Menu
The shift The loop Attacks Shield Learning What it does Screens Demo Docs Get it

From the first error
to the verified fix.

Error monitoring and cyberdefence, built for the AI era.

Most tools stop at the alert. codesafe keeps going:

  1. FIXESRanks the error, writes the patch, opens the pull request.
  2. PROVESWatches the release and confirms the fix held.
  3. REPLAYSRe-runs the attacker's request, to see if it still works.
  4. SHUTSCloses the door the attack came through, until the fix ships.
0
of everything a public site reports is attack traffic
The other quarter is your real bugs. We tell them apart — and fix those.
Open the live demo See the loop Get an instance
The CODESAFE errors grid: live rows with project, type, priority, message, occurrence counts and star/check actions
THE SHIFT

AI writes the exploit. AI has to write the patch.

Finding a hole is now minutes of machine work. A defence that takes weeks has already lost — and a defence you have to prompt is not running when it matters.

Exploit, written by AI
minutes
Patch, the old way
weeks
Patch, with codesafe
minutes

“A derivative of coding is, of course, bug finding. And a derivative of that, which is a very large market, is called cybersecurity.” — Nvidia’s Jensen Huang, Goldman Sachs conference, 10 September 2026, reported by Business Insider. He added the point that matters here: these systems earn their keep by running continuously, not when someone prompts them. That is what codesafe does — around the clock, on your own traffic.

THE FULL CIRCLE

Six arcs. Two of them close the loop.

Four arcs every error monitor has. The last two almost nobody closes.

IDENTIFY01 CLASSIFY02 ADVISE03 ACT04 VERIFY05 LEARN06 THE LOOP closes itself

  1. 01 IDENTIFY

    Every error, probe and refused login. One case, with its evidence.

  2. 02 CLASSIFY

    Severity is decided on arrival. Nobody triages a list by hand.

  3. 03 ADVISE

    The root cause in plain language. Where it is safe, a patch.

  4. 04 ACT

    It opens the pull request. It never merges. That stays yours.

  5. 05 VERIFY

    It waits for the release. Then it re-runs the request that failed.

  6. 06 LEARN

    A rule that cries wolf loses standing. What slipped past becomes a proposed rule — reviewed, then shipped in the next release.

ATTACK TRAFFIC

Attackers use AI now. So does your defence.

An attack shows you where you are weak. Read it, and it is a free penetration test.

Your site is probed every day. Most of it is harmless knocking.

One attack in five is an exploit attempt, not a scan.

codesafe keeps that traffic out of your bug list — and reads it.

It names the address, the weak spot and the patch.

Then it re-runs the request, to prove the door is shut.

75%of what a site reports is attack traffic
20%of those attacks try an exploit, not a scan
92%of what one AI-driven attack exposed was a real defect

Measured on our own codesafe, 3–12 September 2026: 27 803 attack events against 9 250 errors, from 285 addresses. The 92% is one AI-driven attacker against one site we maintain — 25 issues surfaced in a morning, 23 of them needing a code change.

SHIELD

The patch takes a release. The rule takes five minutes.

Every site pulls its rules from codesafe and judges each request before your code runs. Nothing is refused because a machine decided so.

SHIELD · rule 17 example
kind
match
where
query contains ../../
from
a CVE advisory · report plugin 2.4
sites
demo-shop, demo-web
seen
7 days · 214 matched · 0 signed-in users
mode
observe → proven
answer
403 — before the plugin runs
promoted by an admin, with a note

  1. 01 DRAFT

    From a CVE advisory, from a probe in your error list, or from the route that was hammered yesterday.

  2. 02 OBSERVE

    Live on every site, blocking nothing. It counts what it would have stopped — and whom.

  3. 03 PROVEN

    A person promotes it. An exploit attempt gets a 403, a hammered endpoint a 429.

  4. 04 ALARM

    A proven rule that refuses your real users is an urgent case. Its one action: demote.

It runs in WordPress (even before WordPress loads), in any ovos/php-library app, in Node and behind any PSR-15 stack, with one rule language for all of them. A project refuses nothing until it is allowed to.

PROPOSALS

It learns from what it got wrong.

Every night it checks its own rules both ways: what they caught that people marked as wrong, and what slipped past them. A rule that catches the wrong thing is narrowed or retired; what got through becomes a new or wider signature. Each change is tested first, then handed to codesafe's authors as a pull request. Every instance gets what they merge with the next release.

