How it works
Nullify analyzes your code from both directions. Top-down analysis traces user input — HTTP requests, API calls, file uploads — through your application logic to identify unsafe data flows. Bottom-up analysis works backward from dangerous operations like SQL queries, OS commands and deserialization to determine whether untrusted data can reach them. Because the analysis reasons about behavior rather than matching patterns, it understands your framework conventions, your auth model and your data sensitivity. Every finding is then triaged against reachability, exploitability and business context before it ever reaches a human, and what's real gets fixed — not just reported.
Frequently asked questions
How is this different from the SAST scanner we already run?+
Traditional SAST matches signatures and hands your team alerts. Nullify reasons about how your application behaves, which is why it catches logic flaws like IDOR and broken access control that have no signature — and instead of an alert, the output is a validated, merge-ready fix.
Which languages and frameworks are supported?+
Sixteen languages, with framework-aware analysis — Spring and Jakarta EE for Java, Django, Flask and FastAPI for Python, Rails for Ruby, Node, Express and Next.js for JavaScript and TypeScript, Laravel for PHP, Axum and Actix for Rust including unsafe-block analysis, and more. The full list lives in the docs.
What happens when it finds something?+
The finding is validated and scored against your business context, then remediated: Nullify writes a minimal root-cause fix, validates it against the build, opens a pull request routed to the right owner, and manages it through CI and review until your team merges it.
Will it flood our developers with pull requests?+
No. Throughput is deliberately capped at three open Nullify fix pull requests per repository and five per remediation plan, so developers receive a bounded queue of evidence-backed, merge-ready changes to review.
Read the docs: Code Analysis · Supported Languages · Supported Weaknesses · Related: Triage & Remediation · Exploit Validation
