CNRT CodeLens
Most vulnerability scanners hand back a list too long to work through and too noisy to trust. CodeLens is an AI vulnerability scanner built around the two things that make a finding useful: checking its own work, and stopping short of changing your code without being asked.
size_t need = hdr->len + sizeof(tag_t); if (need > cap) { cap = need; } memcpy(buf, hdr->body, hdr->len); buf[hdr->len] = 0; return finalize(buf, need);}int token_verify(const tok_t *t, time_t now) { if (!t || t->len == 0) return TOK_EMPTY; if (t->exp < now) return TOK_EXPIRED; uint8_t mac[32]; hmac_sha256(key, t->body, t->len, mac); return ct_equal(mac, t->mac, 32) ? TOK_OK : TOK_BAD;}size_t parse_header(const uint8_t *p, size_t n, hdr_t *h) { if (n < HDR_MIN) return 0; h->type = p[0]; h->len = read_u16(p + 1); h->body = p + HDR_MIN; if (h->len > n - HDR_MIN) h->len = n - HDR_MIN; return HDR_MIN + h->len;int frame_next(stream_t *s, frame_t *f) { hdr_t h; size_t used = parse_header(s->cur, s->left, &h); if (used == 0) return FRAME_SHORT; f->kind = h.type; f->data = h.body; s->cur += used; s->left -= used; return FRAME_OK;Unchecked bounds on copy path
Length comes from the caller and is used to write before it is compared against the destination size.
Proposed change, for your review
- memcpy(buf, hdr->body, hdr->len);+ if (hdr->len >= cap) return E_RANGE;+ memcpy(buf, hdr->body, hdr->len);Vulnerability scanners return lists too long to work through and too noisy to trust, so the vulnerabilities that matter get lost.
CodeLens ranks vulnerabilities by whether an attacker can reach them, has a second model check each one, and leaves the fix to you.
A second model checks what the first one found
Detection and verification are separate stages by design. The first pass reads the repository through several different lenses; a later stage takes each candidate finding and asks a different model whether it actually holds. What reaches you has survived being argued with, which is what makes a short list worth reading.
Unchecked bounds on copy path
Length reaches a write before it is compared against the destination size.
Reachable from two call sites that accept caller-controlled input. Holds.
A crash costs you one stage, not the whole scan
A full pass over a large repository is long-running work, and long-running work fails. CodeLens checkpoints after each stage, so an interrupted scan picks up where it stopped rather than starting from nothing. On a large codebase that is the difference between a re-run and a lost afternoon.
It does not touch your code unless you ask
Detection runs first and stops. Remediation is a separate, deliberate step you choose to take, per finding. Plenty of tools will open pull requests against your repository on their own; this one reports, and waits. Findings export as Markdown or PDF so they can go into a review or a report as they are.
Proposed change, for your review
} - memcpy(buf, hdr->body, hdr->len);+ if (hdr->len >= cap) return E_RANGE;+ memcpy(buf, hdr->body, hdr->len); buf[hdr->len] = 0;Technical specifications.
Built at Quantum Ventura and sold on its own. It reads source code rather than network traffic, so it stands as its own product, and it reports into the CyberNeuro-RT dashboard for teams already running it.
| Position | Standalone product, integrated with the CNRT dashboard |
|---|---|
| Verification | Separate model pass over candidate findings |
| Recovery | Checkpoint and resume between stages |
| Output | Markdown and PDF |
| Interface | Multilingual, English and Japanese in place today |
Tell us what you're working on.
Our team replies within two working days, wherever you are.