Skip to main content

On-Demand Terminal Product Tour · 1:53 · 0 Bytes Uploaded

See CipherMap Run End-to-End in Your Terminal (100% Offline)

Watch all six offline stages in 113 seconds: read-only Preflight → PQC & Signed CBOM → 12-Language Zero-Day Scan → Compiler-Proven Auto-Fix & Safe Rollback → Single-Pass Upgrade → Local AI Coding Referee. Jump to any chapter or copy the exact CLI commands below.

Download Free Offline CLI (.zip)7-Day Pro Trial

ciphermap --offline · Complete 6-Step Product TourRetina Vector · 0ms

Single-Pass PQC + Bug-Class Auto-Fix

internal/vault/envelope.go

SINGLE-PASS · PQC-PRE-001 + IMM-PATH-001

Jails path + caps 50x larger PQC wire buffer first, then upgrades kyber768 draft to ML-KEM-768

IDE Before → After Verified AST Diff (Go)100% Deterministic · Zero Cloud LLM

28 func SealBlob(baseDir, name string, body io.Reader, peerEk []byte) ([]byte, error) {

29- f, _ := os.Open(filepath.Join(baseDir, name)); raw, _ := io.ReadAll(body)

30- ct, shared, err := kyber768.Scheme().Encapsulate(parseLegacyKey(peerEk))

29+ root, err := os.OpenRoot(baseDir); if err != nil { return nil, err }; defer root.Close()

30+ f, err := root.Open(name); raw, _ := io.ReadAll(io.LimitReader(body, 10<<20))

31+ ek, err := mlkem.NewEncapsulationKey768(peerEk); shared, ct := ek.Encapsulate()

✓ Compiler + Unit Tests + Sandbox Witness: PASS (0 broken files)

0 broken edits retained

Offline CLI Execution

0 Bytes Uploaded · 1.62s · Single Pass

$ ciphermap fix ./checkout-monorepo --with-immunity --apply --offline && ciphermap cbom ./checkout-monorepo --offline -o cbom.cdx.json && ciphermap immunity attest ./checkout-monorepo --out-dir ./attest⏎ ENTER

[██████████] 100% · Verified in 1.62s · Single PassLIVE

[offline] 0 bytes uploaded · Unified PQC + 12-Language Immunity planner

[IMMUNITY] internal/vault/envelope.go:29 -> os.OpenRoot + io.LimitReader

[PQC] internal/vault/envelope.go:31 -> ML-KEM-768 + X25519 hybrid

SIGNED cbom.cdx.json + ibom.cdx.json (.pqc.sig · 0 broken edits retained)

Unified Boardroom Deliverable PreviewZero-Egress Local Attestation

CNSA 2.0 / FIPS 203–205 Readiness + Bug-Class Extinction

Dual CycloneDX 1.6 CBOM & CISA IBOM · OpenVEX 0.2.0

Crypto & Code Sinks Hardened

31 crypto assets + 14 code sinks

Single-Pass Posture

PQC Hybrid + Sandbox Guard Active

Composite Signature: Ed25519 + ML-DSA-65 (.pqc.sig) VERIFIEDAuditor-Ready

100% vector DOM stage · Click any language pill above or watch recorded terminal runs (1:53 · 6 Chapters · 0 Bytes Uploaded)

6-Stage Offline Architecture · Benchmarked Across 832 Repositories

What every command in the tour does—and why it never breaks dirty repos.

Unlike cloud SAST scanners or unverified LLM bots, CipherMap runs locally as a static CGO_ENABLED=0 binary and separates pre-existing repository build errors (T0) from candidate patch verification (T1).

Step 01 · 0:00

Read-Only Preflight & T0 Baseline

$ ciphermap preflight ./repo --offline

Detects installed compilers and records your clean-tree build state (T0) without modifying a single byte. If a branch already fails upstream, CipherMap isolates that pre-existing error instead of blaming or breaking developer builds.

Step 02 · 0:18

PQC Audit & Dual-Signed CBOM 1.6

$ ciphermap cbom ./repo --offline -o cbom.cdx.json

Scans source, X.509/PKCS#12/JKS keystores, JARs, and binaries in ~232ms median time and seals CycloneDX 1.6 CBOM bundles offline with composite Ed25519 + NIST FIPS 204 ML-DSA-65 (.pqc.sig) signatures.

Step 03 · 0:37

12-Language Zero-Day Sink Scan

$ ciphermap immunity scan ./repo --offline

Finds SQL injection, unjailed path traversal, unbounded stream/zip OOM DoS, command injection, unsafe deserialization, and unguarded server actions across 12 supported languages (<4% false-positive rate).

