Connect your repo. See why it's exploitable.

Hacktech 2026 · California Institute of Technology · April 24–26

Static analysis tools have a precision problem. Semgrep fires hundreds of findings and developers ignore all of them. The hard part isn't detection — it's knowing which findings are actually exploitable in your specific codebase. That requires reading your code the way a senior security engineer would. Piratech does that in seconds.

Piratech is a two-layer security analysis pipeline:

Layer 1 — Semgrep (deterministic detection) Runs p/owasp-top-ten, p/secrets, p/sql-injection, p/nodejs, and p/python against the cloned repo. Produces structured JSON candidates. Fast, zero hallucinations. If Semgrep doesn't flag it, Piratech doesn't flag it.

Layer 2 — K2-Think-v2 (reasoning) For each Semgrep finding, the reasoning model receives the flagged file plus all relevant context — the route file, auth middleware, database layer — and performs four tasks:

Non-exploitable findings are suppressed. Only confirmed vulnerabilities reach the dashboard. The contrast — 23 Semgrep candidates → 4 confirmed exploitable — is the product.

React (Vercel)
     │  POST /scan
     │  WS /ws  ──── live finding_ready events
     ▼
FastAPI (Vultr)
     │
     ├── git clone (public URL or PAT-injected for private repos)
     │
     ├── Semgrep CLI (5 rulesets) → raw findings JSON
     │
     ├── context.py → flagged file + imports + auth/db/middleware (cap 10 files)
     │
     ├── K2-Think-v2 × N findings (parallel, K2_PARALLEL workers)
     │        └── exploitable? taint_path, auth_gap, exploit_steps, fix
     │
     ├── Backboard (optional) → per-repo persistent memory across scans
     │
     └── POST /webhook/github → auto-rescan on every git push (HMAC-verified)

No database. In-memory scan store is sufficient for demo. Backboard provides cross-scan memory if BACKBOARD_API_KEY is set.

{
  "rule_id": "javascript.express.nosql-injection",
  "file": "routes/auth.js",
  "line": 34,
  "matched_code": "db.findOne({ username: req.query.username })",
  "exploitable": true,
  "confidence": "high",
  "taint_path": "req.query.username (routes/auth.js:34) → passed unsanitized to db.findOne() (db/users.js:41)",
  "auth_gap": "Auth check on line 38 runs after the query — injection fires before authentication.",
  "exploit_steps": [
    "Send GET /login?username={\"$gt\":\"\"}",
    "MongoDB matches first document in users collection",
    "Credential check bypassed entirely — full admin access"
  ],
  "severity": "critical",
  "fix": "Validate input is a plain string before querying."
}

Every output contains: exploitable verdict, taint path with file/line evidence, auth gap assessment, step-by-step exploit, and a concrete fix. All claims are grounded in specific lines of your actual code.

• Docker + docker-compose
• Node.js 18+
• A K2-Think-v2 API key from api.k2think.ai
• A Semgrep token (semgrep login → cat ~/.semgrep/settings.yml)

git clone https://github.com/your-org/Piratech
cd Piratech
cp .env.example .env
# Fill in K2_API_KEY and SEMGREP_APP_TOKEN at minimum
docker-compose up --build
# Backend running at http://localhost:8000

cd frontend
echo "VITE_API_URL=http://localhost:8000" > .env
npm install
npm run dev
# Frontend at http://localhost:5173

1. Set GITHUB_WEBHOOK_SECRET in .env: openssl rand -hex 32
2. In your target repo: Settings → Webhooks → Add webhook
   • Payload URL: https://your-backend-url/webhook/github
   • Content type: application/json
   • Secret: same value as GITHUB_WEBHOOK_SECRET
   • Events: push only
3. Every git push now triggers a full rescan. Results stream live to the dashboard.

Reliable targets that produce 10–25 Semgrep candidates with several confirmed exploitable:

• vulnerable-node — Node.js, SQL injection + XSS + insecure auth
• DVWA — broad vulnerability coverage across multiple classes
• Any Flask/FastAPI app with raw string interpolation into SQL queries

In scope (MVP): Public + private GitHub repos, JavaScript (Express/Node) and Python (Flask/FastAPI/Django), false positive filtering, real-time WebSocket results, GitHub push webhooks.

Explicitly out of scope: GitHub OAuth, dependency scanning, languages beyond JS/Python, VS Code extension, CI/CD integration, team dashboards.