Quaestor Get started
The Quaestor method

Read the case as it is built.

Scroll down. You'll follow one untrusted input — from a repository you point us at, through a sanitised codebase, across every linked repo, into a signed verdict, and out to a fix your developer applies in minutes. Every frame below is the real product.

Scroll to begin
Act I · Sign in

You sign in. The workspace is yours alone.

Quaestor runs as a multi-tenant cloud with hard, server-enforced isolation — or single-tenant inside your own private cloud. Tenancy is derived from your session; a foreign id returns nothing.

app.quaestor.one/login
The Quaestor sign-in form — organisation, email, password
Isolated tenant · nothing leaves your boundary

Four least-privilege roles: developer and defender scan and work cases, decision-maker signs off, admin runs the team. SSO via Entra ID / OIDC when you want it.

Every team

Your code and findings are isolated to you — no tenant can ever read another's, in cloud or on-prem.

Act II · Point at a repo

You paste a repository. Nothing else.

A GitHub URL is all Quaestor needs — one, a list, or a whole file. Each repo is sanitised (secrets stripped, sealed) before a model reads a line, and “Also scan related repositories” fans out into linked repos.

app.quaestor.one/scans
The New-scan form — paste a repo URL, choose a ref, and 'Also scan related repositories'
Developers

Paste a URL and walk away. The model runs read-only — no writes, no shell, no network — and never sees your secrets.

Act III · The investigation

It reads your code the way an attacker would.

Quaestor maps entrypoints, sinks and reachability, then follows untrusted input from where it enters to where it turns dangerous — across files, and across every repository yours depends on. A tainted value that crosses a package boundary is tracked into the linked repo, and back.

cross-repo taint · query-utils/build.js:12 → checkout-api/db.js:88
Act IV · The verdicts

Every finding is tried. Only proof is signed.

Each candidate walks eight gates. What survives is signed; what can't is refused — disproven or needs-evidence, never dressed up. A real registry from an OWASP/NodeGoat scan:

app.quaestor.one/cases
The real Case Registry showing ready, disproven and needs-evidence statuses on NodeGoat findings
ready survived all gates — fix it disproven a false positive, caught for you needs evidence plausible — it says what it needs
Defenders

False positives are caught for you, not dumped on you — triage stops being a full-time job.

Act V · The remedy

Your developer fixes what's real — fast.

A signed case hands the developer the real signed A–H ledger and the exact source→sink path, plus an AI-drafted fix scoped to the vulnerability. Apply, re-scan, and Stage ∞ auto-closes the case with a signed retest.

case · signed gate ledger
The real signed gate ledger — gates A to H all passed, Ed25519-signed with payload hashes
✦ AI-assisted fix · scoped to this case
// app/data/user-dao.js- if (received === user.password) {   // plaintext compare+ if (await bcrypt.compare(received, user.password)) {    return authenticate(user);  }
Applied · re-scan queued · Stage ∞ signs the auto-close
Developers

No wall of maybe-bugs, no guessing the fix — the proven path and an AI-assisted patch, closed in minutes.

One platform, three readers

Built for the whole team.

The same signed evidence serves the person who fixes it, the person who owns the portfolio, and the person who signs it off.

For developers

Fix what's real.

Every case opens to a proven exploit path — source, sink, and the trace between them — so you fix the bug, not a hunch.

  • Zero false positives to wade through — disproven items never reach your queue.
  • The exact source→sink path plus an AI-assisted fix scoped to the vulnerability.
  • Re-scan and Stage ∞ auto-closes the case with a signed retest.
case · evidence
Real case evidence — the LLM-validated source-to-sink path for a NodeGoat finding
For defenders

Own the portfolio.

A rigor surface competitors structurally can't produce: proof rate, mean-time-to-evidence, and the number that matters most — how much you disproved.

  • Proof rate & disproven rate across every repo — rigor you can report.
  • 0 rubber-stamped, by construction — nothing is confirmed on a guess.
  • Signed coverage and evidence SLAs, one governed view.
app.quaestor.one/analytics
Real analytics — proof rate, 25% disproven, 0 rubber-stamped, mean time to evidence
For decision-makers

Report with proof.

Quantified risk posture and a board-ready pack where every number traces to a signed verdict — not a spreadsheet you have to defend on trust.

  • $ risk exposure and SLA burn-down, built for sign-off.
  • Every figure backed by an Ed25519-signed, offline-verifiable decision.
  • Compliance mapping — SOC 2 · ISO 27001 · PCI · DORA.
app.quaestor.one/board
Real executive board — modelled dollar risk exposure, open cases and SLA
CASE SIGNED

That's one case. You have a repository full.

Point Quaestor at your code and get back a dossier you can hand to an engineer — or an auditor. Enterprises and growing teams book a demo or request access below; we respond the same working day.

Request a demo Request access Read the user guide