AI code security reviews

Find the vulnerabilities scanners miss.

Tachyon reviews every PR in full-codebase context, validates exploitability, and gives developers fix-ready findings before code merges.

Validated vulnerabilities in MLflow, AutoGPT, authentik, and more.

PR #1842 · tenant file downloads

apps/api/src/FileController.ts

High
33
class FileController {
34
// Download endpoint used by every tenant
35
async downloadFile(req: Request, res: Response) {
36
const { tenantId, fileId } = req.query;
37
38
const file = await storage.getById(fileId);
39
if (!file) {
40
return res.status(404).send('Not found');
41
}
42
43
return res.download(file.path);
44
}
45
}

Missing tenant isolation

Broken access control · IDOR

downloadFile resolves fileId from the query string and returns the file without checking ownership. Any authenticated user can request another tenant's file by guessing its id.

Suggested fix

Verify file.tenantId === tenantId before returning the path.

What runs on every pull request

Tachyon reviews each PR against a map of the full repository and validates that a finding is exploitable before it reports it.

Whole-repo context

Every PR review runs against a map of the full codebase — data flow, auth patterns, and service boundaries.

Exploit validation

Findings are checked for reachability, and validated by sandbox execution where possible, before you see them.

Works in your PR flow

Connect GitHub, GitLab, or Bitbucket. Findings land as PR comments and Jira or Linear tickets.

How a PR review runs

1

Connect your repos

Link your GitHub, GitLab, or Bitbucket repositories. Tachyon clones to a secure sandbox and begins mapping your codebase architecture.

Repository connection interface

Found in the wild

Vulnerabilities Tachyon found in open-source projects, publicly disclosed.

AutoGPT
critical
CVSS 9.4CVE-2026-24780

Remote Code Execution via Disabled Block Execution

OpenClaw
critical
CVSS 9.3

Path Traversal in Plugin Installation

authentik
critical
CVSS 9.1CVE-2026-25227

Authenticated RCE via Policy/Property Mapping Test Endpoint

MLflow
high
CVSS 8.1CVE-2025-14297

Authorization Bypass in MLflow Basic Auth

All disclosures

Review every PR before it merges

The same analysis that found critical vulnerabilities in AutoGPT, authentik, and MLflow — run on your pull requests.