SPHIOR Logo
SPHIOR

SPHIOR CODE

Ship secure code without slowing down.

Install once. Every pull request and push gets a deterministic code review plus dependency vulnerability scan — SAST findings, SCA alerts, fix guidance, and CVSS scores appear right in your GitHub workflow. No AI, no config, no context switching.

SAST — 12 languagesSCA — 8 ecosystemsZero config
auth/session.ts
12const email = req.query.email;
13
14const user = await db.query(
15 'SELECT * FROM users WHERE email = ' + email
16);
CriticalCWE-89SQL built from untrusted input

Use a parameterized query. Pass the value as an argument instead of concatenating it.

Supported languages

TypeScript
JavaScript
Python
Go
Java
Ruby
PHP
SQL
C#
Rust
Kotlin
Swift

How it works

From pull request to security feedback in seconds.

SPH 01

PR / Push

Install once. Every code change is automatically reviewed before it ships.

SPH 02

SAST + SCA

Vulnerabilities in your code and dependencies — found in seconds, not sprints.

SPH 03

Check Run

Fix instructions appear right in your pull request. No dashboards, no context switching.

SPH 04

Monthly Report

Every scan becomes audit-ready evidence. Compliance runs itself.

Where it runs

In the editor you already use.

Nothing to log into. Findings appear on the line that caused them, and your AI assistant can read them through MCP.

Extensions
sphior
SPHIOR CODEv0.1.0

Deterministic secrets and insecure-pattern (CWE) detection. No AI, no source upload.

sphiorNo account needed — analysis runs on your machine
Install

Your AI assistant reads the findings and fixes them — with the file, the line and the reason already in hand.

Cursor
Claude Code
VS Code
GitHub Copilot
Cline
Continue
Windsurf
Zed
JetBrains AI
Cursor
Claude Code
VS Code
GitHub Copilot
Cline
Continue
Windsurf
Zed
JetBrains AI