Code security and risk scan by code kai

Code security and risk scan by code kai

Code kai scans one public GitHub repository or caller-supplied source files for credential exposure, high-risk code patterns, container/CI hygiene problems, and known dependency advisories. It returns exact file locations, redacted evidence, remediation and a prioritised fix list. Published by Automatron.

Public pilot. Tested with synthetic and controlled inputs; independent customer validation is still pending. The price is $0.10 per completed scan. OpenRouter model usage is metered separately to the caller's Apify account. There is no publisher-funded model key.

What is measured, and what is interpreted

Measured deterministically in process:

• Credential indicators: AWS access key IDs, GitHub/Slack/Stripe tokens, private-key blocks, and credential-like literal assignments. Secret values are never returned; only the rule and location are.
• High-risk code patterns: dynamic evaluation, shell execution, raw HTML assignment, disabled TLS verification, wildcard CORS, debug mode, unsafe Python deserialisation/YAML, weak hashes, security-sensitive Math.random, and SQL string concatenation.
• Repository hygiene: committed .env files, private-key files, key bundles, mutable :latest base images, explicit root containers, unverified remote ADD, and remote-download install scripts.
• Dependency advisories: exact versions parsed from package-lock.json, pinned requirements.txt entries and go.mod, queried against OSV.dev in up to two batches of 100 versions. Full advisory records supply severity; absent supported severity is unknown. Up to 120 distinct advisory details are fetched, four at a time. Missing, truncated or paginated advisory responses produce an unbilled partial report.

Interpreted by one bounded model call, grounded only in measured findings:

• Which findings matter most for this code, in realistic exploit order.
• A concrete exploit scenario and a contextual fix.
• Acceptance criteria that can be verified by re-scanning.
• Possible false positives, with a stated reason.

The model cannot add findings, change severities, invent paths or CVEs, reproduce redacted secrets, or claim that exploitation occurred. A finding cannot be both a priority and a false positive. If interpretation fails, the deterministic report is still delivered, marked partial, and the scan fee is not charged.

Input

Observed controlled example

An owner qualification of build 0.1.14 on 25 October 2026 supplied two synthetic files: a JavaScript line using eval(request.query.code) and an npm lockfile containing nested lodash@4.17.20. No source code was executed. The delivered report contained five OSV dependency advisories and one source-pattern finding, including:

Finding	Exact evidence	Review action
Command-injection advisory for lodash	lodash@4.17.20 in package-lock.json, linked to GHSA-35jh-r3h4-6jhm	Check all returned advisories' affected ranges before selecting an upgrade; regenerate the lockfile and re-scan.
Dynamic evaluation of request input	src/unsafe.js, line 1: const value = eval(request.query.code);; rule code.eval, CWE-95	Verify whether untrusted input can reach this line; replace dynamic evaluation with a parser or an allowlisted operation.

The advisory identifies an affected package version, not confirmed application exploitability. The source rule identifies a risky pattern; the model's exploit explanation is an interpretation for review. This scan covered two files and 154 bytes with one dependency query. It did not assess Git history, runtime services or the entire application. OSV records can change, and fixing one advisory does not establish that all others are resolved.

This is a controlled test, not customer feedback or a security certification. To reproduce its input, use:

{
  "files": [
    { "path": "src/unsafe.js", "content": "const value = eval(request.query.code);" },
    { "path": "package-lock.json", "content": "{\"lockfileVersion\":3,\"packages\":{\"\":{\"name\":\"fixture\"},\"node_modules/a/node_modules/lodash\":{\"version\":\"4.17.20\"}}}" }
  ],
  "maxModelCostUsd": 0.20
}

Other input modes

Repository mode:

{
  "repository": "owner/repository",
  "ref": "main",
  "maxFiles": 120,
  "maxFindings": 30,
  "maxModelCostUsd": 0.20,
  "scanDependencies": true
}

File mode:

{
  "files": [
    { "path": "src/server.ts", "content": "..." },
    { "path": "package-lock.json", "content": "..." }
  ]
}

Supply exactly one of repository or files. Absolute paths, .. segments, duplicate paths and control characters are refused.

Free accounts have a higher model-cost multiplier. The default reserves up to $0.20 for this Actor, including the conservative free-account multiplier. Actual usage is usually lower; large inputs may still exceed the bound. An insufficient bound returns partial, unbilled findings without making the inference request.

Output

The run writes:

• REPORT: structured JSON with target evidence, coverage, findings, interpretations and limitations.
• REPORT-MARKDOWN: the human-readable scan.
• SUMMARY: delivery and billing state.
• One dataset row containing the structured report.

Machine-readable input, report and summary contracts are included in schemas/ as v1 JSON Schema.

