Ship AI-written code
without shipping a security leak.
AI-written PRs quietly ship queries with no org filter, SQL injection, hardcoded secrets and SSRF. slopGrade Firewall blocks cross-tenant leaks and PHP echo/print XSS from unescaped request input; paid slots also block request-reachable HMAC/signature comparisons using ==. Other findings remain advisory, before merge — deterministic, $0, and only a {file · line · class} fingerprint is sent by default on a private repo. Public repos run the deep scan (heisen-slop) by default; on a private repo it is a paid opt-in.
Built for teams whose private code stays on the runner by default. Enterprise can run heisen-slop inside your network.
By default, the security scan never sees your private code.
Hosted AI reviewers and SaaS scanners ingest your source code into their platform. For many teams — fintech, health, public sector — that alone is a dealbreaker. slopGrade Firewall runs the detectors inside your runner and, on a private repo, posts only a structural fingerprint by default. The deep scan (heisen-slop) is a paid opt-in there, and on by default on public repos.
Typical SaaS scanner
Your whole repo — every line, every secret — copied into a third-party platform.
slopGrade Firewall
A structural fingerprint — path, line, class. On a private repo the file content stays on the runner by default; the deep scan (heisen-slop) is a paid opt-in. On a public repo the deep scan runs by default. Audit the default payload with --print-payload.
Detect → adapt → verify. On a private repo, nothing else leaves by default.
Locally, in your runner
The open-source client walks the diff and builds a structural fingerprint — file paths, {file, line, kind}, and the table and column names the cross-tenant check needs. By default, the contents of your private files stay on the machine.
Server verdict + gate
The fingerprint is classified server-side. Cross-tenant leaks and PHP echo/print XSS from unescaped request input block on public repos, the free private repo and paid slots. A timing-unsafe HMAC/signature comparison using == blocks only on a paid slot, when a request can reach it. All other XSS shapes and classes report without blocking. The paywall fails open. For XSS, only unescaped PHP echo/print of request input ($_GET / $_POST / $_REQUEST / $_COOKIE) blocks.
Fix computed in your runner
Every finding posts inline on its line. For classes with a safe deterministic rewrite (TLS verification off, debug on, yaml.load…), the fix is generated AND verified in your runner — the server never touches it, and it's only offered once it's proven to clear the finding.
Cross-tenant + PHP echo/print XSS block free. Other findings report only.
The 22 open-source detector packs run on every repo. Free blocking covers cross-tenant leaks and only PHP echo/print XSS from unescaped request input; other XSS shapes and classes report without blocking. Paid slots detect the full 125-class catalog; 3 classes block today, adding request-reachable HMAC/signature comparisons using ==. Cross-file dataflow is the deep scan (heisen-slop).
The full paid detection catalog: 125 classes →
Deep scan (heisen-slop)
The deep scan (heisen-slop) is a deterministic dataflow pass across 6 languages. It is free on public repos, a paid opt-in on private repos, advisory by default, and the source is analysed in memory and dropped. Running it in your infrastructure is an Enterprise option, described on the engine page.
The free tier is real. The gate is where it pays.
Block leaks on private repos. Solo for one person, Team for a team — never per seat.
Solo: 10 private repos for one person, up to 50. Team: 50 private repos, unlimited users, Deep Scan on every PR. Blocking is free on every public repo and one private repo. 14 days free, no card.
Public repos are gated free, forever. Solo and Team: 14 days free, no card, once per account.
Ready to block the next leak before it merges?
Add it to one workflow file. The first AI-written PR you scan will tell you what it was about to let through.
The questions a security team asks first.
Does my source code leave the runner?
The contents of your private files never leave the runner by default. The client reads files locally and posts only a structural fingerprint — paths, {file, line, kind}, and the table and column names the cross-tenant check needs. Run node isolation-gate.mjs --print-payload to audit the exact bytes sent. Even a hardcoded secret emits only the location and kind, never the value. The deep scan (heisen-slop: a paid opt-in on a private repo, on by default on a public repo) sends at most 80 sink files / 2M characters, analyses them in memory and drops them. It is advisory unless you set deep-scan-block. A free private repo never sends source.
Will it spam my PRs or break my build?
No. Start in advisory mode — see every finding without blocking — then switch to gate when you're confident. Cross-tenant leaks and PHP echo/print XSS from unescaped request input block free; paid slots also block HMAC/signature comparisons using == when a request can reach the comparison. Other XSS shapes and classes remain advisory until they pass the public blind-evidence bar. The gate fails open by default: a network, server or OIDC failure never breaks a build; strict lets you fail closed.
The auto-fix — where does it run?
For classes with a safe deterministic rewrite (TLS verification off, debug on, yaml.load…): in your runner. The fix is generated and verified locally (we re-run the detector on the patched buffer and keep the fix only if it clears the leak) — the server never touches it, and your tree is never modified: applying it stays your call.
Can I audit the code that runs in my CI?
Yes — the client is open source (MIT). Pin the commit SHA to freeze the exact code (a tag can be re-pointed, a SHA can't). Zero npm dependencies; only Node builtins.
What languages?
JavaScript/TypeScript, Python, Go and .NET today, plus the PHP echo/print XSS shape. The 22 open-source detector packs report for free. Free blocking covers cross-tenant leaks and only PHP echo/print XSS from unescaped request input; other XSS shapes remain advisory. The paid firewall adds Java and the full 125-class catalog; 3 classes block today, including request-reachable HMAC/signature comparisons using ==.