
- pyyaml < 6.0.1 — arbitrary code exec
- paramiko < 3.3.1 — auth bypass
- aiohttp < 3.8.5 — request smuggling
- jinja2 < 3.1.3 — SSTI
- werkzeug < 3.0.1 — path traversal
- numpy < 1.24.0 — buffer overflow
How it works
Three steps. Under 60 seconds.
No IDE. No setup. Authorise once and ORA does the rest.
STEP 01
Connect GitHub
Authorize once. ORA reads your repository structure and file contents. Your code never leaves your control — scanned in-memory, never stored.
STEP 02
Run Bug Hunt
Click the Bug Hunt tile in the Codebase Health Dashboard. ORA scans up to 600 files in parallel, applying all 50+ patterns. Takes under 60 seconds for most repos.
STEP 03
See findings with file:line
Every finding shows the exact file path, line number, code snippet, severity (Critical/High/Medium), and a plain-English explanation of why it's dangerous. One-click fix queues a real code change.
Comparison
No other AI coding tool does this
Cursor, Copilot, Lovable, and Devin have no equivalent of Bug Hunt. Static analysis at commit time is unique to ORA.
| Feature | ORA Bug Hunt | Cursor | GitHub Copilot | Lovable | Devin |
|---|---|---|---|---|---|
| Secret detection (15 types) | All 15 | ✗ | ✗ | ✗ | ✗ |
| Vulnerable code patterns | 20 patterns | ✗ | ✗ | ✗ | ✗ |
| Exposed endpoint detection | 10 checks | ✗ | ✗ | ✗ | ✗ |
| CVE dependency scanner | 11 packages | ✗ | ✗ | Partial | ✗ |
| Runs before every commit | Vanguard | ✗ | ✗ | Had breach | ✗ |
| Static analysis (no HTTP) | Safe | N/A | N/A | N/A | N/A |
| One-click fix per finding | ✓ | ✗ | ✗ | ✗ | Partial |
| Price | $9/month | $20/month | $10/month | $20+/month | $500/month |
* Lovable had CVE-2025-48757 (April 2026) — 48 days of exposed user source code and database credentials due to missing authorization checks. ORA's Vanguard scanner detects this class of vulnerability before it reaches production.
Start scanning your codebase today
10 free Bug Hunt scans. No credit card. Connect your GitHub in 30 seconds.
Start free — auremcto.com$9/month · flat pricing · 10 free scans, no credit card