Skip to main content
FOR PRINCIPAL & STAFF DEVELOPERS

232ms Local CLI Discovery & Compiler-Verified Autofixes — 0 Bytes Uploaded

Built as a static CGO_ENABLED=0 binary with --offline --no-telemetry. Catch quantum-vulnerable RSA/ECDSA call sites and patch SQLi, path traversal, and DoS sinks inside an isolated worktree before you open a pull request.

Download Signed Offline CLI (.zip)Start 7-Day Free Pro Trial (100 CLI Scans)
3-Command Local Verification (0 Bytes Uploaded)
ciphermap preflight ./repo --offline
ciphermap scan ./repo --offline --no-telemetry --format sarif -o results.sarif
ciphermap fix ./repo --dry-run --offline
Zero Cloud Exfiltration

Air-Gapped Static Binary

Runs 100% locally with --offline --no-telemetry. Zero source files, secrets, or git commit histories ever leave your workstation.

Gate 1–4 Sandbox

Zero Broken Builds

Every AST patch is compiled and tested against your real test suite with T0/T1 broken-build isolation and 100% automatic rollback if any test fails.

Local Stdio MCP Referee

Cursor & Claude Code Guardrails

Wire ciphermap mcp and .cursor/rules + CLAUDE.md ratchets so AI coding assistants never reintroduce weak crypto or injection sinks.

ROI & ENGINEERING TIME CALCULATOR · US NATIONAL AVERAGE BENCHMARK

Estimate Your Monthly Manual Triage Cost vs. Automated Local Remediation

Application Security & Senior Software Engineers average $160,000/yr (~$80/hr) in the US before benefits, and multi-repository external PQC readiness assessments typically run $15,000–$75,000+ for static spreadsheets that never fix a single line of code.

25 repos

Scale from a single flagship service (1 repo) to a 250-repo enterprise fleet.

1 repo ($4,999 Sprint)250 repos
3 engineers

Anchored at $160,000/yr (~$80/hr · $13,333/mo) per engineer.

1 engineer20 engineers
450 findings

Includes deprecated RSA/ECDSA/SHA-1 call sites, JKS/PKCS#12 certs, and SQLi/XSS/path sinks.

50 findings5,000 findings
CipherMap Deterministic Savings Benchmark

At 232ms median local repo scan (verified across 832 benchmark repos with 0 crashes), CipherMap inventories all 25 repositories in ~5.8s and verifies fixes via T0/T1 compile-and-test sandboxed autofixes.

Monthly Engineering Bleed

$6,480/mo

~81 hrs/mo manual triage (@ $80/hr)

CipherMap Net Annual Savings

$130,261/yr

Includes avoiding ~$62,500 external audit

Recommended Flat-Rate License Tier

Team Fleet (Up to 25 Repos)

$9,999/yr

$4,999 Sprint 100% credited in 30 days

Zero Hidden Fees / 100% All-Inclusive Enterprise Pledge

$0

per-developer seat tax

Unlimited developer & CI/CD runner commits inside your licensed repository tier.

$0

token/Byte-upload fees

100% local deterministic AST & bytecode engine—zero cloud token metering or per-line surcharges.

$0

mandatory professional services tax

White-glove CI/CD, GitHub Actions, and local MCP setup included with annual fleet plans.

Start with a 7-Day Free Pro Trial (100 CLI scans) or $4,999 Single-Repo Sprint
Explore Founding Partner Offer
UNFAKABLE TECHNICAL CASE STUDY & PROOF WALL

Four Verifiable Engineering Proofs You Can Audit Offline in Under 3 Minutes

No slideware, no cloud uploads, and no unverified AI patches. Every claim below is reproducible on your own workstation before you spend a dollar.

PROOF 01 · ZERO EXFILTRATION0 bytes of source code ever leave your machine

Air-Gapped Zero-Exfiltration Guarantee

Compiled as a standalone CGO_ENABLED=0 static binary running with --offline --no-telemetry. Verify zero outbound sockets yourself under strace, Little Snitch, or inside an air-gapped VPC runner.

