Is your app ready for the people who use it?
Catch the bug that costs you customers, before you merge.
Zelsis reads every pull request for what users notice first: double charges, leaked keys, slow pages, screens that break, and template leftovers that make an app look unfinished. If something critical gets in, the build fails before it ships.
- Code never stored · snippets deleted after 90 days
- Benchmark published, misses included
- No account needed · one flat price, not per developer
Apps ship in weeks now. Users find the rough edges in minutes.
A customer is charged twice
The first support email asks for a refund, and the review mentions it.
A secret key ships to the browser
Anyone who opens the developer tools can copy it.
A deploy locks the orders table
Checkout hangs for every visitor until the migration finishes.
The page still says lorem ipsum
Visitors decide the app is unfinished, and some post a screenshot.
Zelsis checks every pull request for these before it merges. See what it catches
What it catches
Real bugs, caught in real code.
Every example below is scanned by our test suite on each release, so what you see is what the engine catches.
export async function POST(req: Request) {
const evt = stripe.webhooks.constructEvent(await req.text(), sig, secret);
if (evt.type === 'checkout.session.completed') {
await prisma.user.update({
where: { id: evt.data.object.metadata.userId },
data: { credits: { increment: 100 } },
});
}
return new Response('ok');
}
export async function POST(req: Request) {
const evt = stripe.webhooks.constructEvent(await req.text(), sig, secret);
if (evt.type === 'checkout.session.completed') {
await prisma.$transaction(async (tx) => {
if (await tx.processedWebhook.findUnique({ where: { id: evt.id } })) return;
await tx.processedWebhook.create({ data: { id: evt.id } });
await tx.user.update({
where: { id: evt.data.object.metadata.userId },
data: { credits: { increment: 100 } },
});
});
}
return new Response('ok');
}
Our own scanner caught us.
Zelsis checks its own code on every pull request. These made it into our codebase and Zelsis flagged them. Each one is fixed.
Private code, public cache
Our GitHub proxy sent files from private repositories with a public cache header, so a CDN was allowed to keep a copy.
Database functions open to hijack
Functions running with elevated rights had no fixed search_path, so a crafted schema could swap in its own code.
Test origins live in production
CORS still accepted localhost origins on the live site.
A search box you could not see focus on
Keyboard users tabbed into the help search and got no sign of where they were.
It also flagged code that was fine. Each of those became a rule fix with a test, so your scans do not repeat them. Read the changelog
The same check in every step of your work
One set of rules from the editor to the pull request, so a bug caught early is caught the same way later.
VS Code
Run the check from the command palette. Each finding appears under its line with the fix and a CWE link.
Install the extensionEvery pull request
The GitHub Action runs the check on each PR and fails the build when a change ships a critical bug.
Set up the CI gateYour terminal and AI agents
Check uncommitted changes before you push. Claude Code, Cursor and other agents can run it on their own work through MCP. Export SARIF for code scanning and an SBOM in CycloneDX or SPDX.
npx zelsis checkCLI and MCP guide- Pro and Team
Jira
Open a Jira issue from any finding in one click, with the location, severity and fix filled in.
See plans
From repository to release decision
Connect a repo, get findings in seconds, and let the gate fail the build when something critical slips in. Your reviewers still decide; Zelsis makes sure they see the risks.
Connect a repository, scanned in memory
Paste a public GitHub repository, or connect private ones through the Zelsis GitHub App (read-only, repositories you choose). Files are fetched into worker memory, scanned, and released.
- —Your code is scanned in memory and never stored. We keep findings plus a short snippet around each one; snippets are erased after 90 days.
- —Public repositories instantly, private ones through the GitHub App
- —GitHub Actions, GitLab CI and pre-commit configs generated for you
# From the dashboard, or from any CI runner with one HTTP call
$ curl -X POST https://zelsis.com/api/v1/gate-check \
-H "Authorization: Bearer $ZELSIS_API_KEY" \
-H "Content-Type: application/json" \
-d '{"repoUrl": "your-org/your-app", "ref": "'"$GIT_SHA"'"}'
{"gateStatus": "PASSED", "readinessScore": 94, ...}A fix prompt for every finding.
