Security intelligence
for autonomous
code.
Smart contracts, agentic AI, and web backends introduce risk that traditional scanners were not built to measure. VORO scores findings across six threat dimensions using Bayesian probabilistic analysis and produces integrity-verified ThreatReports structured for auditor handoff, developer triage, and operator review.
Evidence engine online and ready for review.
Evidence-first threat reporting organized into one integrity-verified ThreatReport.
Bayesian scoring across six dimensions with structured review output for developers, auditors, and operators.
Six risk surfaces. One structured review.
Every finding maps to a threat dimension before it reaches your team. Triage starts with context, not a flat list of alerts ranked by severity alone.
This is what your team receives.
One integrity-verified ThreatReport. Two review modes. The same structured artifact moves between developer triage, audit prep, and operator review without rewriting the packet for every audience.
Verdict
No significant vulnerabilities detected. OpenZeppelin Contracts is a well-audited, industry-standard library. Minor informational findings only.
Gas Optimization Opportunity in ERC20 approve
Consider Using Custom Errors Over require Strings
Mapped to recognized security frameworks.
Findings cross-reference established taxonomies so your ThreatReport speaks the same language as your auditor, your compliance team, and the standards your customers already expect.
CWE
Common Weakness Enumeration
OWASP Top 10
Web vulnerability taxonomy
OWASP Smart Contract
Smart contract taxonomy
OWASP Agentic AI
Agent autonomy risk
SWC Registry
Ethereum weakness registry
CVSS
Severity scoring vectors
One artifact. Four workflows.
The same surface can support protocol teams, security engineers, agent builders, and auditors without pretending those users need identical workflows.
Protocol audits start from scratch every time.
VORO produces the evidence artifact before the auditor even starts.
Clients hand you a codebase, not a finding structure.
Start every engagement with a structured ThreatReport as your baseline evidence layer.
Standard security tools don't understand what autonomous agents can do.
The agent_autonomy dimension scores unscoped permissions and execution boundaries specifically for agentic code.
Cloud scanners mean uploading sensitive code to someone else's infrastructure.
Air-gapped. Offline-capable. Nothing leaves your environment.
Measured coverage. Honest boundaries.
VORO loads patterns for multiple languages. The landing page only claims coverage where benchmark-validated evidence exists.
Benchmark-validated now
Solidity, Python, and Go are the measured coverage set currently safe to present at the front door.
In bounded validation
Java, PHP, and C# remain in bounded validation rather than being flattened into the measured set early.
Pattern coverage beyond the measured set
JavaScript, TypeScript, Rust, Ruby, Motoko, C, C++, Kotlin, Swift, and Scala remain visible as broader pattern coverage, not equal benchmark maturity.
The scanner is the starting line.
VORO V1 ships the evidence engine: structured threat reporting with Bayesian scoring across six dimensions. The architecture behind it is designed for something larger.
Continuous posture scoring
Expand from one report into a broader risk surface that tracks how security posture changes across repositories over time.
Trust verification pipelines
Carry the evidence engine forward into stronger scan provenance and trust verification workflows as the current V1 controls widen.
Deeper agentic risk modeling
Push the agent_autonomy wedge further as OWASP Agentic AI taxonomy and customer workflows mature.
Two paths in. Same evidence engine.
Run the evidence engine locally or deploy the self-hosted Pro stack when your team needs browser and API review surfaces.
Run the evidence engine locally.
Air-gapped scanning from your terminal. Offline-capable, evidence-first output, ready to plug into your existing review workflow.
$ pip install voro-scanDeploy the full stack. Own the data.
Docker Compose deployment with browser and API scan submission, ThreatReport review, and export paths for auditor and developer handoff.
$ docker compose upSubmit code. Get your ThreatReport.
Three ways in: GitHub URL, contract address, or file upload.
Self-hosted workflow with GitHub URL, contract, and upload entry paths.
Report integrity check runs before save and the browser flow stays focused on six-dimension review output.
Use the CLI for the fastest cold-start path or the browser flow when the team needs a shared review surface.
Submit a repository, deployed contract, or file package for review in the self-hosted web path.
Self-hosted
Docker Compose on your infrastructure.
Lock-verified
Report lock check runs before save.
Pro workflow
Browser review with six-dimension reports.