Pentoma Code does not score code quality or generate dashboards. It hunts exploitable vulnerabilities, reconstructs full attack chains from source to sink, and surfaces 0-day candidates worth coordinated disclosure.
Definition
An offensive code audit is the source-side equivalent of a penetration test. Reviewers and AI agents read the codebase looking for what an attacker would: exploitable bugs, missing authorization invariants, unsafe data flows, deserialization gadgets, and chains that combine smaller bugs into real exploitation primitives.
Auth bypass, broken access control, injection sinks (SQL, OS command, LDAP, NoSQL), deserialization, prototype pollution, SSRF, secret exposure, unsafe deserialization, and exploitable third-party calls. Per-language and per-framework.
Code style, linting, formatting, and test coverage opinions. Pentoma Code does not score code quality. Those concerns belong in CI and dev tooling — not in a security audit.
Differentiation
A scanner pattern-matches against a function. Pentoma Code reasons about whether an attacker can reach it, what they can do with it, and whether the chain has been disclosed before.
SAST tooling
Pentoma Code
Engagement shape
Each audit runs as a scoped, time-boxed engagement. Agents and reviewers work the codebase together; nothing reaches the customer report until human validation signs off.
01
Customer signs scope agreement specifying repos, services, languages, and out-of-scope artifacts. Vendor lockfiles, generated migrations, and minified bundles are excluded by default.
02
Pentoma agents read the codebase, identify candidate vulnerabilities, and trace each one through call graphs, frameworks, and trust boundaries.
03
Each candidate must be reproducible: the source line, the reachable sink, the conditions for exploitation, and a deterministic data-flow proof. Reviewers verify or reject.
04
Validated findings ship with line-level remediation, severity rationale, retest plan, and any 0-day candidates routed into our disclosure standard.
Buyer fit
Pentoma Code is an offensive audit, not a dashboard. Use it when validated, auditor-grade findings matter more than alert volume.
You ship runnable software. Your codebase has business logic with authorization decisions. You need an auditor-grade deliverable. You ship AI features and want the agent code reviewed.
You want a daily SAST dashboard (use Snyk or Semgrep). You want PR-style code-quality review (use a senior engineer). You want runtime exploitation evidence (use Pentoma Web).