Skip to content

Scans

A scan reads the whole project, not one file at a time.

Kelrova follows each entry point into the code behind it, from where a request comes in to where its data ends up. It reports only what it can back with evidence: each finding with its file, line and a suggested fix.

Get startedSee pricing

A drawing of a completed Standard scan on a sample project: 38 parts of the code reviewed, 5 new findings and 2 already known.

A completed Standard scan on a sample project.
01

Coverage levels

Choose the depth: changed files or the whole project.

Kelrova is an AI security scanner that reviews your code at the level you pick: deeper levels read more of it, take longer and cost more. Standard is the default, and the Basic trial runs Quick or Focused.

  1. Quick

    Fastest, lowest cost

    Files changed since the last completed scan.

    For a round of changes, such as a merged pull request. Needs an earlier completed scan to compare with.

  2. Focused

    Fast, low cost

    High-risk entry points and the files behind them.

    For a short look at the riskiest parts when time is tight.

  3. Standard

    DefaultModerate time and cost

    Every entry point and the files that handle it.

    For the first scan of a project, then regular scheduled scans.

  4. Extended

    Longer, costs more

    Every entry point and application file, build pipelines included.

    For a release, or the scan after large changes.

  5. Full

    Longest, costs the most

    Every entry point, application and config file; stops when budget or time runs out.

    For the most thorough review, such as before a major launch.

Beside the five levels sits Adversary, the attacker's view of the whole project, on Pro and above.

A drawing of the New scan dialog's Coverage step: Quick, Focused, Standard (the default, selected), Extended and Full with their depth meters, then Adversary, the attacker's view.

02

Adversary

The attacker's view: small weaknesses chained into one attack.

Adversary is a separate scan beside the five levels. It reads the whole project from more than one attacker's point of view and reports multi-step attack paths.

  • Every step on record

    The attack path lists each step in order, with the file and line where it happens.

  • Who it reaches

    Each finding says whether it affects one user, one tenant or all users.

  • Fixed like any finding

    Go Fix, the button that opens a fix as a draft pull request, gets the whole chain, and so does a chat about the finding.

Pro and aboveCompare plans

Attack path · 3 steps

Any signed-in user can trigger refunds for another tenant

CriticalAffects: All users

  1. 1Where it startsRefund request accepts any amount from the clientsrc/routes/refunds.ts:142
  2. 2What it passes throughTenant check reads the tenant id from the request headersrc/auth/tenant.ts:57
  3. 3Where it endsPayout job pays the refund without a second checksrc/jobs/payouts.ts:88

A signed-in caller can name another tenant in a request header, set the refund amount and have the payout job pay it out without a second check.

A sample attack path on a sample project, as an Adversary finding shows it.
03

Schedules

Run it on a schedule: each run compared with the last.

Repeat any scan daily, weekly or every two weeks on the branch you chose to scan. Pick the first run, and later runs start at the same time.

  • New, known and resolved

    Each run is compared with the last: findings it already reported count as known, and fixed ones show as resolved.

  • Earlier findings checked again

    From Focused up, a run can check open findings from earlier scans with fresh evidence. Re-check one yourself once its fix is merged.

  • Duplicates flagged, not hidden

    A finding that looks like one already reported is marked as a possible duplicate for you to review.

  • Pause without losing anything

    Turn a schedule off and it keeps its settings. Remove it and the instructions, threat model, history and findings stay.

Adversary schedules need Pro or above.

A drawing of the Schedule page: one schedule for northwind/payments-api, Standard, weekly, next run Mon 09:00, enabled.

04

Scan settings

Tell it about the project once: every scan starts there.

Members who manage a project set what its scans should know. A single scan can still change the level, the model tier (how careful the AI review is), the instructions, the threat model and the report language.

Coverage levelPer scan
Standard unless you pick another level for the scan or schedule.
Model tierPer organization
Fast, Balanced or Best: how careful the AI review is and how much usage it takes. Change it for one scan or schedule. Best comes with Pro and above.
InstructionsPer project
What every scan should focus on or skip, in plain words.
Threat modelPer project
Four optional questions: what would hurt if it leaked, which entry points are public or internal, who to treat as hostile, and what you have already accepted.
Business rulesPer project
Rules the project must always keep. Scans report any ordinary request that can break one.
Data visibilityPer project
Which roles may see prices, salaries, personal details or internal notes. Scans report every place another role still can.
Report languagePer project
The language findings and summaries are written in. English unless you choose another.
EmailsPer person
Whoever starts a scan hears when it finishes. A schedule's creator hears when a run cannot start. Each person can turn these off.
AccessPer organization
Organization owners decide who can run scans, view findings and change them.

Start with Standard: then put it on a schedule.

Connect a repository from GitHub, GitLab or Bitbucket and run the first scan. Every paid plan runs Standard. The 14-day Basic trial on your first organization runs Quick and Focused.

Get startedCompare plans