Get started in two minutes
Orvanta needs no agent and no CI change to start. Scan, review, fix.
1. Run your first scan
From the dashboard, click Upload a folder and select your project's root directory. Orvanta reads your Python, JavaScript, and TypeScript source in the browser and sends only text files (no node_modules, binaries, or lockfiles). Prefer to try it first? Use Scan the demo repo.
2. Read the findings
Each finding is ranked by severity and confidence and mapped to a CWE and OWASP category. Open one to see a plain-language explanation, a concrete attack scenario, and the business impact.
3. Generate and review fixes
On any finding, click Generate secure fix. Orvanta writes a production-ready patch and runs an adversarial self-review to confirm it resolves the issue without breaking behavior. Approve it to mark the finding resolved and improve your security score.
4. Open a pull request
Once you've approved fixes, use Prepare pull request on the project page. Orvanta assembles a single security PR — unified diff, risk summary, and follow-up checklist — ready to apply with git apply or open through the GitHub App.
Supported languages
Python, JavaScript, and TypeScript today. Go, Ruby, and Java are on the roadmap.
API status
The live service health, engine version, and rule count are available at /api/status.