Code generated by Codex: check its security automatically

Codex works in the background and proposes complete changes, ready to merge. The bigger the changes, the less closely they are reviewed. That is where flaws slip in: unvalidated input, an added dependency, a forgotten test secret.

With analysis on every push, Citadel automatically reviews every update to the main branch and warns you as soon as a flaw appears, with the fix to apply.

Ten free analyses every month, no card needed. First report in minutes.

Analyse my app for free

The most common flaws

Unvalidated user input

File paths, queries and commands built from the request: injections and path traversal.

Forgotten test secrets

Keys and tokens used during development that stay in the code or configuration.

Misconfigured JWT and sessions

A token verified without an algorithm allow-list, a weak secret, unprotected cookies: authentication becomes bypassable.

Vulnerable dependencies

npm or Composer packages affected by a CVE or a published security advisory.

What Citadel checks (24 live checks)

Code, dependency and secret analysis against OWASP and CWE. Every flaw comes with a plain explanation and the fix prompt to paste into your assistant.

Next.js version vulnerable to middleware bypass (CVE-2025-29927) A06 · CVE
Secret exposed in a NEXT_PUBLIC_ variable CWE-200 · A02
dangerouslySetInnerHTML fed with external data CWE-79 · A03
Redirect built from URL parameters CWE-601 · A01
images.remotePatterns open to every domain CWE-918 · A10
Source maps published in production CWE-540 · A05
child_process.exec or spawn with user input CWE-78 · A03
eval, new Function or vm on external data CWE-95 · A03
File path built from the request (path traversal) CWE-22 · A01
JWT verified without an algorithm allow-list or with a weak secret CWE-347 · API2
Session cookies without HttpOnly, Secure or SameSite CWE-1004 · CWE-614
CORS: * origin combined with authentication cookies CWE-942 · A05
Secrets in the code and config files (100+ key types) CWE-798 · A07
npm and Composer dependencies with published CVEs or GHSA advisories A06 · CVSS
Passwords hashed with MD5, SHA-1 or unsalted CWE-916 · A02
http:// redirects to https:// CWE-319 · A02
HSTS present with a sufficient duration CWE-319 · A05
CSP present, without unsafe-inline or unsafe-eval CWE-693 · A05
Protection against embedding in another page (clickjacking) CWE-1021 · A05
Secure, HttpOnly and SameSite cookies CWE-614 · CWE-1004
CORS open to every site with cookies CWE-942 · A05
nosniff and Referrer-Policy headers, server version hidden CWE-693 · CWE-200
Forms sent in clear text, or password passed in the URL CWE-319 · CWE-598
Forms without an anti-CSRF token, or sent to another domain CWE-352 · CWE-201

Frequently asked questions

Is my code kept?

No. It is analysed in an isolated container with no internet access, then deleted as soon as the analysis ends. Only the results are kept, with secrets masked.

How much does it cost?

The Free plan includes ten analyses a month, no card needed. Paid plans add Citadel AI, analysis on every push and team work.

Other guides

Vibe coding security: the checklist before you put your app online

By tool

By technology