RedNest

Add a hacker to your team.

Secure your entire codebase with AI-powered Deep Scans, automated GitHub PR reviews and actionable fixes through Claude Code, Cursor, Codex or any MCP-connected agent. Powered by $RED, with 50,000 tokens unlocking 50 monthly Deep Scans and organization-wide security coverage.

Get started

Find the exploit before someone else does

RedNest monitors repositories, discovers real vulnerabilities, and reports what it can prove. Every finding comes with:

  • The attack path, step by step, with file and line
  • A proof of concept you can run
  • What the fix must guarantee, and what it mustn’t break
  • A ready-to-run prompt for your coding agent, with a regression test

  1. 01

    Install the GitHub app

    Pick the repos your hacker can see. It maps each one for free.

  2. 02

    Choose your hacker

    Give them a name, a look and a voice. They sign everything they find.

  3. 03

    Scan your codebase

    When you sign up, your hacker deep scans a whole repo, every file. The first one is free. Run another whenever you like.

  4. 04

    Open pull requests as usual

    Each one gets reviewed. Findings land on the exact lines, with a fix prompt for your agent.

Powered by $RED.

RedNest connects AI-powered repository security with Solana token-based access.

  • Free accessOne lifetime security scan after GitHub sign-in. No payment details required.
  • $RED holder access — coming soonHold at least 50,000 $RED in a verified Solana wallet for 50 scans per UTC month while eligible.
  • StatusToken-holder scanning is not active yet. Wallet verification is available ahead of the official $RED launch.

Official mint address coming soon.

What a finding looks like

redacted/redacted#418 · Add invoice download
app/api/invoices/[id]/route.ts
11 export async function GET(req: Request, { params }: Ctx) {12   const session = await requireSession(req);13   const { id } = await params;14+  const invoice = await getInvoice(id);15+  return Response.json(invoice);16 }

rednestbotcommented on lines 14–15

HighHigh confidenceCWE-639

Any signed-in user can read every customer’s invoices.

Attack path

  1. app/api/invoices/[id]/route.ts:13The invoice ID comes straight from the URL.
  2. lib/billing/invoices.ts:31getInvoice looks it up by ID alone. Nothing checks who is asking..where(eq(invoices.id, id))
  3. app/api/invoices/[id]/route.ts:15The whole invoice is returned, billing email and line items included.

Preconditions

Signed in as any user, in any organisation.

Proof of concept

curl https://redacted/api/invoices/inv_000001 \
  -H 'cookie: session=redacted'
# 200 OK, another customer's invoice
Fix prompt for your coding agent
Fix a broken access control bug in app/api/invoices/[id]/route.ts:14.

Attack path: GET /api/invoices/:id passes the ID from the URL to
getInvoice (lib/billing/invoices.ts:31), which looks it up by ID only.
Any signed-in user can read any customer's invoice.

The fix must guarantee: an invoice is only returned to members of the
organisation that owns it. Everyone else gets a 404.

Must not break: invoice downloads for the owning organisation.

Add a regression test that signs in as a member of another
organisation, requests an invoice it doesn't own and expects a 404.
RedNest found 1 high-severity issueReviewed · 2 credits

An example. Identifying details are redacted.

Get started