About Kelrova
Security review should read your code the way an attacker does.
Kelrova is a cloud security scan for code repositories. It reads across the whole project instead of matching patterns file by file, and reports what an attacker could reach, with the evidence behind each finding.
Why Kelrova exists: the depth of a manual review, at the cadence of a scan.
File by file
Pattern matching reads one file at a time and flags what looks familiar. The weaknesses that hurt often sit between files: a check in one place, a missing one in another, a value from the client trusted three calls later. Finding those has taken a manual review, which is thorough but slow, so it happens rarely.
The whole project
Kelrova makes that kind of reading an AI security scan you can run any day. You choose the depth, from the files you changed to the whole project, and Adversary, on Pro and above, works through it from an attacker's point of view. A small team can run it before a release and on a schedule, without waiting for the next audit.
What we believe
Four principles decide what a scan reports and how you act on it.
Evidence before noise
Every finding names the file and line and shows the code behind it, and Adversary findings add the attack path that reaches it.
The whole project is the unit of review
A scan reads code across files rather than one at a time, so a check in one place and a gap in another show up together.
Fixes belong in your own loop
Go Fix opens a pull request for you to review, the MCP server hands findings to your own agent, and a re-check confirms the fix once it is merged.
Privacy by construction
Scans run in an isolated cloud runtime with access only to the repositories you choose, and they never change your code: a pull request opens only when a member asks Go Fix for one.
How we work
A small team, reachable by email, and plain about what a scan can and cannot do.
- Team
- Kelrova is built by a small team, and the people who build it are the ones who answer you.
- Support
- By email, answered directly by the team. Write to us from the contact page.
- Limits
- A scan is a reviewer, not a guarantee. It can miss a weakness, and a clean result means nothing was found at the level you chose, not that nothing is there. Read more on the security page of the docs.