See what your software is missing against the standard.
GapScan reads your code, maps every finding to a control in standards like OWASP ASVS, and shows each unmet control as a gap with its evidence and a fix that is re-scanned before you merge. Security first. Every standard your software answers to next.
Open-source engine, Apache-2.0 · Runs in the cloud, on your servers, or fully offline
Coverage by chapter
105 controls checked“No finding” is never shown as “met”. A person decides what passes.
OS command built from a request parameter
helpers/export.py:43 · reached from GET /export
- 1Find
rule python.cmd-shell-fstring matched - 2Trace across files
request.args["file"] → run_export(name) → subprocess.run(shell=True) - 3Review AI
No validation on the path. Real issue, high confidence. - 4Fix
Pass arguments as a list, drop shell=True - 5Re-scan
0 findings on the changed lines
The gap model
One question, answered with proof.
Security tools tell you what they found. Auditors, customers and regulators ask something else: which requirement is not met, and how do you know? GapScan starts from the standard and works back to your code.
The standard
Each control your software answers to, starting with OWASP ASVS, Top 10 and MASVS.
Your code
What the software really does: source, dependencies, containers and infrastructure files.
Each unmet control
With the evidence, a coverage score for the standard, and a fix that is checked before it ships.
Find and prove
Every gap comes with its evidence.
A gap is not a guess. GapScan shows the path attacker data takes through your files, the control it breaks, and a review you can check line by line.
12@app.get("/export")13def export():14 name = request.args.get("file") # source15 return run_export(name)
41def run_export(name):42 cmd = f"tar -czf /tmp/out.tgz {name}"43 subprocess.run(cmd, shell=True) # sink
The file name from the query string reaches a shell command with no check. A value like x; rm -rf /data would run. Check this reasoning before acting on it.
42 cmd = f"tar -czf /tmp/out.tgz {name}"43 subprocess.run(cmd, shell=True)42 subprocess.run(43 ["tar", "-czf", "/tmp/out.tgz", "--", name],44 check=True)
- Gap
- ASVS V1.2.5 · OS command injection
- Opened
- commit 3f9c2a1 · 21 Oct 2026
- Closed
- commit 8be41d0 · re-scan clean
- Evidence
- trace, review, diff, re-scan log
anyone can verify it with GapScan’s public key
Close
Fixed means re-scanned, then signed.
GapScan proposes a fix, scans it again, and only then offers it as a pull request. In the cloud service, each closed gap becomes a signed record you can hand to an auditor or a customer questionnaire.
Standards
One engine. Every standard your software answers to.
Security comes first. The catalog grows in waves, mapped to the same evidence, with reports in English and Arabic for Gulf frameworks. GapScan reports coverage and gaps. It never calls a product compliant.
Vision
From a scanner to the place where gaps get closed.
The engine
Finds, proves and fixes security gaps on one machine or one team server.
- Rules, data flow, dependency reachability
- AI review and verified autofix
- OWASP ASVS, Top 10 and MASVS reports
- Self-hosted team server, offline bundles
The cloud
What a single machine cannot do, with your code staying in your own runner.
- Coverage view per standard
- Signed proof of fix
- Verdict network: shared, redacted triage
- Regression radar for new advisories
Every standard
The same gap model for the frameworks auditors and regulators use.
- NIST SSDF, ISO 27001, SOC 2, PCI DSS
- EU CRA, NIS2, DORA, GDPR
- Saudi NCA, SAMA, PDPL in KSA, UAE and Egypt
- Sovereign deployments at scale
GapScan finds, proves and closes the gaps between software and the standard it answers to. Security is the first standard, not the last.
Where it runs
Runs where your code is allowed to be.
Cloud
The default. Scans run in your CI runner or an isolated worker; AI sees redacted context only.
Sovereign
Self-hosted in your country or fully air-gapped, with AI on your own GPU.
CLI and CI
Scan, review and fix from the terminal, a pre-commit hook or any CI pipeline.
IDE and agents
Gaps in VS Code, and an MCP server so coding agents check their own work.
Measured, not claimed
Scored on data we never tuned on.
OWASP Benchmark, Python
community rules: +20OWASP Benchmark, Java, data-flow engine
community rules: +48Independent set: SecuriBench Micro and 6 real apps
the realistic estimateof real bugs dismissed by AI review, on every test set
3 of 110 on held-out JavaScore is catch rate minus false-alarm rate, the measure published tool comparisons use. Every number is on the held-out half of each benchmark, scored once. Full method and limits are in the evaluation docs.
Plans · planned launch pricing
Priced per contributor. Open at the core.
Free
$0Up to 10 contributors. All scan types and 500 AI reviews a month.
Pro
$12 /contributor/moUnlimited repositories, triage memories, Jira, Linear and Slack. Billed yearly.
Business
$29 /contributor/moVerified autofix, ASVS evidence packs, regression radar, SSO and audit log. Billed yearly.
Sovereign
$300 /contributor/yrSelf-hosted or air-gapped, from $4,900 a year for up to 15 contributors.
Know your gaps before your auditor does.
The cloud service is in development. Join the waitlist to get early access and a founding price that stays as long as you do.