QuestorAI

QuestorAI VulnDNA is a code security tool that combines deterministic static analysis with LLM-based reasoning. The deterministic engine decides results, and LLM conclusions are checked against the engine's graph facts before they can change a result. Find: VulnDNA parses source code into taint flows, control-flow graphs, SSA, a cross-file call graph and function summaries. The analysis is interprocedural, field-sensitive and flow-sensitive. It traces untrusted input from sources (HTTP, WebSocket, GraphQL, gRPC, files, CLI arguments, environment variables, storage) to sinks. It detects issue classes such as SQL/NoSQL injection, command injection, XSS, path traversal, XXE, insecure deserialization, SSRF, SSTI, prototype pollution, CSRF, race conditions and auth bypass. It also finds broken object-level authorization (IDOR) by analyzing authorization structure, and checks whether known CVEs in third-party dependencies are reachable. Prove: Every candidate gets a verdict. It is either a finding with a proof trace or a refutation with the specific reason it is safe. Checks cover provenance, exposure, defenses on the actual path and certainty. Findings are grouped per root cause. An LLM validates each isolated finding against the engine's facts. Fix: An LLM generates a fix using the proof as context. The result is checked against the same proof. Generation is model-agnostic and supports frontier models, Azure OpenAI, Amazon Bedrock and self-hosted open-weight models. Verify: The code is re-scanned with the deterministic engine to confirm the proven flow is gone. Automate: A post-scan action can be set per finding category and verdict: none, generate fix, submit issue, issue plus PR, or commit.