winfunc

What languages does winfunc support?

Winfunc adopts a combination of on-the-fly generated tree-sitter queries, plug-and-play language servers (LSP), and LLM-powered analysis for ingesting codebase context with 100% accuracy. The team has worked on the problem of "codebase comprehension" for more than a year. Winfunc supports all major programming languages, including Haskell, Elixir, Clojure, Lua, and niche languages like Arc.

How does winfunc guarantee zero false positives?

Traditional scanners rely on regex or shallow AST matching, leading to noise. Winfunc uses a formal verification engine that mathematically proves the existence of a vulnerability. For every finding, we generate an executable Proof-of-Concept (PoC) script that reproduces the exploit in your specific environment. If we can't exploit it, we don't report it.

Can winfunc find business logic bugs?

Yes. Unlike SAST tools that look for generic patterns like SQLi or XSS, winfunc builds a semantic map of your application's business flow. It understands roles, permissions, and financial transactions, allowing it to identify logical flaws such as unauthorized fund transfers, price manipulation, or race conditions like TOCTOU.

How is this different from a human pentest?

Speed and coverage. A human pentest takes weeks and captures a snapshot in time. Winfunc runs continuously on every commit and PR, providing the depth of a senior security engineer's audit in minutes. While humans excel at creative intuition, winfunc scales that intuition across your entire codebase instantly.

Do you have SOC 2 certification?

Yes, we are SOC 2 certified. You can view our security posture and compliance details at our Trust Center.