Know what your security scan actually checked.

FASE local scans your code with four open-source scanners on your own PC, in a throwaway container. You see what each one found and which ones didn't run, so a gap never looks like a clean result.

Create account See what we measured
  • Your code stays on your PC
  • Shows what didn't run
  • Free during the pilot
example/payments-api · mainSample data

Scan results

Findings need review
Findings to review
14
Critical
1
High
3
Scanners not run
1
  • Secrets (Gitleaks)Ran
  • Unsafe code (Semgrep)Ran
  • Vulnerable packages (OSV-Scanner)Ran
  • Infrastructure settings (Trivy)Ran out of time

How it works

From repository to results

There is nothing to install on your machines. Connect a repository and FASE does the rest.

  1. 01

    Connect

    Install the read-only GitHub App and choose which repositories FASE can read.

  2. 02

    Scan

    FASE takes one commit into a throwaway sandbox and runs four scanners over it.

  3. 03

    Review

    See each finding with its severity and file, and which scanners didn't run.

  4. 04

    Keep scanning

    Your first scan is free. A plan lets you scan again as your code changes.

Your code

FASE reads your code to scan it, and then it's gone.

Read-only access

FASE connects through a GitHub App that can only read. You choose which repositories it can see, and you can remove it at any time.

A throwaway sandbox

Each scan gets its own container, with no network, no shared folders and strict limits, running under gVisor.

Code is not kept

Your code is only held in memory-backed storage during the scan, and is gone when the container ends.

Findings, not secrets

FASE keeps each finding and where it is, but never the matched secret or a line of your source code.

Why FASE?

  1. Gaps stay visible

    A scanner that was missing, timed out or failed is listed as not run, so it never counts as a clean result.

  2. Findings need review

    A scanner can be wrong in both directions. FASE lists what it found for you to judge, and no findings is not proof of security.

  3. Limits are published

    You can see each scanner's blind spots and how the scanners score on public benchmarks before you rely on them.

Coverage map

What each tool looks at, and what it can't see.

No scanner covers your whole application, and FASE doesn't test it while it's running. You should know each tool's blind spots before you rely on its result.

  • Secrets
    Gitleaks

    Current files only. Git history isn't scanned.

  • Source code
    Semgrep

    A small set of FASE's own rules. Logic flaws are mostly out of reach.

  • Dependencies
    OSV-Scanner

    No lock file means nothing is checked, and only some ecosystems are covered.

  • Infrastructure config
    Trivy

    Accuracy isn't benchmarked yet.

In the local app · Evidence record

Everything an assessment produces ends up in one record.

Scanners, your own tests and your reviewers all feed the same record. Decisions and reports come from it, so you can trace each one back to what was actually shown.

What goes inThe recordWhat comes outReviewersOwners, approvals and rationaleScannersGitleaksSemgrepTrivyOSV-ScannerOWASP ZAPIsolation test scriptsYour tests, with signed receiptsUploaded evidenceEach file is SHA-256 hashedEvidence and hashesFindings and ownersControls and reviewsFrozen snapshotRelease decisionBlockedException requestedApproved for internal reviewReportsPDF and JSON, labelled asinternal self-assessmentsCI gategate.json → 409Stays at 409 until the projectis ready, so a pipeline can stop

What goes in

  • ReviewersOwners, approvals and rationale
  • ScannersGitleaks, Semgrep, OSV-Scanner, Trivy and OWASP ZAP
  • Isolation test scriptsYour tests, with signed receipts
  • Uploaded evidenceEach file is SHA-256 hashed

What comes out

  • Release decisionBlocked, exception requested or approved for internal review
  • ReportsPDF and JSON, labelled as internal self-assessments
  • CI gategate.json returns 409 until the project is ready

In the local app · Tenant isolation

Your tests decide what's shown. FASE keeps the receipt.

Declare your isolation tests in the project's target definition. FASE runs them at the assessed commit and signs the results, and the receipt must cover exactly the tests you declared.

  • A project that declares no tests is always blocked from review.
  • Scripts only receive the credentials you name.
  • So far this has been tested against local stand-ins, not a real staging environment.
Your testscriptas tenant ALocal staging cloneRLS policyRefusedTenant A rowsTenant B rowsSigned receiptrls-receipt.json · commit · HMAC
Illustration. What's actually checked depends on your scripts.

In the local app · Release gate

Approval is refused until every check clears.

A decision is tied to a frozen snapshot, and needs a named approver and a written reason. A reviewer can't approve around an open blocker.

Assessment snapshotfrozen · SHA-256RELEASE GATEEvery control passed or not applicableNo unresolved critical or high findingsSecurity scans recordedEvidence files uploadedPassed controls name a reviewer and evidenceIndependent test verified, if that control is assignedAll checks clearA reviewer can record the releaseas approved for internal review.Still not a certification.Any check openFASE refuses approval. Record it asblocked or request an exception.An exception doesn't make it a pass.
Assessment snapshotFrozen, with a SHA-256 hash
  1. Every control passed or not applicable
  2. No unresolved critical or high findings
  3. Security scans recorded
  4. Evidence files uploaded
  5. Passed controls name a reviewer and evidence
  6. Independent test verified, if that control is assigned
All checks clearA reviewer can record the release as approved for internal review. Still not a certification.
Any check openFASE refuses approval. Record it as blocked or request an exception. An exception doesn't make it a pass.

