// PLATFORM

One security layer across your application.

Most teams end up with a scanner for code, another for dependencies, and nothing at all for APIs or external exposure. Veyra runs all of it as one system, then correlates the results into findings that describe real risk.

READ-ONLY ACCESS · NON-DESTRUCTIVE TESTING · AUTHORIZED ASSETS ONLY
// 02 · HOW IT FITS TOGETHER

Signals are only useful once they are connected.

A dependency alert on its own is a ticket. A dependency alert on a package that is reachable from an unauthenticated public route, in a service that holds customer records, is an incident waiting to happen. Veyra models the difference.

COLLECT
Repository analysis
Dependency graph
Secret detection
API route discovery
External surface
NORMALIZE
Deduplicate
Map to assets
Link code to routes
Resolve ownership
CORRELATE
Build attack graph
Trace data flow
Score confidence
Score severity
DELIVER
Prioritized findings
Attack paths
Remediation guidance
Alerts & reports

RAW FINDING → NORMALIZE → DEDUPLICATE → CORRELATE → ANALYZE → CONFIDENCE → SEVERITY → VERIFICATION → CUSTOMER FINDING

What every finding carries.

A finding is only actionable if it answers four questions: what is wrong, how sure are we, what does it put at risk, and what should an engineer do next.

EXECUTIVE SUMMARY
One paragraph a non-engineer can act on, describing the issue in terms of business consequence rather than scanner output.
TECHNICAL EXPLANATION
The request flow, the code path, and the specific control that is missing or insufficient.
EVIDENCE
Enough detail for your engineers to reproduce the problem, without unnecessarily exposing sensitive data.
ATTACK PATH
The chain from entry point to impact, showing how the weakness connects to something worth protecting.
SEVERITY & CONFIDENCE
Severity scored on exploitability, privilege, data sensitivity, and blast radius. Confidence stated separately and never inflated.
REMEDIATION
A specific fix for your stack, plus the security pattern that prevents the same class of issue returning.
WORKFLOW
Assign, mark investigating, mark fixed, request rescan, create a GitHub issue, or export.
// 03 · BOUNDARIES

What Veyra will and will not do.

A security vendor that is vague about its limits is telling you something. These are ours, stated plainly.

VEYRA DOES

  • Analyze only repositories, domains, and applications you explicitly authorize
  • Request read-only repository permissions wherever possible
  • Run analysis in isolated, ephemeral environments that are destroyed after each assessment
  • Perform non-destructive external checks within limits you configure
  • State confidence honestly and separate verified findings from probable ones
  • Let you disconnect any repository and request deletion at any time

VEYRA DOES NOT

  • Modify, merge, or delete your source code
  • Test any asset you have not authorized in writing
  • Run destructive exploitation, denial of service, or data-modifying attacks
  • Replace a penetration test, a compliance audit, or a security engineer
  • Claim certifications it has not earned
  • Present an unverified finding as a confirmed vulnerability

See it against your own code.

A baseline assessment covers your authorized repositories, applications, and external surface, and produces a prioritized report your engineers can act on.

Read-only repository access · Authorized testing only · Customer-controlled connections