Branch A is safe. Branch B is safe.
The merge is not.
The worst vulnerabilities don’t live in a single pull request. They appear when two independently-safe branches merge, and every diff scanner on the market reviews one PR at a time, so none of them can see it. This is the one thing Stateward does that nobody else does.
An SSRF that exists only after the merge
Adds a handler that forwards a user-supplied URL to the internal HTTP client. No sink is reachable yet, safe alone.
app.post('/fetch', (req) =>
http.get(req.body.url)) // forwards user URLRefactors the HTTP client to follow redirects and drops the host allowlist. No caller passes user input yet, safe alone.
function get(url) {
// allowlist removed, redirects on
return fetch(url, { redirect: 'follow' })
}Clean ✓
Each PR reviewed in isolation. Nothing to flag.
SSRF 🔴
The user URL from A now reaches the allowlist-free client from B. Flagged, attributed to both branches, and confirmed by a full audit of the merged state, verdict: REJECT.
Reproduced end-to-end in our test suite (the housing-calculator demo repo), offline.
Knowledge base
A model of your whole codebase, call graph, trust boundaries, dependency reachability, kept warm across PRs.
Virtual merge
The prospective merged graph is computed from the base plus each branch’s changes, without actually merging.
Confirm & attribute
A full adversarial audit runs over the merged state to confirm the flaw, attributed to both contributing branches.
Cross-branch analysis and the whole-codebase audit are Stateward’s deep-reasoning layer, validated on our labeled evaluation suite and available now.
Built to be trusted with your code
Read-only & ephemeral
Stateward can comment, but never pushes, merges or stores your keys.
EU hosting & data residency
Code and security data stay EU-hosted with EU data residency, built for NIS2, DORA and the CRA.
Whole-codebase aware
Reasons over your call graph and trust boundaries, not just the diff.
Stateward is live and ready to guard your code. Built by Yggdrasil Digital.