Verified code security,
on every pull request
Cora is Plaidnox's pull request reviewer and white box testing agent. It proves a vulnerability is real by independently trying to exploit it, in your application's own context, before it ever reaches a developer, and it blocks the merge on verified new risk.
The triage queue, removed
Pattern and rule scanners flag code that looks dangerous without proving it is reachable or exploitable, so engineers lose trust and ignore the backlog. Cora only ever shows a finding it has independently proven.
Proof, not opinion
- Every finding survives an independent falsification pass
- A taint trace from attacker source to the dangerous sink
- A verified proof plan and a regression test the fix must pass
- A deterministic policy, not an LLM, decides the merge gate
- Zero unverified findings reach a developer
How Cora works
One pull request, reviewed like an attacker
Four stages run as one durable job. Every finished step is checkpointed, so a failure costs minutes, not a whole run.
Snapshot and context
Reads an immutable base to head snapshot and reuses the repository security index: routes, entry points, authentication boundaries, and data stores.
Changed surface review
AI reviews only the code the pull request touches, with full application context, instead of re-scanning the whole repository on every push.
Deep Hunt verification
A separate agent traces each candidate end to end and actively tries to disprove it. Only what survives falsification becomes a finding.
Baseline and merge policy
Each finding is classified as introduced or existing, then a deterministic policy, not an LLM, decides whether the merge is blocked.
The dashboard
See Cora in action
From posture overview to a verified finding and its taint trace, the whole review is in one place.
Posture at a glance: what is open, whether it is being fixed, and how much Cora caught before merge.
Failure costs minutes, not a whole run
A thorough review takes minutes and many model calls, and real runs fail: a provider rate limits the request, a credit budget runs out, a worker restarts. Cora is built so that failure is cheap.
- Every finished step is checkpointed the moment it succeeds
- A resume replays completed work for free and re-runs only what failed
- Finished work is bound to the exact revision and reused safely
- An unfinished run is reported as incomplete, never as a clean pass
A case, not a line number
When a developer opens a Cora finding, there is nothing left to triage: the description, the business impact, the exact remediation, and the taint trace that proves it.
- Source to sink taint trace rendered on the real code
- A verified proof plan for an authorized test environment
- A regression test the fix has to pass
- One stable identity per finding across pushes
Two modes, one verifier
Prevent new risk, and find what already exists
Pull request review stops new vulnerabilities at the merge. White box review covers the bugs that were already there.
Pull request review
Runs on every pull request. Reviews the security surface the change touches, with full application context, and gates the merge on verified new risk.
- Changed surface first, not a full re-scan on every push
- Inline, evidence backed findings on the pull request
- Deterministic block, warn, allow, or incomplete decision
White box review
Runs a full repository hunt for pre-existing vulnerabilities that no pull request ever touches, using the same verification engine.
- Covers the blind spot that PR-only review cannot see
- Best triggered on risk signals or on request
- Scoped to the affected application in a monorepo
Where Cora is different
Prove the bug, then gate the merge
Most SAST tools detect patterns and leave the triage to you. Cora proves exploitability first, in context.
Comparison reflects publicly documented capabilities of mainstream SAST tools as of October 2026. “Not stated” means a capability is not publicly documented, not that it is impossible.
Read only by design
No dependency installation, no builds, no code execution, and no reading of secret files.
No noise at the gate
Verified-only findings, and incomplete is never presented as a clean pass.
Private and redacted
Context is size bounded and redacted before any model sees it; secrets never enter prompts.
Ready to see Cora on your pull requests?
Connect a repository, run Cora as a non-blocking check, and watch it catch and prove new vulnerabilities before they merge.