Read between the lines.
Review source code patterns that can lead to security issues. Start with built-in presets, then shape coverage around your application.
Source-linked findings · Language presetsAPPLICATION SECURITY, WITH CONTEXT
Code.
Context.
Confidence.
Even experienced developers make security mistakes. Vibe-coded apps can ship vulnerabilities, too. Find what needs attention, understand the evidence, and give your team a clear path to a fix.
Self-hosted by design. Private AI when you choose it.
Built around the evidence
WAFUSecurity workspace
PROJECT SECURITY
From finding to understanding.
Source snapshot capturedAnalysis starts from a known revision
Check access at the boundary.
Trace a request to the code that handles it. Review the surrounding context before deciding.
Controller.java
42 @GetMapping("/items/{id}")
43
Item getItem(String id) {
44 return
service.find(id);
45 }
Source-linked evidence
CaptureInspectRemediate
Illustrative workflow. Findings always need context.
A connected view of your codeSource codeSecretsDependenciesInfrastructure
ONE WORKSPACE. FOUR SCAN FAMILIES.
Different risks.
A shared place to work.
Bring detection, source evidence, and the next action together. Keep scanner findings and human decisions connected.
Spot credentials in code.
Look for exposed tokens, keys, and other credential patterns in captured source. Track the work needed to remove and rotate them.
Credential detection · Remediation trackingUnderstand what you inherit.
Compare dependency evidence with vulnerability advisories. See coverage gaps alongside results so missing information stays visible.
Advisory matching · Dependency inventoryReview the configuration.
Check supported infrastructure definitions for security misconfigurations. Keep the location and rule behind each finding close at hand.
Infrastructure checks · Reviewable evidenceFROM CODE TO A CLEAR NEXT STEP
A workflow your team
can follow through.
A scan is the start of a decision. Wafu keeps that decision attached to the code and the work that follows.
-
01
Capture a revision.
Upload a ZIP, import an authorized GitHub repository, or send captured source from CI. Choose the scan families and preset that fit.
-
02
Inspect the evidence.
Open the source location, review detector details, and record a decision. Optional AI review adds context through your configured Ollama server.
-
03
Move the fix forward.
Assign remediation, track progress, and verify changes with another scan. Export reports or use quality gates in your delivery pipeline.
COVERAGE WITH INTENT
Your stack.
Your rules.
Use built-in presets as a starting point. Inspect their rules, clone a preset, and tune what your team enables without losing sight of precision.
Explore presets in your workspace
Choose your starting pointBuilt-in + custom
Java & Spring Boot
Application and framework checks
Mobile applications
Platform and framework coverage
Web applications
Security checks across supported stacks
Make a preset your own.
Search, review, and select the checks you need.
Coverage varies by language, framework, and captured source.
ON YOUR INFRASTRUCTURE
Keep the control.
Connect the context.
Run Wafu in your environment. Decide who can access a workspace, how scanning is configured, and whether AI is part of the review.
A deployment you operate.
Host the platform and manage workspaces, access, maintenance windows, and storage from your own installation.
AI is an explicit choice.
Connect your own Ollama server for code discovery, finding review, or remediation guidance. Eligible source is sent to that configured server when AI is enabled.
Meet your delivery workflow.
Use the CLI, CI quality gates, signed webhooks, and portable reports to bring review outcomes into the tools your team already uses.
No automatic cloud AI fallback. Dependencies, scanner images, and advisory updates still need their configured network access.
A FEW THINGS TO KNOW
Before you
start scanning.
Can experienced developers introduce security issues?
Yes. Missed access checks, unsafe input handling, exposed credentials, and vulnerable dependencies can slip into any codebase. Security scanning helps teams spot supported issues alongside code review and manual testing.
Do vibe-coded apps need security review?
Yes. An AI-generated app can work as expected while still missing access controls, handling untrusted input unsafely, or using vulnerable dependencies. Review generated code before release. Wafu can scan supported source regardless of who wrote it; business logic and runtime behavior can still need manual testing.
What does Wafu scan?
Wafu scans captured source snapshots using SAST, secret detection, dependency analysis, and infrastructure checks. Coverage depends on the selected families, enabled rules, supported formats, and the source you provide. It also offers optional AI code discovery and review.
Is an AI server required?
No. Deterministic scan families work without an LLM. To use AI features, an operator connects an Ollama server and explicitly enables them. AI output remains reviewable guidance rather than a guarantee that code is secure.
Can we create our own presets?
Yes. Inspect built-in presets, clone them, and create custom presets. Choose defaults for your workspace and adjust a project's scan settings when you need different coverage.
Can a scan prove that an application is secure?
No scanner can establish that on its own. Wafu presents findings, scope, and coverage gaps to support review. Business logic, runtime behavior, and issues outside the selected detectors can still require manual testing.
How do I access the scanner?
Open scan.wafusecurity.com and sign in with an account provided by your platform administrator. Workspace access and integrations are managed inside the platform.
LESS GUESSWORK. A CLEARER NEXT STEP.
Make security part
of the workflow.
Bring your code into focus with Wafu.