Hacktron Review
Your team and your coding agents ship more code than anyone can review by hand.
Hacktron Review checks every pull request for exploitable vulnerabilities before it merges, reading each change with the context of your whole codebase, not just the diff.
Each finding lands on the vulnerable line with the attack path and the evidence to reproduce it, and Hacktron can open a tested fix against the same pull request. Your triage feedback teaches it what matters in your app.
Pull requests
Nothing exploitable merges unnoticed. Review checks every pull request when it opens and on each new commit, and serious findings fail the check until they’re fixed or your team triages them.
Call graphs
A reviewer sees a diff, not the call graph. Review builds call graphs of the codebases you connect, so it can follow a change through the code around it and report a vulnerability outside the lines that changed.
Notifications
Review runs in the background on every pull request. When it finds nothing, the check passes and nobody has to stop and read a comment. You hear from it when there’s a finding.
Threat model
Review writes down what your application protects, who can reach it and what stands in the way. That document is called a threat model. You can read and edit it, and it improves as your team replies to findings.
Setup
Connect your Git provider and choose your repositories and branches. Review runs on their pull requests from then on.
Price
From $40 per developer a month, with 50 PRs (unlimited scans per PR) per developer pooled across your organisation, and $1 per additional PR if you turn overage on. Free for open source.
Questions
Is this a SAST scanner?
No. Review reasons about exploitability with repository context and call graphs, not only syntax patterns, so it can find business logic flaws that pattern matching misses.
What does it look for?
Business logic flaws, broken access control, injection, prompt injection, memory safety bugs, infrastructure-as-code exposures, supply-chain risk and leaked secrets.
Which changes are reviewed?
Pull and merge requests in the repositories and branches you enable, subject to your filters and developer seats. Each review covers up to 500 changed files, and larger changes are skipped.
Does it change my code?
Not on its own. Every finding carries a prompt that opens the fix in Cursor, Claude or Codex. Ask for a fix and a Hacktron agent writes it on its own branch and opens a pull request for your team to review. Those runs use automation credits.
Do bots count as seats?
Yes. A bot that opens a reviewed pull request takes a seat like any developer. Filter it out by author if you don’t want it reviewed.