Know where to look.
Findings point to the relevant code so the agent can focus on the issue.
The problem
AI is an Asset and a Risk
Bottleneck 001
More to Review
The new bottle neck is your team's ability to review all the code agents create.
Exposure 002
Hackers Are More Dangerous
With AI, bad actors can exploit vulnerabilities faster and more easily than ever before.
Volume 003
Your Backlog is Growing
Dev teams are forced to slow down to deal with vulnerability backlogs growing from dozens of static scanning tools.
Noise 004
False Positives Obscure the Reality
Tools of the past can't keep up with the speed of modern teams. False positives sap valuable dev time or cause alert blindness.
Introducing Rig
Automated Security
Inside the Loop
Rig checks code when the coding agent finishes a change. Findings go straight back to the agent, while the code and context are still fresh.
›_Agent chatsearch-api
THE LOOP / 01
The agent finishes a change. Rig starts a check.
Rig connects to the agent’s completion hook. The check starts automatically, without a developer remembering to run a scan.
The Difference
Clear Findings.
Actionable Fixes.
Give your coding agent the details it needs to address a security issue without waiting for a developer to investigate and explain it.
01 / THE ISSUERisky code
db.query( `SELECT * FROM users WHERE name = '${name}'`)SQL injection risk
User input can change the meaning of the database query.
02 / THE FIXSuggested change
db.query( 'SELECT * FROM users WHERE name = $1', [name])Keep input separate
Pass the name as a query parameter so it is treated as data.
Understand what matters.
Each finding explains the security risk and gives guidance for addressing it.
Check the change.
Rig checks again after a fix, showing whether the issue remains or the check passes.
How it Works
Security Checks That Keep Work Moving
Rig brings security feedback into the agent’s work, so issues can be addressed before the change reaches review.
Benefits
Fewer Vulnerabilities Reach Review
Find and fix vulnerabilities while agents work in minutes, not weeks or months.
Catch More
Catch more vulnerabilities before they make it to review or production.
Chase Less
Stop distracting developers with false positives so they can stay on task.
Ship More
Your developers spend more time shipping and less time managing vulnerability findings.
Get started
Set up Rig where
the code gets written.
- 01 / INSTALL
Install the CLI.
Rig runs on the developer’s computer, alongside the application being tested.
- 02 / CONNECT
Connect the coding agent.
Connect Rig to the agent’s completion hook so a finished task triggers a security check.
- 03 / CHECK
Run the first check.
Check the application and review the result, Rig checks subsequent work through the agent workflow.
Need feedback outside an agent session? Developers can also run a check directly from the CLI.
Works with your stack.
Agents
CodexClaude CodeOpenCode
Editors & terminal
VS CodeTerminal
Languages
PythonJavaScriptRust
CI / CD
GitHubGitLab
FAQ
Frequently asked questions.
01Does Rig work with my existing coding agents?
Rig connects to a supported coding agent through its completion hook. During the demo, we’ll review the team’s agent and application to confirm fit.
02Who makes the code changes / fixes to reported vulnerabilities?
Your existing coding agent makes the fix. Rig supplies the finding, code location, and fix guidance, then checks the updated code.
03Is Rig checking every keystroke?
No. The automatic check starts when the agent signals that it has finished its work. Developers can also run a check manually through the CL
04What happens if a fix does not work?
Rig reports that the vulnerability remains. If testing cannot complete, that is reported separately from a passed check.
05Does a clean scan mean the entire application is secure?
No. It means Rig completed the checks within that scan’s scope without confirming a vulnerability. Untested paths are not proven safe, and incomplete checks are reported separately.
06Will Rig Collect my Data?
No, Rig is committed to being the most secure and private security testing tool available.. Our telemetry is limited. Tests run on device and code and conversations never leave the machine.