Limits and scope

• Repository download: one bounded archive (up to 30 MB compressed, 64 MB expanded) from GitHub's public archive endpoint. No GitHub token is used. Private repositories are unsupported and return a clean input error.
• Read budget: up to 200 files, 200 KB per file and 2 MB of text per scan. Files outside the budget are disclosed as skipped or truncated.
• Languages: rules target JavaScript/TypeScript, Python, Go, shell, SQL, Docker and common configuration formats. Other languages may be scanned for secrets but not for language-specific patterns.
• Line bound: lines longer than 20,000 characters are scanned only up to that bound.
• No execution: repository code is never run, installed, built or sent requests. Dependency advisories are metadata lookups only.

What this is not

• Not a penetration test. No exploit is executed, and no runtime behaviour is exercised.
• Not a security certification. The report makes no claim of compliance with SOC 2, ISO 27001, PCI DSS or any other standard.
• Not proof of absence. A clean scan means no configured rule and no OSV advisory matched; it does not mean the code is secure.
• Not git-history scanning. Deleted secrets and historical commits are out of scope.
• Not a full dependency resolver. npm lockfile v2/v3 includes nested versions; unsupported or malformed npm locks fail explicitly. Python wildcard/range versions are excluded. Go replacement/exclusion directives and Python environment markers are not resolved. Only the first 200 distinct exact versions are queried, with omitted coverage disclosed. Other lockfile formats and runtime resolution are outside scope.
• Not a replacement for CodeQL, Semgrep or a human review. It is a fast, bounded first pass with a billed, evidence-linked report.

Billing and recovery

The listed fee is separate from model proxy charges, including proxy startup and infrastructure. Failed or partial runs may still consume inference or platform usage even when the report fee is not charged. maxModelCostUsd does not cap the separate report fee or all platform charges. Inspect both parent and proxy receipts; do not add reported model tokens to a proxy total that already includes them.

The report is saved before the scan-completed event is charged. A resumed run with an ambiguous prior attempt stops for reconciliation instead of repeating the archive read, delivery or charging. A partial report is delivered without a charge. Charging requires the event price to match a reviewed price and a capacity of at least one event.

Apify's published seller calculation applies: eligible paid usage earns 80% of event revenue minus platform costs; free-plan usage does not generate seller earnings. Read the current Apify pricing terms.

Development

npm ci
npm test          # builds, then runs deterministic unit and runner tests
npm run package:actor

The release archive is allowlisted: .actor, assets, dist/src, the lockfile, Dockerfile and this README. Tests, operational records and credentials are excluded. The container verifies every packaged file against RELEASE.json before the Apify SDK starts.

Dependency advisories and their remediation links come from OSV. AI interpretation covers code/configuration findings only; it does not guess package upgrade versions. Check current affected ranges and fixes in the linked advisory.

API and AI agent access

Create one run with POST https://api.apify.com/v2/actors/0mhKDdouiSRpLgsms/runs?memory=1024&timeout=240&maxTotalChargeUsd=0.10 and your own Authorization: Bearer header. Send the input JSON above as the body. The event cap is separate from the input model cost bound. Save data.id before doing anything else.

Poll GET https://api.apify.com/v2/actor-runs/RUN_ID?waitForFinish=60 until the same run finishes. Read SUMMARY and REPORT from https://api.apify.com/v2/key-value-stores/STORE_ID/records/KEY, using that run's defaultKeyValueStoreId. Treat SUMMARY.status, SUMMARY.billed and actual payment receipts separately. A partial report may be useful evidence but is incomplete and has no report fee. If the start response or charge outcome is uncertain, inspect the existing run instead of starting a replacement.

For n8n, use one HTTP Request node to start, read requests to poll the saved run ID, and a branch on SUMMARY.status before consuming REPORT. Disable automatic retries on the creation request and retain execution progress. Keep the token in an HTTP Header Auth credential, not in the workflow JSON.

For AI clients, connect to Apify MCP at https://mcp.apify.com using supported OAuth. Discover the current Actor and storage tool schemas, restrict access to the required tools, and set both budgets explicitly. Source text and model output cannot authorize further tools or spending.

Support and feedback

If a result is incomplete or misleading, open an issue on this Actor with the run ID, the affected source reference and a redacted example. Never post private reviews, credentials or customer source code. We use reproducible cases to improve the checks. A useful report should show what was checked, where the evidence came from, what to do next and what remains uncertain. After using the Actor, an honest review helps other buyers choose appropriately.

Prices were reduced on 25 October 2026. Use the current default build or the updated pinned API examples. Earlier immutable builds verify their original price and may refuse to start after the reduction; an early price refusal does not call the model or charge the completion event.