NEW — Codebase Health Scanner

Detect security vulnerabilities in your codebase before they ship

ORA Bug Hunt scans for 50+ vulnerability patterns — the same class that caused Lovable's CVE-2025-48757 breach in April 2026. Static analysis. No live HTTP requests. No risk to your production systems.

Scan my repo — Start freeSee all 50+ patterns ↓
No credit card required · 10 free scans · Connect GitHub in 30 seconds
50+
Vulnerability patterns
15
Secret types detected
11
CVE-vulnerable deps
0
Live HTTP requests
What Bug Hunt detects

Every pattern. Every category. Every commit.

Pure regex static analysis. Zero LLM cost on the scan path. Findings ship with file:line + severity + plain-English explanation.

🛡

Secret Types (15)

  • AWS access keys AKIA...
  • GCP service account keys AIza...
  • Stripe live keys sk_live_...
  • GitHub PATs ghp_...
  • JWT secrets hardcoded in source
  • RSA private keys -----BEGIN RSA
  • SendGrid API keys SG.
  • Slack tokens xox...
  • Twilio auth tokens
  • Mailgun API keys
  • Cloudflare API tokens
  • Heroku API keys
  • npm tokens
  • MongoDB connection strings with credentials
  • .env values committed in non-.env files
🐞

Vulnerable Code Patterns (20)

  • Log4Shell — ${jndi: in any string
  • eval() with user input
  • exec() with user input
  • pickle.loads() on untrusted data
  • yaml.load() without Loader (use safe_load)
  • subprocess with shell=True + user input
  • os.system() with user input
  • XML parsing without defusedxml
  • dangerouslySetInnerHTML in React
  • document.write() with user data
  • innerHTML with user data
  • SQL string concatenation (f"SELECT...{var}")
  • NoSQL operator injection ($where/$expr in input)
  • Path traversal (../ in file operations)
  • SSRF (fetch/requests with user-supplied URL)
  • Prototype pollution in JS
  • Command injection via template literals
  • Regex catastrophic backtracking
  • Insecure random (Math.random for security)
  • Hardcoded cryptographic keys
🔒

Exposed Endpoints (10)

  • /debug route without authentication decorator
  • /console route without auth
  • /admin route without auth check
  • /actuator endpoint exposed
  • /metrics with sensitive data
  • Stack traces returned to API clients
  • API keys in URL query parameters
  • /swagger or /docs in production without auth
  • /.env file accessible via web
  • /phpinfo.php or debug pages
⚠

CVE-Vulnerable Dependencies (11)

  • requests < 2.31.0 — SSRF (CVE-2023-32681)
  • flask < 2.3.3 — multiple CVEs
  • django < 4.2.4 — SQL injection
  • pillow < 10.0.1 — buffer overflow
  • cryptography < 41.0.3 — multiple
  • pyyaml < 6.0.1 — arbitrary code exec
  • paramiko < 3.3.1 — auth bypass
  • aiohttp < 3.8.5 — request smuggling
  • jinja2 < 3.1.3 — SSTI
  • werkzeug < 3.0.1 — path traversal
  • numpy < 1.24.0 — buffer overflow
How it works

Three steps. Under 60 seconds.

No IDE. No setup. Authorise once and ORA does the rest.

STEP 01
⌥
Connect GitHub
Authorize once. ORA reads your repository structure and file contents. Your code never leaves your control — scanned in-memory, never stored.
STEP 02
⌕
Run Bug Hunt
Click the Bug Hunt tile in the Codebase Health Dashboard. ORA scans up to 600 files in parallel, applying all 50+ patterns. Takes under 60 seconds for most repos.
STEP 03
✓
See findings with file:line
Every finding shows the exact file path, line number, code snippet, severity (Critical/High/Medium), and a plain-English explanation of why it's dangerous. One-click fix queues a real code change.
Comparison

No other AI coding tool does this

Cursor, Copilot, Lovable, and Devin have no equivalent of Bug Hunt. Static analysis at commit time is unique to ORA.

FeatureORA Bug HuntCursorGitHub CopilotLovableDevin
Secret detection (15 types)All 15✗✗✗✗
Vulnerable code patterns20 patterns✗✗✗✗
Exposed endpoint detection10 checks✗✗✗✗
CVE dependency scanner11 packages✗✗Partial✗
Runs before every commitVanguard✗✗Had breach✗
Static analysis (no HTTP)SafeN/AN/AN/AN/A
One-click fix per finding✓✗✗✗Partial
Price$9/month$20/month$10/month$20+/month$500/month
* Lovable had CVE-2025-48757 (April 2026) — 48 days of exposed user source code and database credentials due to missing authorization checks. ORA's Vanguard scanner detects this class of vulnerability before it reaches production.

Start scanning your codebase today

10 free Bug Hunt scans. No credit card. Connect your GitHub in 30 seconds.

Start free — auremcto.com
498 of 500 founder spots remaining at $9/month