Drag this title bar to move its window. With the title bar focused, use the arrow keys to move, Shift plus an arrow key to move farther, and Home to reset its position. On narrow screens, the windows move vertically while their fixed left rails stay anchored.
The V12 CLI starts a run on kestrel/streams and watches it complete with three findings. It saves the critical finding's proof of concept as a test, runs it with cargo to confirm the bug reproduces, and prints V12's proposed fix.
Securing the code behind systems that cannot afford to fail.
Every pull request gets a security review. Findings land beside the code, ready for your team to review.
Connect GitHub@v12sec please review the frontend & db surface
| Finding | Severity | Details |
|---|---|---|
| F-82768 | Critical | Removed status guard enables replayable refund drain |
Analyzed twelve files, diff 4f29a17...8bc320e.
Chat with V12 like it’s your security engineer. Ask it anything about the repo, and trigger a run for what actually matters.
Connect SlackYour coding agent knows how to use V12. Audit the code, pull the findings, and patch them—in one session.
Configure MCP ›
•Called
└v12.v12_findings({"runUid":42,
"severity":["critical","high"]})
3 of 3 findings.
•Run 42 complete — 1 critical, 2 high
UID 4 critical valid contracts/Vault.sol:41
Reentrancy permits complete vault drain
UID 9 high valid contracts/OracleAdapter.sol:88
Oracle price can be manipulated within one block
UID 11 high unreviewed contracts/WithdrawalAuthorizer.sol:126
Signature replay bypasses withdrawal limits
•UID 11 is unreviewed. Mark it valid, invalid, or acknowledged?
I can also change severity or add a note — after you confirm.
The entire audit lifecycle lives in your terminal. Quote, review, triage, fix, all from one binary.
Install CLI $
Scope: acme/treasury @ main
12 files2,841 LOC
Pricing input: 125,004 bytes
FILE BYTES LOC
AccessManager.sol 13,992 318
LiquidityPool.sol 26,488 602
… 10 more 84,524 1,921
Price $77.38, charged at start
Create this run? [y/N] y
✓ Run 42 created, queued
V12 finds bugs in software you already run. Recent disclosures from V12 research include Signal, QEMU, PostgreSQL, and the Linux kernel.
Browse the disclosures
today we are releasing a qemu escape
Type text into Wikipedia. Get the shell's output back on the page.
A bug introduced 22 years ago.
Still alive in the wild, until it was found by V12.
Here's how EasyTimeline allowed arbitrary code execution (RCE) directly from wikitext.
AnyPwn: AnyDesk preauth 0click RCE (heap buffer overflow)
we will release PoC post disclosure and patch
user → root privesc 0-day in CUPS
a free PoC while we wait for some bigger disclosures to go through 😇
🐬🐬🐬 dolphin rce 🐬🐬🐬
Signal's Contact Discovery automatically sends your contact list information to an SGX enclave in the cloud.
V12 broke into that enclave and leaked the key, allowing the server host to decrypt everything.
Two separate critical bugs: arbitrary read and RCE.
Here's how. 🧵
another day, another universal linux LPE
Default configuration of WKWebView can cause downloaded files to instead be rendered on the host page.
This allows HTML injection, and sometimes even XSS, in countless iOS and WebKit apps.
PlayStation 5. Firefox. X. Instagram. TikTok. Telegram. Binance...
Breakdown and POC. 🧵
And here's postgres bidirectional RCE
no admin required, client infects server, server infects client ♻️🐛
Stick around on our web page for 10 minutes and all your funds are gone.
Just connect your wallet to the dApp and enjoy some Temple Run. Unlock your wallet again and it’s empty 😇.
A silent signature extraction in @Rabby_io, leading to a full wallet drain. 🧵
Arbitrum Nitro normally runs natively, but disputes rely on fraud proofs run in a WASM VM.
If these two environments don't fully agree, it can get ugly… like “L1 bridge funds ($2.8B) can be extracted” ugly.
Here's how V12 uncovered two independent mismatches, autonomously.
found another one! redis 8.8.0 bidirectional RCE
we will release poc after the patch
unauthenticated root RCE on TerraMaster TOS4 NAS appliances. (+free additional LPE)
something light for sunday. bigger stuff this week! :-)
here's a mariadb RCE, what should we look at next?
we consistently find bugs human auditors miss
in this review for the Ethereum Foundation, we reported a unique High-severity bug. it stems from missing input validation
us and the human auditors found the same set of crits
Every change gets reviewed before it reaches production. Autopilot audits every change as soon as it lands.
Set up Autopilot2 Steers attached, one run
2 Steers attached, one run
2 Steers attached, one run
Tune the engine in your own words. A Steer is a short note on what reviews should look for. Point at past findings, runs and files, drop in a spec, then attach it to runs and Autopilot rules.
Write a Steer“We had our cryptography library audited by V12 alongside a human auditor. V12 caught every critical bug the human found and surfaced several issues the human missed. For a team our size, an independent review at this depth with both cryptographic and engineering insights was invaluable.”
“V12 has given us greater confidence throughout our Solana smart contract audit process. It consistently catches issues that are easy for humans to overlook, helping us identify potential vulnerabilities earlier and focus more of our time on validating complex attack scenarios. It’s become a valuable addition to our security workflow.”
“V12 found a critical soundness bug that had been lurking in our ZK code for over a year. Human expert auditors missed it. Since then, we’ve made V12 a central part of a security strategy. Better and cheaper than most human experts.”
“V12 has been great at spotting issues and helping us pipeline them into our production process. For Bulk, the biggest value is the loop: find risk, verify it, turn it into a ticket, fix, retest. Excited to see this loop get better every day!”
“We write a lot of complex cryptographic code, and security is always top of mind. Having a tool like V12 in our belt has been a huge lift for our security posture. We get detailed code review on complete repositories in hours, giving a boost in confidence for our engineers, researchers, and partners.”
“V12 is fantastic as another set of review eyes for your high velocity team. When fixing legacy code, it points out all the other ways it was already broken for you.”