Each finding comes with the file, the line and a precise instruction you can paste into Claude, ChatGPT or Cursor. Your assistant gets the context it needs, and you review the change like any other diff.
Zelsis flagged SAAS3-02 in app/api/stripe/webhook/route.ts. The webhook adds credits on every checkout.session.completed event without remembering the event id, so a retried delivery pays the customer twice. Fix it so that: 1. The handler stores event.id in a processed_events table with a unique constraint, and returns 200 without doing anything when the id is already there. 2. Recording the event and adding the credits happen in one transaction, so a crash in between cannot apply them twice. Keep the route's signature verification and response codes unchanged.
Checks built for how real apps break
Secrets, database access rules, injection, auth and dependencies, each finding with the exact line and a fix you can paste into your AI assistant.
Rules that know your stack
OWASP Top 10, database access rules and cloud config, checked on every pull request.
Rules for JavaScript, Python, Go, Ruby, PHP and Java apps catch injection, broken auth, leaked secrets, permissive database policies, wildcard CORS and containers that run as root before they ship.
- —No AI guessing: the same code always gets the same result
- —Per-repository policy: ignore rules or paths and choose how strict the gate is
- —Every finding explained and mapped to its CWE
The exact line, and how to fix it
Every finding points to the file and line, with a fix you can paste into your AI assistant.
Each finding shows the code around it, how severe it is and why it matters. Review a before / after diff, or copy a fix prompt into Claude, ChatGPT or Cursor and review the change like any other.
- —Exact line numbers with syntax-highlighted code context
- —Fix prompts that work with any AI coding assistant
- —Every finding tagged verified or suggestion, so you fix what is proven first
Try the rules in your browser
Paste a snippet and see what Zelsis flags, before you push it.
Check an API route, a Dockerfile or a component against the same engine the scans use. It runs in your browser, so nothing is installed and the snippet never leaves your machine.
- —The full rule engine, loaded in the page
- —One-click examples: leaked secret, permissive RLS, root container
- —Pick the file type, from route.ts to a Dockerfile, so path-based rules apply
Beyond security: performance and accessibility
Catch the code patterns behind layout shifts, heavy bundles and unbounded containers.
Static checks for the causes of poor Core Web Vitals (images without dimensions, render-blocking scripts, oversized imports), WCAG 2.2 AA accessibility gaps, and Docker or Kubernetes resources left unbounded, before you deploy.
- —Patterns that cause layout shift (CLS) and slow first paint (LCP)
- —Unkeyed React lists and heavy third-party bundles
- —Docker healthchecks and container memory limits
Measured on real code, published as-is.
We scan pinned open-source projects: intentionally vulnerable apps to measure what we catch, and maintained production apps to measure noise. These are the latest results, including what we miss.
Priced per account, not per developer.
Snyk protects your code. Zelsis protects it too, and checks that your app is ready for the people who use it: payments that charge once, pages that load fast, screens that work on a phone, store reviews that pass, and nothing that looks unfinished. One flat price that does not grow with every hire.
| Zelsis | Aikido | Snyk | Semgrep | |
|---|---|---|---|---|
| Paid plan | $19/mo flat per account; team of 10 for $49/mo | $300/mo flat for 10 users and 100 repos (Basic) | Team from $25/mo, up to 10 developers | $30/mo per contributor (Code or Supply Chain) |
| Free plan | Unlimited scans, 3 saved projects, 5 fix prompts / month | 2 users, 10 repos | 5 projects, 100 Code tests/mo | Up to 10 contributors and 10 private repos |
| Focus | Logic bugs behind real incidents (auth, payments, caching, database rules), plus secrets, dependencies and CI/CD config, gated on every pull request | All-in-one platform (code, cloud, runtime) | Developer security platform | Customizable SAST and supply chain |
Competitor prices from their public pricing pages, October 2026; they may have changed since. Aikido · Snyk · Semgrep
Made for whoever ships the code
You might build with an AI assistant or write every line yourself. Either way the pull request gets the same check before it merges.
