Continuous AppSec · Inside the pull request
Vulnerabilitiescaughtbeforemerge.
Every pull request reviewed inline. Your team keeps the merge decision.
The problem
Volume grew. Human review didn't.
- AI writes code at machine speed. Insecure patterns ship with a green build.
- Scanners report after the merge, buried in legacy noise nobody reads.
- Exploits land within a day of disclosure. A quarterly scan is already late.
zerodayclock.com · Epoch.ai, via a16z · 2026
How it works
From pull request to merge. No context switch.
- 01 · GitHub
Pull request opened
Webhook in. Nothing to install.
- 02 · Review
Inline comments
Exact lines. New · inherited · resolved.
- 03 · Slack
“@vora show H-1”
Reads your findings. Writes nothing.
- 04 · Merge
Your team decides
Vora never merges.
New findByCustomerId concatenates the customer-ID path parameter directly into the SQL. A request with ' OR '1'='1 in the path returns every order in the table: full enumeration, no authentication bypass needed. Suggestion: parameterize the filter with ? and a bound argument, matching the JdbcTemplate shape used elsewhere in this file.
Security posture
Never writes your code
Minimum GitHub scopes. Never merges.
No production access
Pull requests only.
Encrypted and audited
Encryption at rest. Hash-chain audit ledger.
Nothing to install
Connect the org. Done.
Built first for regulated finance, where every finding needs evidence an auditor will accept. That standard now ships to every team.