  • CGO_ENABLED=0 static binary with SHA-256 checksums
  • --offline --no-telemetry enforced at runtime
  • 0 bytes of source code ever leave your machine
CGO_ENABLED=0 · ciphermap scan . --offline --no-telemetry
PROOF 02 · DETERMINISTIC SCALE232ms median scan time across 832 repositories · 0 parser crashes

Speed & Scale Proof

Benchmarked across 832 real-world multi-language repositories (Go, Rust, Python, TypeScript/JS, Java, C/C++, C#, Ruby, PHP, Swift) with 232ms median local scan latency and 0 parser crashes.

  • Go, Rust, Python, TypeScript/JS, Java, C/C++, C#, Ruby, PHP, Swift
  • Deep bytecode & keystore inspection (.jar, .war, .whl, JKS, PKCS#12, X.509)
  • Deterministic AST + call-graph reachability without LLM token variability
232ms median scan · 832 benchmark repos · 0 parser crashes
PROOF 03 · COMPILER-VERIFIED AUTOFIXT0/T1 broken-build isolation + 100% automatic rollback

Gate 1–4 Compile & Test Sandbox Proof

Every AST autofix is verified against your actual compiler/test suite inside an isolated worktree. T0/T1 broken-build isolation ensures that if a single unit test fails, CipherMap triggers a 100% automatic rollback.

  • T0/T1 broken-build isolation before any patch is proposed
  • 100% automatic rollback if a single test fails
  • Zero uncompiled regex replacements or hallucinated imports
Gate 1 AST → Gate 2 Build → Gate 3 Test Suite → Gate 4 Diff Sign-Off
PROOF 04 · DUAL-SIGNED EVIDENCEEd25519 + ML-DSA-65 (FIPS 204) CycloneDX 1.6 CBOM + CISA IBOM

Cryptographically Signed Audit Evidence

Every run emits a dual-signed (Ed25519 + ML-DSA-65 FIPS 204) CycloneDX 1.6 CBOM + CISA IBOM archival bundle ready for PCI-DSS 4.0, CNSA 2.0, CMMC 2.0, and FDA Section 524B assessors.

  • Dual-signed with classical Ed25519 and post-quantum ML-DSA-65 (FIPS 204)
  • CycloneDX 1.6 CBOM + CISA IBOM with file:line provenance
  • Mapped to PCI-DSS 4.0, CNSA 2.0, CMMC 2.0, and FDA Section 524B
Ed25519 + ML-DSA-65 (FIPS 204) · CycloneDX 1.6 CBOM + CISA IBOM
2-Minute Reproducible CLI Walkthrough (No Slides)

From Local Discovery to Signed CycloneDX 1.6 CBOM + Sandboxed Autofix

Download Offline Eval Pack (.zip)Inspect 832-Repo Benchmark Evidence
[00:00]Offline · 0 Bytes Sent

Step 1 — Air-Gapped Local Discovery (232ms Median)

$ ciphermap preflight . --offline --no-telemetry

Scans source, compiled .jar/.whl archives, X.509 certificates, and JKS/PKCS#12 keystores locally with 0 bytes uploaded.

[00:55]Offline · 0 Bytes Sent

Step 2 — Gate 1–4 Compile & Test Sandboxed Autofix

$ ciphermap fix . --verify-sandbox --offline

Applies deterministic AST migrations (e.g., RSA-2048/SHA-1 to ML-KEM/ML-DSA or parameterized SQL sinks) with T0/T1 broken-build isolation and 100% automatic rollback if any test fails.

[01:45]Offline · 0 Bytes Sent

Step 3 — Dual-Signed CycloneDX 1.6 CBOM + CISA IBOM

$ ciphermap report --format cyclonedx-1.6 --offline

Produces the Ed25519 + ML-DSA-65 (FIPS 204) signed audit binder for PCI-DSS 4.0, CNSA 2.0, SOC 2, CMMC 2.0, and FDA Section 524B assessors.