Step 04 · 0:56

Compiler-Proven Auto-Fix & Safe Rollback

$ ciphermap immunity extinguish ./repo --apply --proof-out proof.json && ciphermap immunity attest ./repo --out-dir ./attest --proof proof.json

Synthesizes minimal AST patches, runs your compiler and unit tests (T1), verifies live exploit payloads are blocked in an OS-seatbelt sandbox, and rolls back 100% byte-for-byte if any gate fails.

Step 05 · 1:17

Single-Pass PQC + Bug Upgrade

$ ciphermap fix ./repo --with-immunity --dry-run --offline

Touches sensitive auth, storage, and payment files once: hardens co-located stream/path bugs before 15x–50x larger Post-Quantum keys hit those buffers, while declining cross-service protocol rollovers cleanly.

Step 06 · 1:35

Local MCP AI Coding Referee

$ ciphermap mcp --workspace ./repo

Runs locally over stdio inside Claude Code and Cursor with zero network sockets—blocking AI assistants from importing pre-FIPS kyber768 drafts or re-introducing SQLi and path traversal before git commit.

Focused Domain Clips · Zero Source Code Uploaded

Explore focused 30–50 second deep dives by team workflow.

Executive Overview · 1:20 (5 Scenes)

80-Second Pre-Call & Pre-Purchase Walkthrough

The 80-second executive & staff-engineering overview: why legacy cloud SAST stalls, how CipherMap generates a signed CycloneDX 1.6 CBOM in 232ms, patches 12 languages automatically, and verifies all 4 compiler & exploit gates before touching your git tree.

~95 WPM Live CLI5 Timed Voiceover Chapters

ciphermap --offline · Executive & Engineering Walkthrough1:20 · 5 Chapters

Now Showing — 01 Why Cloud SAST Stalls:0:00–0:15 · Local T0 preflight across 12 languages with 0 bytes uploaded

Workflow 01 · 0:46

PQC Audit & Signed CycloneDX 1.6 CBOM

Built for CISOs, cryptography leads, and federal/enterprise compliance teams. Inventories RSA, ECDSA, SHA-1/MD5, X.509/JKS/PKCS#12 keystores, JARs, ELF/PE binaries, and pre-FIPS Kyber/Dilithium drafts—then dual-signs CycloneDX 1.6 CBOM artifacts offline with Ed25519 + ML-DSA-65.

232ms median scan.pqc.sig provenance

ciphermap --offline · PQC Audit & Signed CBOM0:46 · PQC & CBOM

Now Showing — 01 Offline Crypto Scan:Finds weak RSA/ECDSA keys, SHA-1 certs & JARs in 232ms (0 bytes uploaded)

Workflow 02 · 0:47

12-Language Bug Auto-Fix & Zero Broken Builds

Built for AppSec and Staff Engineers tired of triaging thousands of SAST alerts. Synthesizes minimal standard-library AST patches across 12 languages, proves compiler + sandbox exploit gates pass, and rolls back 100% automatically on pre-existing broken branches.

832 repos · 0 crashesT0/T1 blame guard

ciphermap immunity · 12-Language Sandbox Auto-Fix0:47 · Auto-Fix

Now Showing — 01 12-Lang Zero-Day Scan:Catches Path Traversal, Zip-Bomb OOM & SQLi in first-party code (<4% FP)

Workflow 03 · 0:31

Local MCP Referee & Zero-Code Herd Immunity

Stop AI coding assistants from re-introducing legacy crypto or SQLi/traversal sinks before git commit. Runs ciphermap mcp locally over stdio with zero outbound network sockets, plus optional 12-node zero-code AST rule skeletons.

Claude Code + Cursor0 source lines shared

ciphermap mcp --workspace ./repo · AI Referee & Herd Immunity0:31 · Local MCP

Now Showing — 01 Local MCP AI Referee:Blocks insecure AI crypto & code edits over stdio in Claude Code and Cursor (0 sockets)

Human Engineering & Commercial Scoping

Schedule a Live 1-on-1 Call (25 min)

Speak directly with a CipherMap engineer to scope a 30-day multi-repository fleet pilot, air-gapped CI rollout, or immediate $4,999/yr Standalone Auditor onboarding (100% credited toward Fleet within 30 days). Never share source code or private keys.

Direct architecture & pricing review—no generic SDR script
Clear T0/T1 scope boundaries across 12 supported languages

Live 25-min 1-on-1 architecture & pricing call with an engineer (no source code shared)—or start today on a $4,999/yr Standalone Auditor card seat.

Self-Serve Local Evaluation

Prefer to run the CLI on your machine first?

Download SHA-256-verified native binaries for macOS, Linux, and Windows (x64 & ARM64), activate an optional 7-day Pro Trial key for local CBOM/OpenVEX and dry-run previews (or run ciphermap demo), or review transparent pricing.

Download Free Offline CLI (.zip)7-Day Pro Trial View Pricing ($4,999/yr+)