- Home
- Security audits
- Code analysis
Source code analysis: your code never leaves your server
One command on your server or workstation is enough. The KrakenShield agent analyses the code on site, lists dependencies and embedded libraries, looks for known vulnerabilities, secrets and security mistakes, then sends only the results.
2 to 5 Kredits
- No line of code sent
- Linux, macOS and Windows
- Single-use command
Third-party components, secrets and your own code
Known vulnerabilities are cross-checked with the public OSV and EPSS databases and the CISA KEV catalogue of exploited flaws.
Dependencies
Inventory of declared packages (npm, Composer, Python and others), versions and known vulnerabilities with their CVE reference.
Embedded libraries
Files copied by hand into the project (jQuery, Bootstrap, PHPMailer…) are recognised by their signature, even without a package manager.
Secrets
API keys, passwords and tokens left in code or configuration, before they leak.
Security mistakes
SQL or command injection, code execution, deserialisation and other dangerous patterns in your own code.
Priorities
Severity, exploitation probability (EPSS) and confirmed exploitation (KEV), to fix first what is really attacked.
Software inventory
The list of components and their licences, useful for your customers, your audits and upcoming European regulation.
One command, no code sent
- 1
Create a command
In the console, name your project: you get a single-use command, valid for one hour, for Linux, macOS or Windows.
- 2
Run it on your side
The agent measures the size of the code and shows the cost before starting. Nothing leaves without your confirmation.
- 3
Read the report
Only results are sent. Flagged lines stay in a local report, on your machine.
A report a developer and a manager can both read
Third-party components come first, with the fixed version to install.
- Vulnerable components with CVE, severity and fixed version
- Outdated embedded libraries flagged first
- Secrets and security mistakes grouped by rule, with the fix
- PDF report and component inventory
- Comparison of two analyses to track fixes
Analysis cost, by code size
2 Kredits up to 20 MB, 3 up to 100 MB, 5 up to 1 GB
The agent measures the code and shows the cost before starting. It is deducted only if the analysis succeeds.
A Kredit costs €29 to €19.03 excl. VAT depending on the pack.
PricingWhat the analysis does not do
- It does not test the running application: that is the penetration test’s job.
- It does not fix the code for you: it says what to change and where.
What people ask us
Is my code sent to KrakenShield?
No. The agent runs on your machine and only sends results: component names and versions, triggered rules, files concerned. Flagged code excerpts stay in a local report that only you can read.
What do I need to run the agent?
A bash terminal on Linux or macOS, or PowerShell on Windows with Git for Windows. The agent checks its own integrity before starting.
How long does the analysis take?
From a few seconds to a few minutes depending on the size of the project. Progress is shown in the terminal and in the console.
Which technologies are supported?
The main ecosystems (JavaScript, PHP, Python and others) for dependencies, plus detection of libraries copied by hand into the project.
