Platform

How Tenzai works

A scan-and-fix engine built for application security teams who need to close holes, not just catalog them.

SAST

Static analysis

DAST

Dynamic analysis

CVE

Dependency checks

Architecture

Continuous scanning across your full call graph

Tenzai combines static analysis, reachability analysis, and CVE cross-referencing to find vulnerabilities that matter, filtering out findings that cannot be reached in production. Runs on push via webhook or on a schedule you configure.

Scan pipeline overview

Authorize Repo
Continuous Scan
Finding + Fix Report

Static analysis (SAST)

Parses your codebase to detect insecure patterns, injection points, and dangerous data flows across your full call graph before runtime.

Dynamic analysis (DAST)

Tests running application endpoints with crafted payloads to surface runtime vulnerabilities that static analysis alone cannot see.

Dependency analysis

Cross-references your dependency tree against CVE databases, including transitive dependencies and reachability analysis to reduce noise.

Fix generation

Every finding includes a ready-to-review patch

For each confirmed vulnerability, Tenzai generates a patch scoped to the affected function, validated against your test suite fingerprint, and scored for confidence. Developers see the proposed change, not a ticket with a generic description.

  • Scoped to the affected function

    No broad rewrites. The fix targets the exact code path with the vulnerability.

  • Confidence score per proposal

    Know how certain the model is before applying. Requires extra review only when flagged.

  • Explanation alongside the diff

    Developers understand why the fix is correct, not just what changed.

src/api/auth.py SQL Injection 
 def get_user(user_id):
-    query = "SELECT * FROM users WHERE id = %s" % user_id
-    return db.execute(query)
 
+    return db.execute(
+        "SELECT * FROM users WHERE id = %s",
+        (user_id,))

Integrations

Works inside your existing workflow

Tenzai connects to your repository host and posts findings as pull request comments or Slack and Teams notifications. CI checks block merges above your configured severity threshold. No new tool for your developers to learn.

GitHub GitLab Bitbucket Slack Teams Jira CI/CD webhooks

PR comment findings

Findings appear directly on pull requests with the proposed fix inline, so developers review and apply without leaving their workflow.

Severity-gated CI checks

Configure your severity threshold. Tenzai posts a failing CI status when a finding exceeds it, blocking merges until the fix is applied.

Team notifications

Route critical findings to your Slack or Teams channel. Security leads see the issue and the fix at the same time the developer does.

See Tenzai in your repository.

Set up in under five minutes. First scan results in under an hour.

Try it free Read the docs