AI code security reviews for modern engineering teams

Find the vulnerabilities scanners miss.

Tachyon reviews every PR in full-codebase context, validates exploitability, and gives developers fix-ready findings before code merges.

Book a DemoExplore Platform

Validated vulnerabilities in MLflow, OpenWebUI, Gradio, AutoGPT, and more.

PR #1842 · tenant file downloads

apps/api/src/FileController.ts

High
37
class FileController {
40
// Download endpoint used by all tenants
41
async downloadFile(req: Request, res: Response) {
42
const { tenantId, fileId } = req.query;
43
const file = await storage.getById(fileId);
44
return res.download(file.path);
45
}
46
}

Missing tenant isolation

Tachyon validated that user-controlled file IDs can fetch another tenant's file before the authorization check runs.

Sourcereq.query.fileId
Sinkstorage.getById(fileId)
Missing checkfile.tenantId === tenantId

Suggested fix

Scope the lookup by tenant or verify ownership before returning the file path.

Defend your code with confidence.

Stop reacting to threats. Tachyon proactively guards your codebase, catching real security issues before they become problems.

Complete Code Protection

Tachyon watches your entire codebase continuously. It reviews every PR and commit to catch real threats before they reach production.

Validated Threats Only

No more chasing false positives. Tachyon validates every finding with reachability analysis and proof-of-concept exploits before alerting you.

Seamless Integration

Connect to GitHub, Gitlab, Bitbucket, Jira, Linear, and Notion. Get security insights where you work.

From push to protected

1

Connect your repos

Link your GitHub, GitLab, or Bitbucket repositories. Tachyon clones to a secure sandbox and begins mapping your codebase architecture.

Repository connection interface

Pricing for teams and open source

Start with public repositories, then add private repos, team workflows, and enterprise controls when you need them.

OSS

For public repositories

Free

  • Public repositories only
  • PR security reviews for public repos
  • 5 full-repo deep scans per month
  • GitHub App integration
  • Community support

Team

For growing engineering teams

$100/mo

  • Private repositories
  • Unlimited PR scans
  • 10 deep repo scans per month
  • Exploitability-validated findings
  • GitHub, GitLab, and Bitbucket source code integrations
  • Jira, Linear, Slack, and email workflows
  • Email support

Enterprise

For large organizations

Custom

  • Everything in Team, plus:
  • Unlimited repositories and deep scans
  • SAML/SSO and SCIM
  • Custom scan policies
  • VPC or on-prem deployment
  • Custom integrations and reporting
  • Security review and procurement support
  • Dedicated support and SLAs

Open Source Project?

Free access for public OSS repositories. Help us make open source more secure.

Apply Now

MSP or Partner?

White-label Tachyon for your clients. Custom branding and volume discounts.

Get in touch

Security Researcher?

Discounted access for independent security research.

Apply Now

Review every PR before it merges

Install Tachyon to find exploitable vulnerabilities, explain the attack path, and give developers fixes they can ship.