How it works

From code to secure in minutes.

VulRAG uses retrieval-augmented generation to surface real vulnerabilities your linter won't catch — then shows you exactly how to fix them.

STEP 01

Upload

Submit your code

Drop a local file, paste a GitHub repository URL, or write directly in our built-in Monaco editor. No build system, no config — just your code.

Supports C, C++, Java, and Python
GitHub integration with branch selection
Up to 10 files per submission

main.c

#include <stdio.h>

int main() {

char buf[64];

gets(buf);← unsafe

return 0;

}

.c.cpp.java.py

STEP 02

Analyse

RAG-powered scanning

Your code is embedded and cross-referenced against a curated knowledge base of real CVEs and vulnerability patterns using retrieval-augmented generation. No rule lists. No guesswork.

Semantic similarity — not just keyword matching
Mapped to CWE and CVE identifiers
Catches patterns static analysers miss

rag_engine.log

✓Parsing AST...

✓Embedding code vectors

✓Querying CVE knowledge base

⟳Matching vulnerability patterns

CWE-120 Buffer Overflow87%

CWE-676 Dangerous API71%

CWE-190 Integer Overflow34%

STEP 03

Review

Line-by-line findings

Every vulnerability is severity-rated, explained in plain language, and pinned to the exact line that triggered it. Context, not just a warning code.

HIGH / MED / LOW severity ratings
Exact line numbers and plain-language explanations
Downloadable JSON report

findings.json

HIGH

Buffer Overflow — CWE-120

line 3 · gets() is inherently unsafe

MED

Dangerous API — CWE-676

line 3 · use fgets() instead

LOW

Implicit Return — CWE-394

line 6 · ensure explicit return

STEP 04

Patch

Get the fix

For each finding, we generate a corrected version of your code and show you exactly what changed. Review the diff, apply the patch, ship with confidence.

Side-by-side diff view
Safe replacement functions suggested
One-click patch download

patch.diff

@@ -3,1 +3,1 @@

gets(buf);

fgets(buf, sizeof(buf), stdin);

Vulnerability resolved

Safe equivalent function applied

Common questions

Ready to scan your code?

Back to home