PRIVATE AI SECURITY
Nurbak is an AI pentester with its own model. It finds vulnerabilities like a senior analyst, your code never goes to OpenAI or Anthropic, and we store nothing after the analysis.
For banks, fintech, insurance, healthcare, government and companies with sensitive IP that cannot send their code to OpenAI or Anthropic.
Create account and connect GitHubWe never store your code. We only write when you ask for a fix PR. You pay only if you want the detail or continuous monitoring.
Open source project? Request a free scan →
Teams that already trust Nurbak
THE PROBLEM
You can't send your code to OpenAI or Anthropic. Compliance blocks it and you're left without AI.
Your scanner throws 500 findings and can't tell which one is actually exploitable.
USD 10–30K per engagement, once or twice a year, expiring at the next release.
Even the leading tools send your code, or the reasoning, to a third party.
THE SOLUTION
An AI security agent reasons over your repository, architecture, dependencies, authentication, business logic and multi-file vulnerabilities, prioritizes by real exploitability and hands you the remediation. It runs on our Whitehat model on ephemeral infra: the code is deleted when it finishes, with signed proof that nothing was stored.
HOW IT WORKS
Create your account and connect GitHub.
We spin up ephemeral infra with our Whitehat model, just for your analysis.
The agent maps the architecture, analyzes the code and correlates findings.
You get risks prioritized by exploitability, with remediation, in your Jira.
Download the signed audit trail for your auditor.
SEE NURBAK IN ACTION
YOUR DASHBOARD
Connect GitHub and see each repo's health from 0 to 100, how many issues there are by severity, which files are affected and the next steps to close them.
FINDINGS
Exposed credentials, dependencies with known CVEs, secrets left in git history, IDOR, mass assignment and more. Ranked by severity and grouped by type and language.
DETAIL AND FIX
Every finding tells you what it means in plain words, what could happen, the technical evidence with CVEs and how to fix it. With one click, Nurbak opens the Pull Request with the change and a security test.
THE PR IN YOUR REPO
Nurbak opens the PR on a new branch with the smallest change, a summary of what was wrong and a test that fails before the fix and passes after it. It never touches your main branch: you review it and merge it.
SECURITY AND PRIVACY
WHITE / GRAY / BLACK BOX
White box generates hypotheses; gray and black box confirm them.
Repo + code + configuration
SQLi, XSS, SSRF, secrets, authz/IDOR, business logic and multi-file vulnerabilities.
Endpoints + test credentials + architecture
Confirms the real exploitability of what white box suspects.
Only the exposed target, no code
Validates from the outside like an attacker and discovers backends and infrastructure.
NOT A SCANNER
It maps the architecture, forms attack hypotheses, gathers evidence, correlates findings, determines impact, prioritizes and proposes the fix. After the fix, it re-analyzes.
BLOG
An SBOM is the ingredient list of your software: every library, version and supplier in a machine-readable file. Here is what goes inside one, why regulators now ask for it, CycloneDX vs SPDX, how to generate one with Syft, cdxgen or GitHub, and how to actually use it.
A vulnerability assessment finds and ranks as many weaknesses as possible. A penetration test proves what an attacker can actually do with them. Here is a clear comparison (goal, depth, exploitation, frequency, automation, cost and output), when to use each, and how continuous code-level assessment fits between pentests.
A fair comparison of the main secret scanning tools: what TruffleHog, Gitleaks, GitGuardian and GitHub secret scanning actually do, which are open source, which verify live secrets, how they handle git history, and how to rotate and purge a leaked key the right way.
ENTERPRISE
Own model, ephemeral infra and signed evidence for your auditor.
SAML/OIDC and role-based access control.
Which model analyzed what and when, with signed evidence.
The instance dies with the analysis. Signed proof that nothing was kept.
SIEM, Jira, GitHub/GitLab and Slack/Teams.
Turns findings into evidence for PCI, HIPAA or SOC 2.
Whitehat, our own model. No third-party APIs.
Request a free scan of your public repo with the same model. Create your account, send the repo and we review it and run the scan.
PRICING
See your score for free. When you want file, line and fix, plus automatic daily scans, pick a plan. Everything included.
To know where you stand.
Everything included for one project.
Everything included for your team. USD 40 per repo.
More than 5 repos or on your own infrastructure
Enterprise with SSO, SIEM, compliance reporting and on-premise deployment.
We charge per repo, not per developer: add teammates without changing the bill. Reference: a manual pentest costs USD 10–30K. Open source: the public report and the badge are always free. Enterprise with SSO, SIEM and compliance reporting: get in touch.