How EpicScan works

EpicScan reads your changed code the way a careful reviewer would: first it understands the file, then it hunts for bugs, then it argues with itself about every finding before reporting it.

The pipeline

1 · Context
A model writes a security briefing for each file: what it does, where untrusted data enters, which buffers exist and how big they are.
2 · Scan
Primed with that briefing, the model checks the code function by function and records structured findings.
3 · Skeptical triage
Every finding of medium severity or above is challenged over several rounds (5 by default). The reviewer can search the codebase to confirm or refute a claimed defence.
4 · Verdict
An arbiter reads every round and marks the finding valid or invalid. The confidence score is the share of rounds that said valid.

Results are saved as Markdown for people and JSON for tools.

Quick start: the CLI

Live

You need Python 3.8 or newer and an API key for the model you use. No packages to install.

git clone https://github.com/Huge/nano-analyzer.git
cd nano-analyzer
python3 scan.py --help

Scan a file or a whole folder:

python3 scan.py ./src/

Useful options:

Option	Default	What it does
`--model`	`gpt-5.4-nano`	Model used for every stage
`--triage-rounds`	`5`	Rounds of skeptical review per finding
`--min-confidence`	`0.0`	Show only findings above this confidence (0.0 to 1.0)
`--repo-dir`	auto	Repository root the reviewer may search
`--output-dir`	`~/nano-analyzer-results/<timestamp>/`	Where results are written

The full list of options is in the README.

Run it in your CI

Live

Any CI job that can run Python can run the scanner. Store your model API key as a protected CI variable and keep the results as a job artifact. A GitLab example:

security-scan:
  image: python:3.12
  script:
    - git clone https://github.com/Huge/nano-analyzer.git /tmp/nano-analyzer
    - python3 /tmp/nano-analyzer/scan.py ./src --output-dir scan-results
  artifacts:
    paths:
      - scan-results/

A ready GitLab merge-request job and a GitHub Action are in private testing. Early-access members get them first.

Command syntax

Roadmap

Comment on any pull or merge request:

@epicscan €<amount> [--max-delay <time>] [--depth <level>]

Part	Example	Meaning
`€<amount>`	`€0.50`	Most you will spend on this scan, in euros
`--max-delay`	`5m`	Finish by then; if time runs out, post a partial report. Accepts `90s`, `5m`, `1h`
`--depth`	`deep`	`quick`, `standard` (default) or `deep`: how the budget is spent

EpicScan plans the depth to fit both limits and reports what it covered and what it cost. Try it in the simulator.

What works today

Feature	Status
Open-source CLI scanner	Live
Running the scanner in your own CI	Live
GitLab merge-request job	In testing
GitHub Action	In testing
Your own model endpoint	In testing
Hosted scans on our Mac Studio machines	In testing
`@epicscan` comment command	Roadmap
Budget and deadline caps	Roadmap
Prepaid credits	Roadmap
Skipping unchanged files on re-scan	Roadmap

Limits you should know

Tuned for C and C++ memory-safety bugs; other languages give weaker results.
Each file is analysed on its own, so bugs that span several files may be missed.
Logic bugs, race conditions, crypto and authentication flaws are often missed.
A clean scan does not mean the code is safe.

Request early access