OzonebyCecuro

    Security that never stops watching.

    Ozone reviews every commit and pull request in your repos and flags vulnerabilities right on the PR, before they merge. Web2 and Web3, one engine.

    Coming soonBook a call
    OzoneLive

    • payments-service91cf5a3

      fix: webhook retry backoffGo

      Scanning

    • auth-serviceb2d47e0

      feat: password reset flowPython

      High

    • api-gateway7f03b8d

      chore: rotate session token configTypeScript

      Clean

    • vault-contractse4a91c2

      feat: add emergency withdraw pathSolidity

      Critical

    High · auth-service

    Reset link built from unvalidated Host header

    How Ozone works

    Three steps between you and continuous coverage.

    [ Step 1 ]

    Connect your repos

    Point Ozone at the repositories you ship from. Smart contracts, frontends, backends: everything you ship, Web2 and Web3.

    [ Step 2 ]

    Ozone learns your system

    It builds a working model of your architecture: call graphs, data flows, trust boundaries, and where the money moves.

    [ Step 3 ]

    Every change gets reviewed

    Each commit and pull request is checked against that model. Findings arrive with severity, impact, and a suggested fix.

    It learns your codebase first.

    Generic scanners pattern-match line by line. Ozone builds a working model of your system: how requests flow, which functions move funds, where untrusted input crosses a trust boundary. That model updates itself as your code evolves.

    api/auth.tstrust boundary
    services/payments.goexternal calls
    jobs/payouts.pysigns transactions
    contracts/Vault.solhandles funds
    contracts/Oracle.solprice feed
    contracts/Roles.solaccess control
    Ozonecall graph · data flows · trust boundaries

    Vulnerabilities flagged before they ship.

    Every commit and pull request is reviewed the moment it lands, with severity, impact, and a suggested fix commented directly on the PR. The cheapest vulnerability to fix is the one that never reaches production.

    feat: add emergency withdraw path#412Web3

    contracts/Vault.sol

     function emergencyWithdraw(uint256 amount) external {
         require(balances[msg.sender] >= amount);
    +    (bool ok, ) = msg.sender.call{value: amount}("");
    +    require(ok, "transfer failed");
    +    balances[msg.sender] -= amount;
     }
    ozone / continuous-securityChanges requested · 1 Critical
    ozonebotCritical

    Reentrancy: external call before state update

    msg.sender.call runs before balances is decremented. A malicious contract can re-enter and drain the vault. Move the state update above the call, or add a reentrancy guard.

    Web2 and Web3, one engine.

    Real attacks rarely respect the boundary. A leaked backend key drains a treasury. A compromised API feeds a bad price to a contract that trusted it. Ozone models both sides as one system and catches the issues that live in between.

    Web3SolidityRustVyperMoveand more
    Web2TypeScriptPythonGoJavaand more
    api-gatewayTypeScript
    auth-servicePython
    payments-apiGo
    Vault.solholds funds
    Oracle.solprice feed
    Bridge.solcross-chain
    Ozone layer

    Flagged: Leaked deployer key

    Web2Web3

    Built on the Cecuro audit engine.

    Ozone runs on the same multi-agent engine behind Cecuro's smart contract audits, ranked #1 on EVMBench, OpenAI's real-exploit benchmark. The same scrutiny, kept on continuously.

    See how the engine works

    Simple pricing.

    Start with a 7-day free trial that includes $50 of review credit, no card required.

    StandardFor small teams shipping daily.

    $19 / month

    ProFor teams running agents at scale.

    $100 / month

    See full pricing

    Put a protective layer over your code.

    Connect your repos and Ozone starts learning your codebase.

    Coming soonBook a call