Divergent

Find the bugs an attacker would use.

Elliot looks at your app like an attacker and reports only the vulnerabilities it can trace from input to impact, each with the request that triggers it and the fix.

Run a free scanYour first full scan is free.

Most scanners are slow, flag everything that looks risky and come with guardrails. Elliot doesn’t. It’s built specifically for offensive security work.

Every finding shows its work.

Open a finding and follow the attacker’s path through your code, step by step, with real files and line numbers. Below it: who can reach the bug, the request that triggers it and the change that fixes it.

Built by an AI lab that works on offense.

Divergent is an AI lab doing security research. We study how AI finds and exploits vulnerabilities in real software, and Elliot is where that research ships.

What happens in a scan.

Elliot works through your repository in five passes. Findings stream onto your board while the scan is still running.

  1. 01

    Index

    Maps routes, handlers, callers and deploy config at the head of your branch.

  2. 02

    Threat model

    Works out what is worth stealing, where the trust boundaries are and how tenants are kept apart.

  3. 03

    Hunt

    Attacks every entry point from several angles, and digs again wherever it finds something.

  4. 04

    Ground

    Checks each step of every trace against your real code and merges reports that share a root cause.

  5. 05

    Prove reach

    Decides who can reach the bug and what they gain. If the answer is nothing, it stays off your board.

Fits the way your team ships.

Start with a free scan.

Connect GitHub or GitLab and pick a repository. Elliot scans all of it for free and opens the five most severe findings. Choose a plan to open the rest and scan on every push.

Questions.

Does Elliot run my code?

No. Elliot reads your source with read-only access and never executes it, deploys it or sends requests to your servers.

What access does it need?

Read access to code and metadata on the GitHub or GitLab repositories you choose during setup. You can add or remove repositories at any time.

How is this different from a static analysis tool?

Pattern-based tools flag code that looks dangerous. Elliot follows input from an entry point to the line that breaks, checks every step against your code and works out who can reach it before a finding lands on your board.

What if Elliot gets one wrong?

Mark it as a false positive and it stays closed, even when a later scan finds the same thing again.

What do I get from the free scan?

One full scan of one repository. The five most severe findings open with their trace, request and fix. The rest show their severity and open when you choose a plan.

Who counts as a contributor?

Anyone who committed to a connected repository in the last 90 days. Each person counts once, however many repositories they push to.

How many scans are included?

Each plan scans on every push, up to a monthly allowance. If you go past it, Elliot scans each repository once a day until your next billing cycle. There are no overage charges. A scan of a commit with no changes, or a scan that fails, doesn’t count.

What is a full scan?

The first scan of a repository reads all of it and builds its threat model. After that, scans on push review only what changed. Every plan includes one full scan per repository when you connect it, and you can run another for $99.

Can I pay yearly?

Yes. Annual plans get two months free: $1,490 a year for Pro and $4,990 a year for Team.

See what Elliot finds in your code.

Connect GitHub or GitLab, choose a repository and Elliot runs its first full scan for free.

Run a free scan