Source analysis

Most scanners look at one file at a time. Real AI vulnerabilities don’t live there.

Rowan builds a call graph across your entire codebase and follows tainted data from source to sink, across imports, modules, and async boundaries. A three-hop taint path across different files is invisible to pattern matching. That’s where the real findings are.

Request access →

In the wild

The vulnerabilities dependency scanners miss.

A vulnerable dependency only matters if your code can actually reach it. Rowan traces the call graph to tell the difference, surfacing real, reachable issues in the frameworks production AI applications depend on.

Example HIGH A path-traversal in an LLM framework’s prompt loaders. Dependency scanners flag this class of issue as informational because they can’t prove a call path. Rowan traces it through the call graph and confirms whether it is actually reachable from your entry points.

The limitation

Real vulnerabilities don’t stay in one file.

An SSRF that crosses two files and an async boundary won’t show up in a single-file scan. Rowan follows the full path and shows you exactly where it breaks.

[CRITICAL] Server-Side Request Forgery, confidence: high

        Source
        api/endpoints.py:3   url = request.args.get(‘url’)
        Via
        api/endpoints.py:5   return await client.get(url)
        Sink
        clients/resource.py:9   httpx.get(url), no validation
      
No URL validation, scheme restriction, or allowlist detected.

Coverage

What Rowan tracks.

Cross-file taint

HTTP params, CLI args, env vars: tracked to dangerous sinks across files, imports, and async function boundaries.

AI/ML attack surfaces

torch.load(), trust_remote_code=True, apply_chat_template(): each has dedicated rules that understand what these do in an AI context. A general-purpose scanner doesn’t know what they mean.

Model file scanning

Static analysis of binary model files (pickle checkpoint formats, GGUF metadata, and Keras layers) before they are loaded into memory.

Reachability-aware SCA

Only surfaces CVEs your code can actually reach. Most SCA tools report vulnerabilities in functions you never call. This doesn’t.

Prompt injection paths

Taint flows into LLM system prompts, RAG contexts, and Jinja2 template rendering. The full attack chain, not just the sink.

Framework-specific rules

Named rules for LangChain, Keras, OmegaConf, ONNX Hub, Gradio, and other AI infrastructure libraries. These aren’t in general-purpose scanner rule sets.

Architecture

Four parallel analysis engines.

Each engine covers a different class of vulnerability. Results are combined, deduplicated, and ranked before output, so you see one prioritised finding list, not four separate reports.

Cross-file taint analysis

Follows user-controlled data from HTTP handlers and CLI args across file and function boundaries to dangerous sinks. The finding includes every hop: source, intermediate calls, and sink.

AI-specific pattern scanning

AST-based rules written specifically for AI frameworks: unsafe model loading, missing auth on inference endpoints, misconfigurations in LangChain, Keras, OmegaConf, and similar. These aren’t in general-purpose rule sets.

Reachability-aware supply chain

Checks your dependencies against the CVE database, then traces whether the vulnerable function is reachable from your entry points. If there’s no call path, it’s suppressed. In practice this cuts most of the noise conventional SCA surfaces.

Autonomous hunt mode

An agentic pipeline that forms hypotheses about where vulnerabilities exist, traces potential exploit paths, and tries to confirm them. Not a CI tool. Use it for research and deep audits.

Output

Scored findings. Standard formats.

Confidence scoring

Every finding gets a confidence score based on source clarity, taint path length, and whether sanitizers appear in the path. High-confidence findings are direct exploit paths. Lower ones are patterns worth a look. Filter to the top tier if you want a short list.

Output formats

SARIF 2.1	IDE and GitHub Advanced Security
JSON	Programmatic integration
HTML	Shareable report
CSV	Ticket import
CycloneDX AI-BOM	Supply chain attestation

Setup

CLI and web API.

Runs locally with no infrastructure required. Also available as a FastAPI web service with project management, triage dashboard, and REST endpoints for CI integration.

# Scan a local project
rowan scan ./my-project

# Scan with SARIF output for CI
rowan scan ./my-project --format sarif --output findings.sarif

# Run the agentic hunt pipeline
rowan hunt https://github.com/org/repo --backend gemini

Changed-file scanning, PR security gates, and a GitHub Actions template are included. The free Gemini API tier is sufficient for most repositories.