PROPOSAL · learn/sqli-union example
evidence
41 requests no signature caught, on 3 sites
change
one signature, tightened · 4 lines
trial
catches all 41 · flags none of the benign corpus
checks
CI passed
state
waiting for review
VIEW PRDECLINE

  1. 01 SCREEN

    AI reads the requests no signature caught, and keeps what it finds as evidence.

  2. 02 DRAFT

    Enough evidence, and it writes the change: a new signature, a tighter one, a rule from an advisory.

  3. 03 TRIAL

    The draft runs against everything seen so far — what it would catch, what it would wrongly flag.

  4. 04 PROPOSE

    A pull request against codesafe's own repository, with the evidence attached and the CI read back.

  5. 05 DECIDE

    codesafe's authors review it and merge it, and the next release brings it to every instance. Only a change built on a false report is declined — and it is never proposed again.

An advisory does not wait for a release: its drafted rule can go straight into the Shield of the instance that saw it, accepted by the people who run that instance. Every site pulls it within five minutes, in observe until a person promotes it.

WHAT IT DOES

Eight jobs, done without you.

Each one is a thing you would otherwise do by hand, at night.

Nothing is lost in a storm.

Errors land in Redis in under a millisecond. Your app serves on.

A thousand errors, one line.

The same fault collapses into one row with a count.

It decides what is serious.

Impact and urgency are scored on arrival, per project.

It writes the patch.

A read of your repository, a diff, a pull request. You review.

It proves the fix held.

After the release it re-runs the request that failed. Measured, not claimed.

It watches what goes quiet.

Cron jobs and pages. You hear it before your users do.

Your AI can ask it.

Point Claude at codesafe over MCP — one command. It reads, and it acts.

Every stack you run.

A drop-in library, a snippet, or a CMS plugin. Your CMS not covered? Tell us — we write the client and integrate it for you.

IN USE

See it working

Real screens from a running instance. Nothing mocked.

Live demo

And the running instance is open.

It is codesafe itself, not a tour of it. Errors, uptime checks and attack waves keep arriving while you read — and you can work them.

codesafe-demo.ovos.at
Errors grid
ERRORSThe live grid. Filter, star, bulk-act.
An expanded issue showing its lifecycle, trend, affected hosts and releases, an AI root-cause read, the exception, the full stack trace and the request metadata
FULL TRACEOne issue, expanded: stack, request, releases, AI read.
Issues view
ISSUESGrouped by fingerprint, with lifecycle and attention.
Stats dashboard
STATSCounts, trend and the top issues.
Monitors view
MONITORSUptime checks and dead-man's switches.
Project edit dialog
PROJECTSPer-project rules in one dialog.
SETUP, PROPOSALS: four changes codesafe drafted to its own rules, each with the evidence, the kind of change, its trial against the corpus, and COPY PATCH and DECLINE
PROPOSALSIt drafts changes to its own rules, for its authors to review.
A natural-language question typed into search being translated by AI into codesafe filters
AI SEARCHAsk in plain language. It becomes filters.

…and on your phone

The same codesafe. Grids fold into cards, controls fit a thumb.

Errors grid on a phone — rows rendered as stacked cards
ERRORSThe grid becomes cards.
Issues view on a phone with state filters and card rows
ISSUESState filters, thumb-friendly.
Stats dashboard on a phone with stacked cards and sparkline
STATSCounts, trend and top issues.
WHO IT'S FOR

Anyone who looks after a website.

If a site is your responsibility, this is for you. One codesafe, however many you run.

Agencies and freelancers

Every client site in one codesafe, keyed apart. No bill that grows with the client list.

In-house teams

Every app you run in one place, whatever it is built in. Shipping and watching in the same view.

WordPress and CMS sites

Install the plugin, paste a key. Errors, probes and plugin CVEs land in one list.

Teams whose data cannot leave

Your own instance, on infrastructure you control. Personal data is masked on arrival; the original is kept encrypted and revealed only with a reason, logged.

High-traffic portals

Error storms hit Redis, not your app. codesafe indexes behind you.

Whoever is on call

codesafe does the night shift: it ranks, patches, verifies and only then wakes you.

GET IT

Your own instance, either way

Not a shared tenancy. The only question is who runs the machine. Before either: the live demo is open to anyone, with no login and nothing to install.

Run for you

We operate your instance from Vienna, in the EU. You point your apps at it. Nothing else to think about.

office@ovos.at

On your infrastructure

Your data stays inside the building. We set the instance up on your servers and hand you the keys.

Talk to us

Running a CMS we have no client for — TYPO3, Drupal, Shopware, something in-house? We write it and integrate it. Tell us the platform and the version.