A gate that stays quiet
Only proven critical findings fail the build. The rest show up as notes you can read when you have time.
Runs next to your AI reviewer
Keep CodeRabbit or Copilot for review comments. Zelsis adds a pass or fail check that gives the same result every time it runs.
See both on the same five pull requestsYour code is not kept
Your code is scanned in memory and never stored. We keep findings plus a short snippet around each one; snippets are erased after 90 days.
No setup file to start
Paste a repository URL and get a report. Add a .zelsisrc.json later if you want to tune thresholds or ignore paths.
Fix it and ship the same day
Each finding gives the file, the line and a fix prompt, so you can fix it and merge without waiting for a separate security review.
What it catches before release
Prices set by the browser
Checkout amounts the client can change before payment.
Customers charged twice
Pay buttons that stay clickable and webhooks applied twice.
Pages that crawl
One database query per item in a list, unbounded sorts and deep pagination.
Deploys that freeze checkout
Migrations that lock a busy table while they run.
No way to say no
Cookie banners without a reject option and personal data written to logs.
Screens some people cannot use
Dialogs that trap the keyboard, missing labels, pages wider than the phone.
Packages with known holes
Dependency versions with a published advisory, and the version that fixes it.
One user reading another’s data
Routes and tables that skip the owner check.
Leaked keys
Secret keys in client code, logs or committed config.
AI features open to abuse
User text that reaches a model prompt unchecked, and model output used as trusted input.
Runaway AI bills
Model calls with no token limit, and agent loops or retries that never stop.
Cloud and infrastructure left open
Public buckets, wide-open access rules and containers running with too many rights.
Start free, upgrade when you ship
Every plan runs the same rules. Paid plans remove the limits, unlock private repositories and the CI gate, and add team features.
Free
Unlimited scans of public and private repositories, for trying Zelsis on your own projects.
- Unlimited scans, public and private repositories
- 3 saved projects
- Every check, on every plan
- 5 AI fix prompts / month
- Email support, best effort
Pro
Unlimited scans of public and private repos, CI release gate and AI fix prompts.
- Unlimited scans
- Unlimited saved projects
- Every check, on every plan
- Unlimited AI fix prompts
- Printable PDF audit report
- GitHub Actions & CI/CD release gate
- Jira issues from findings in one click
- Email support, reply within 2 business days
Team
Pro for your whole team: shared workspace, one gate policy for every repo and SOC 2 control mapping.
- Everything in Zelsis Pro
- Team workspace: 10 seats, every member gets Pro
- Owner / admin / member roles and invite links
- Organization gate policy applied to every repo
- SOC 2 control-mapping appendix (PDF)
- Priority email support, reply within 1 business day
| Feature | Free $0 For trying Zelsis on your own projects | ProRecommended $19 / month For professional developers and shipping teams | Team $49 / month For teams: shared workspace, org policy & SOC 2 reports |
|---|---|---|---|
| Scans and projects | |||
Scans Repository and website scans per month | Unlimited Scans | Unlimited Scans | Unlimited Scans |
Saved Projects Repositories and sites you keep in the dashboard, public or private | 3 saved projects (public or private) | Unlimited saved projects | Unlimited saved projects |
Enterprise: more than 10 seats or a custom contract?
We set up onboarding, volume pricing, invoicing and help with your security questionnaire.
Frequently Asked Questions
What happens to your code, how the CI gate works and what each plan includes.
No. Repository files are fetched into worker memory, scanned with pattern-based rules, and released when the scan ends. We do not save repositories; we save the findings, which include a short snippet of each flagged line so you can review it. Customer code is never used to train AI models. Scans are rule-based and send no code to an AI model.
Know what you are shipping before your users find out.
Scan a repository in seconds, then add the gate to your CI so the next critical bug never reaches production.