Pricing

Free while FASE is in its pilot.

Pilot organisations are invited, scan with FASE local, and tell us what works. Plans open after the pilot.

  • Pilot

    £0

    • FASE local, on your own PC
    • Executive summary and full report
    • Your feedback shapes FASE
    Ask to join

What FASE doesn't do

We publish the limits, so you don't have to find them.

  • It isn't a certification.

    FASE doesn't issue a security grade, and a scan doesn't prove that nothing is wrong.

  • It doesn't replace a penetration test.

    Independent testing still needs to be done separately.

  • Its detection has limits.

    The scanners it runs miss many known problems in our benchmarks, raise false alarms, and mostly can't reach logic flaws.

  • The hosted service only reads code.

    It scans a repository at one commit. It doesn't test your running application or your live infrastructure.

  • The hosted service stops at the findings.

    It lists what the scanners found. Tracking fixes, holding evidence and recording release decisions are in the local app only.

  • It's early.

    The hosted service is new. FASE has assessed one real system, a local copy, and no deployed one yet.

The Semgrep figures are for the rules the hosted service runs, written by FASE. They were widened for the kinds of problem these benchmarks contain, so read them as a best case: expect less on your own code. They're here to show how far scanners like these can be relied on.

41.3%

Semgrep's overall score on OWASP BenchmarkPython, with FASE's rules. Random guessing scores 0%. It flags 18% of the safe tests, and command injection scores below zero.
Weak hash: +100%Weak hash+100%Secure cookie: +100%Secure cookie+100%Deserialisation: +66.7%Deserialisation+66.7%XXE: +65%XXE+65%Weak randomness: +58.6%Weak randomness+58.6%LDAP injection: +33.2%LDAP injection+33.2%SQL injection: +20%SQL injection+20%Open redirect: +11%Open redirect+11%Path traversal: +10.5%Path traversal+10.5%XPath injection: +9.8%XPath injection+9.8%Cross-site scripting: +4.5%Cross-site scripting+4.5%Trust boundary: +0.9%Trust boundary+0.9%Code injection: −0.4%Code injection−0.4%Command injection: −46.2%Command injection−46.2%Weak hash: +100%Weak hash+100%Secure cookie: +100%Secure cookie+100%Deserialisation: +66.7%Deserialisation+66.7%XXE: +65%XXE+65%Weak randomness: +58.6%Weak randomness+58.6%LDAP injection: +33.2%LDAP injection+33.2%SQL injection: +20%SQL injection+20%Open redirect: +11%Open redirect+11%Path traversal: +10.5%Path traversal+10.5%XPath injection: +9.8%XPath injection+9.8%Cross-site scripting: +4.5%Cross-site scripting+4.5%Trust boundary: +0.9%Trust boundary+0.9%Code injection: −0.4%Code injection−0.4%Command injection: −46.2%Command injection−46.2%
View the values as a table
CategoryScore
Weak hash+100%
Secure cookie+100%
Deserialisation+66.7%
XXE+65%
Weak randomness+58.6%
LDAP injection+33.2%
SQL injection+20%
Open redirect+11%
Path traversal+10.5%
XPath injection+9.8%
Cross-site scripting+4.5%
Trust boundary+0.9%
Code injection−0.4%
Command injection−46.2%

10 of 34

Marked Juice Shop challenges found by Semgrep with FASE's rules.

0 of 3

Known vulnerable packages found by OSV-Scanner, as Juice Shop's source has no lock file for it to read.
ZAP needs a browser to reach an application like Juice Shop. ZAP runs in the local app only, and the crawl is off by default because it loosens the container. ZAP flagged these findings, and nobody has exploited them here.
Without the browser crawlWith it

URLs reached

116195

API routes reached

027

Findings

718

High severity findings

03

Semgrep measured on 8 November 2026, the rest on 4 November. Results on your application may differ.

FASE local

FASE local · By invitation

Run FASE's scans on your own computer.

For organisations in the pilot. FASE local scans on a PC you control and sends only the results to your portal, labelled as run on your device. A session you sign in with stays on that PC.

  1. Sign inAs an owner of your organisation.
  2. Download and pairInstall FASE local on a Windows PC with Docker, and approve its pairing code.
  3. Scan from your PCScan code and test a registered web address with ZAP, signed in if you choose.
Set up FASE local

Not invited yet? Sign in and ask for your organisation from the same page.

See what a scan of your repository finds.

FASE is in a pilot. Create your organisation and ask for FASE local. There's nothing to pay.

Create account About FASE local