Frequently Asked Questions

VulnDNA runs where your code already lives, and your source can stay there. Because there is no build step, VulnDNA can run in three places:

On your own infrastructure.

Run it from the command line, or drive every scan, report, and fix through its full API. It is fast enough to run before every push, even on code that doesn’t compile yet.

In your CI pipeline.

It scans the repository and can gate merges. After the first scan, it re-analyzes only the code that changed. Deterministic output keeps diffs clean between runs.

Cloud hosted.

Available if you would rather not run the infrastructure yourself.

In a CI setup such as Jenkins or GitHub Actions, the flow looks like this:

1. The scan runs as part of the pipeline.
2. A proven finding opens an issue, one per root cause, with full context and a generated fix.
3. Once a re-scan confirms the fix, a PR is raised with it.
4. A developer reviews and merges it.

There is no separate console to monitor. Everything lands in the ticketing and source control tools your team already uses.

So fast it can be used as a real-time tool. Scan times from our internal testing:

These times are for the deterministic analysis. LLM validation runs after the analysis and adds time in proportion to the number of findings. After the first scan, VulnDNA caches its analysis, so later scans re-analyze only the code that changed.

Yes. VulnDNA is model-agnostic. You can use frontier APIs, Azure OpenAI, Amazon Bedrock, or open-weight models you host yourself, which puts cost, data residency, and privacy under your control.

Neuro-symbolic AI combines neural models, such as large language models, with symbolic systems that reason using explicit rules and facts. In VulnDNA, the symbolic side leads. Deterministic code analysis finds each issue and records the facts behind it: where the data comes from, where it ends up, and which defenses stand in between. The language model reasons over those facts to confirm or challenge the finding, and the deterministic engine checks every claim it makes against them. If the model’s reasoning doesn’t hold up, the original result stands.

VulnDNA is Questor-AI’s code analysis platform, built to give engineers only the security vulnerabilities that matter: real, exploitable issues with high-quality automated fixes. It reduces both the cognitive load and the workload for engineers.

Yes. AI agents can work with VulnDNA directly through MCP (Model Context Protocol). It can also be operated from the command line or fully through its API.

Yes. VulnDNA can run entirely on-premise, so your code and scan results stay on your own infrastructure instead of a vendor’s SaaS platform. Paired with a self-hosted model, nothing leaves your environment at all. Results are stored in Postgres and are fully queryable. Whole scans can be exported as JSON or SARIF, and individual findings as Markdown.

Yes. Due to the CLI and API interface, the tool can be fully automated into any workflow.

• Injection
• Access control: Special focus on IDOR
• Authentication
• SSRF and external-resource access
• File and path handling
• Deserialization and parser vulnerabilities
• Web and HTTP vulnerabilities
• Business logic: Advanced IDOR detection for Go, coming for other languages
• Concurrency
• Configuration and dependencies
• Cryptography and secrets (coming)

VulnDNA has two costs. The license cost of the product which can be found on the pricing page. The second cost is the LLM usage of tokens. This varies on how the tool is used. See the table below for approximate validation and fix costs.

Expand image