Nucleus runs the tools you already trust — Semgrep, Bandit, Gitleaks, OSV-Scanner, your own tests — combines their output, signs the aggregate, and publishes it to a public transparency log. Anyone can verify it offline. Anyone can reproduce it byte-for-byte. Works on any code: AI-generated, hand-written, or anywhere in between.
Public GitHub, GitLab, and Bitbucket repositories. Results in 15 seconds to 5 minutes depending on repository size. Large repos processed asynchronously.
Real scan of expressjs/express. All values deterministic and independently verifiable.
Full analysis report with gate results, security findings, code metrics, and improvement suggestions.
View Example →Ed25519 signed PDF certificate with cryptographic proof hashes, independently verifiable by anyone.
View Example →Downloadable proof pack containing all artifacts needed to independently replay and verify the result.
View Example →Paste the full AI response including code blocks. Nucleus will extract the code and verify the implementation against your claims.
Every scan runs your code inside a hardened bubblewrap sandbox — no network, nobody uid, dropped caps. Compile & syntax-check steps are wired for each of the languages below.
Five SAST engines on every scan: Semgrep · Bandit · Gitleaks · OSV-Scanner · CodeQL Deep Analysis
.nucleus-ignore
Nucleus Verify blocks the verdict on hardcoded secrets, command injection,
and critical IaC misconfigurations. If a match is a known false positive,
drop a .nucleus-ignore file at your repo root to suppress it.
Submit your code
Provide a public repository URL, upload a ZIP archive, or paste source code directly. Nucleus Verify clones the repository, indexes every file, and builds a complete artifact map before analysis begins.
Seven deterministic gates
Every scan passes through the same pipeline: gate_v2 (artifact integrity, JSON-canonical tree hashing), gate_d (determinism — same inputs always yield the same det_hash), contract (structural evidence matches the prompt or README), build (syntax & manifest), gate_s (995 structural operators for auth gaps, dead routes, hallucinated APIs, secrets), gate_scanners (external SAST, see below), and gate_exec (sandboxed compile + tests inside bubblewrap). Each gate produces a pass/fail result with evidence.
Five external scanners, versions pinned
On every scan, Nucleus runs Semgrep (p/security-audit — CWE Top 25 coverage), Bandit (Python-specific), Gitleaks (hardcoded secrets), and OSV-Scanner (250,000+ dependency CVEs). The version, binary, and finding fingerprint of each tool is recorded on the attestation, so a third party re-running the same tools on the same artifacts gets byte-identical results. Business plans unlock 8 enhanced operator packs (Semgrep Pro rule sets, AI analysis, custom compliance). Enterprise customers can request custom operators mapped to their specific frameworks.
Signed attestation, published to the transparency log
You receive an Ed25519-signed certificate, an in-toto / SLSA v1 DSSE envelope, and a SARIF 2.1.0 report for your existing security tooling. The signature is appended to a public hash-chained transparency log, so forgery is detectable even without trusting us.
Verifiable offline — by anyone, without us
Download our single-file Python verifier (only dependency: PyNaCl) and the public-key bundle. Your auditor can confirm any Nucleus certificate without a network call to us. Revoked keys are rejected automatically.
Wire it into your CI in three lines
Add Nucleus to GitHub Actions, GitLab CI, CircleCI, or any pipeline that can POST to an API. Attestation links are posted on every PR. View on GitHub →
Every run is deterministic. Every tool's version is recorded. Every result is signed and published to a public log.
det_hash. Verified with three artifact orderings.p/security-audit), Bandit (Python), Gitleaks (secrets), OSV-Scanner (CVE database). Each tool’s version and finding fingerprint is recorded and signed.bubblewrap: no network, read-only filesystem, resource caps. If the code doesn’t work, the verdict drops.bubblewrap sandbox with no network, no host FS, dropped capabilities. 33 runtimes supported: Python, JavaScript, TypeScript, Go, Rust, Java, Kotlin, Scala, Groovy, Clojure, Ruby, PHP, C, C++, C#, Objective-C, Elixir, Erlang, Haskell, Lua, R, Julia, Perl, OCaml, Racket, Ada, D, Nim, Pascal, COBOL, Assembly, Shell, Crystal. Proves the code is not only well-formed but also runnable in a hostile environment.What Nucleus Verify still does not check: business logic correctness, runtime behaviour under production load, zero-day vulnerabilities, accessibility.
Real result from a public repository verification. All values are deterministic and reproducible.
Every verification run produces the same cryptographic hashes for the same input. You can independently replay any proof pack to confirm the result.
Same repository, same seed, same hashes. Always.
Nucleus works on any code — hand-written, AI-written, generated, vendored. AI output has characteristic failure modes (hallucinated APIs, missing implementations, fabricated dependencies), so we include AI-specific operators and differential-regeneration verification. But a Nucleus certificate is just as meaningful for a 2015 Python codebase.
Real finding from a verification run. The AI claimed it implemented file upload, but the code contained no upload handling, multipart parsing, or file storage logic.
915 public repositories. Python and JavaScript ecosystems. Zero consistency errors.
A system that verifies 41% of real-world repositories is honest. A system that verifies 90% is lying.
Every certificate explicitly lists the NOT_verified scope. We publish our CWE coverage matrix alongside every release.
Verify AI-generated code before it ships. Certificate in every PR. Know exactly what was built vs what was claimed.
Structural gaps caught before production. Audit trail for every decision. Trust scores you can track over time.
SOC 2 ready. PostgreSQL audit log. Ed25519 signed. Independently replayable. Full chain of custody.
| Feature | CodeQL | SonarQube | Snyk | Nucleus Verify |
|---|---|---|---|---|
| Finds vulnerabilities | ✓ | ✓ | ✓ | ✓ |
| Cryptographic signing | ✗ | ✗ | ✗ | ✓ |
| Independent replay | ✗ | ✗ | ✗ | ✓ |
| Tamper-evident chain | ✗ | ✗ | ✗ | ✓ |
| Honest scope disclosure | ✗ | ✗ | ✗ | ✓ |
| DORA / FCA evidence | ✗ | ✗ | ✗ | ✓ |
| Works alongside existing tools | — | — | — | ✓ |
Nucleus Verify finds vulnerabilities and produces cryptographically signed proof that the review happened — independently verifiable by anyone. It works alongside your existing tools or as a complete verification solution on its own.
Start free. Scale when you're ready.
Need just one certificate? $4.99 one-time per verification. Available on the result page.
For enterprise enquiries, custom plans, or volume pricing contact contact@altermenta.com