Offscan.

1. 01 · The problem

   Your AI wrote it. Nobody read it.

   AI tools now write a lot of the code that ships, and nobody reads all of it. The scanners that could check it run in the cloud: to use them, you hand over your source code. For a bank, or anyone with code they cannot share, that ends the conversation.

2. 02 · Why I built it

   I needed it on my own bug bounties.

   Security is my field. The AI tools I tried on bug bounties flagged too much that was not real, and never connected one bug to the next. I wanted a scanner that checks its own findings, links them into real attack paths, and never sends code anywhere. It started as a hackathon win in spring 2026, and I kept going.

3. 03 · The hard part

   Two designs failed. Then selling it was harder.

   The first design drowned the model in context. The second hit the 4GB limit of my laptop GPU. In June I rebuilt it from scratch. After a LinkedIn post, a vice president at a major Indian card issuer reached out, then went quiet. Banks were my first market, but their sales cycles were too long for a founder with no funding, so in September I turned to developers. Most cold outreach got no reply. A US investor said it was too early and asked to keep the door open. I nearly quit more than once.

4. 04 · Where it is now

   A private release, headed for developers.

   Offscan is in private release, built and tested by one person, and I am taking it to developers.

Who stays in controlYour code, your machine, your call. The AI runs on your own computer, and nothing is sent anywhere.

Hover a marked term to decode itTap a marked term to decode it

1. 01

   Read the code

   Its own static analysis and taint trackingFollowing untrusted input, like a form field, through the code to see where it ends up. (Following untrusted input, like a form field, through the code to see where it ends up.) follow untrusted input through the codebase.

2. 02

   Check each finding

   An on-deviceIt runs on your own computer. Nothing is sent to a cloud service. (It runs on your own computer. Nothing is sent to a cloud service.) model gives a second opinion on every serious finding and explains why. It never hides one or changes its severity.

3. 03

   Connect the dots

   Related findings are joined into attack chainsSmall bugs that, used together, give an attacker a real way in. (Small bugs that, used together, give an attacker a real way in.), so you see how small bugs combine into a real risk.

• The classic flaws

  Injection, SSRF, XSS, XXE, path traversal, unverified JWTs and weak hashing.

• Secrets, masked

  Keys and tokens, even in git history.

• Supply chain

  Risky Actions and vulnerable dependencies, checked offline.

• AI-era files

  CLAUDE.md, Cursor rules and MCP configs.

1. 01 · A solo developer

   Before launch.

   Checks AI-written code without it leaving the laptop.

2. 02 · A team under NDA

   Code that cannot leave.

   Runs fully offline, for banks and client code.

3. 03 · A coding agent

   Scanning its own edits.

   Fixes critical findings before it calls a task done.