MISBAH · SOURCE CODE REVIEW

Analysis that holds up in an audit report.

Misbah is a source code review platform for security auditors and inspection teams. It maps how untrusted data moves through the code under review and turns each risk into documented evidence — file, line, path and the rule behind it — while everything, from the client’s code to the final findings, remains on your own machine.

Runs locally, offline
Step-by-step evidence
Rules open to inspection

Request a demo

Languages: 13Languages
Vulnerability types: 124Vulnerability types
Frameworks: 25Frameworks
Template engines: 10Template engines
Credential formats: 277Credential formats

From source to sink

Every finding tells its own story: where the data entered, how it travelled, and where it became exploitable — laid out on the code itself, ready to verify and ready to present.

Declared rules, not buried behaviour

Behind every conclusion is a rule you can open, read and cite. When a client asks why, the answer is on screen — and every rule can be edited or disabled, with the set extending through new rules to fit the scope of each engagement.

Scan summary

The whole assessment on one screen: severities, CWE classes and the timing of every stage — the executive summary, before you write it.

A starting point in unfamiliar code

Unfamiliar code stops being a blank page: discovered sources, the API surface and sensitive locations come together in one view that points the review to what matters first.

What the analysis covers

Mapped to CWE and OWASP

Untrusted input flow

SQL, OS command, code execution, path traversal and SSRF: the engine follows the input across functions and files, and shows every hop up to the dangerous call.

Second-order taint

Data one request writes to a database, a file or a session, and another reads back. The path is followed through the store and the load, not only within a single request.

Hardcoded secrets

277 real provider key and credential formats, with an entropy gate that drops documentation keys and placeholders instead of burying you in them.

Config-file security

73 rules over JSON, YAML, XML, TOML, INI, .env and .properties: disabled certificate verification, wide-open CORS, debug modes in production, keys written into config.

Cryptography & compliance

An inventory of the crypto calls in your code — algorithm, mode, key length — then a control-by-control verdict against NCS-1:2020, the Saudi NCA’s national cryptographic standard.

Template injection & XSS

Unescaped output across ten template dialects: Razor, Twig, Jinja, Go, Vue, ERB, JSP, Handlebars, Jelly and Freemarker.

Deserialization gadget chains

Not just a dangerous call: the engine looks for the object chain reachable from an untrusted deserialize all the way to a real execution.

Supported languages

13 programming languages

JavaScript
TypeScript
Python
PHP
Java
Kotlin
C#
Go
C
C++
Swift
Objective-C
Dart

Three confidence tiers, not one

The difference between proven and worth a look

Vulnerability

A complete, proven path: a known source reaching an unambiguous sink, with every hop between them shown by file and line.

Potential

A real path with a weaker end — a broader source, or a sink that depends on context. It deserves a read, not an alarm.

Hotspot

Attack surface recognised by presence, not by flow: a dangerous call or an entry point, with no traced path. Counted and shown separately, never folded into the findings.

The tier is not decoration: the engine separates what it proved a complete path for from what it merely recognised as attack surface, so a confirmed vulnerability is never mixed into a list of things that need a human read.

Reports to read, reports to process

Five formats from the same scan

A review does not end at the screen: one audience wants a document to open and send, another wants the findings inside its own tools, and a platform wants something it can read mechanically. All five formats come out of one scan with one command, and none of them is an abridged summary — every finding carries its source, its sink and every step between them.

html

A report to read

A self-contained document that opens in the browser and is sent as it is — for management and the audit file.

Inside the review

Markdown that drops into a merge request, a ticket or a wiki with no manual formatting.

sarif

Inside your platform

SARIF 2.1.0 uploads straight into code scanning on GitHub or GitLab, so findings appear on the very lines of the diff.

json

The finding, in full

Every finding with its complete path, plus the exact configuration the engine ran with — for your tooling and dashboards.

csv

For the spreadsheet

One row per finding: class, severity, file and line — for sorting and follow-up.

How it works

1
Open the review
The code under review opens locally, read-only; nothing ever leaves your machine.
2
Let the engine read
A flow model of the project is built, and every rule is weighed against its sensitive paths.
3
Report with confidence
Findings arrive ranked by severity and confidence, each with its evidence already attached.

Put Misbah on your next engagement

Write to us for an evaluation build that runs on your own machines, or a guided walkthrough on sample code.

sales@safina.sa

The blocks above are not images; they are the application interface itself, taken from a running build against real scan results.