Unslop

Find and fix known bugs. No model in the loop.

Live Static analysis and vulnerability scanning

Unslop is a modular, encrypted knowledge base of code bugs and vulnerabilities paired with a non-LLM detector. It ingests dozens of open-source vulnerability datasets into one sealed, source-blind store, then scans whole codebases in seconds by matching against it.

Open Unslop

What it does

Scans are deterministic: the same code produces the same findings, every run, with zero model calls and no code leaving the machine. Output is SARIF, so it drops into existing CI and code-scanning dashboards.

It also auto-fixes, either by swapping a matched chunk for the known-good code or by applying a registered safe rewrite. Because the match is exact rather than inferred, a fix is a substitution rather than a suggestion.

Who it is for

Engineering teams that need reproducible vulnerability scanning in CI without sending source code to a model provider.

What it costs

Free scanning tier; paid plans for larger codebases and private dataset hosting.

How we price everything else →

Terminology

Words this page uses in a specific sense.

Non-LLM detector: A matcher that finds known-vulnerable code by comparison against a dataset, with no language model in the analysis path. Deterministic and offline.
Source-blind store: The vulnerability knowledge base is encrypted and content-addressed, so it can be distributed without shipping the original vulnerable source it was derived from.
SARIF: Static Analysis Results Interchange Format, the OASIS standard JSON format that GitHub code scanning and most IDEs consume.

Facts

Field	Value
Name	Unslop
Status	Live
Category	Static analysis and vulnerability scanning
Platforms	Web, Windows, Linux, macOS
Pricing	Free scanning tier; paid plans for larger codebases and private dataset hosting.
Source	Closed source
Publisher	Cognitive Industries
Published from	Brisbane, Queensland, Australia

Capabilities behind it

Security and cryptography

Non-LLM vulnerability scanning, a self-playing cyber range, encrypted-at-rest stores, and licensing backed by proof-of-work.

How it compares

Unslop vs LLM-based code scanners

Both find problems in a codebase. They fail in opposite directions, so the choice is about which failure you can live with.

Sources

Where this page states a standard, an obligation or a research result, this is what it is drawn from. All external, all checkable.

ONNX Runtime: the inference engine behind the vision stack
Keystroke dynamics research overview: Computers & Security, the basis for HumanIO timing models
Fitts, P. M. (1954), The information capacity of the human motor system: the motor-control law behind cursor submovements