DUDU STUDIO · MULTI-MODEL SECURITY AUDIT
Vettalon doesn't trust one model's own judgment. Different model families hunt for issues, then cross-check each other's findings, cutting false positives and leaving candidates worth a human's time. Your code is analysed on your machine; we never touch it.
Open-source core under Apache 2.0, free to use. The enterprise edition and commercial licensing come directly from DuDu Studio.
CAPABILITIES
One pipeline ties together OSS static scanners, multi-model AI review, adversarial cross-checking and sandboxed PoCs.
One model finds an issue; a model from a different family tries to refute it. Only cross-family review lowers false positives — a single model confirming itself does not count.
Analysis runs on your computer. During AI review, code snippets go only to the models you configure (your own CLI account or API key; a local Ollama keeps everything on-device). Vettalon never handles or resells them.
Audit the source of your dependencies for not-yet-CVE'd vulnerabilities, then responsibly disclose upstream. Your private code stays put; only each dependency's public name@version is sent.
HOW IT WORKS
Every stage of a deep audit is recorded, and a validator runs before any report is written.
Census languages, find entry points, read git history to flag files that keep getting security fixes, then rank modules by risk.
The top-ranked modules are dealt to finders; high-risk modules get a second read from a different family.
Each candidate goes to a verifier from another family that tries to refute it. Independence counts only reviews that gave a verdict.
For plausible high-risk findings, a minimal PoC is generated and run in a no-network, read-only, non-root Docker container.
JSON / SARIF output, validated before writing; exploitability tiers, CWE/CAPEC attack scenarios and disclosure drafts are included.
BENCHMARKS
The numbers below come from reproducible benchmarks; we report them as measured, limits included.
With the vulnerable file in scope, all 9 real CVEs were identified with the right file, line and vulnerability class.
OWASP Benchmark, 160 cases: 91% recall, 0 false positives (upper bound ≤ 3.8%). Cross-family review took a 7B local model from 57% FP to 0%.
The optional metadata-only ranker lifts deep-audit recall from 6/9 to 8/9, sending metadata only — code never leaves the machine.
Whole-repo recall is 5/9 (a vulnerable file that is huge and falls past the page cap can be missed); we state the limits too.
EDITIONS
The open-source core is enough for CLI and CI. The enterprise edition adds reports for people and a desktop experience.
The command-line auditor: OSS static scanners + multi-model AI review + adversarial cross-checking + SARIF output. Drop it into CI and set policy gates.
Desktop app and local dashboard, enterprise reports aligned with Taiwan security-assessment conventions (PDF / Word / HTML), supply-chain hunting and upstream disclosure drafts. Reads the same scan JSON; the core never depends on Pro.
FAQ
Analysis runs on your machine. During AI review, code snippets go only to the models you configure (your CLI account or API key); with a local Ollama, nothing leaves the device at all. Vettalon never handles, stores or resells them.
A single model has no resistance to its own judgment. Having different families cross-check is what lowers false positives. On the OWASP Benchmark, cross-family review took a 7B local model from 57% FP to 0%.
No. Jev only reorders which modules are audited first, and sends metadata only (paths, sizes, git hotspot counts), checked against the source file-by-file and failing closed before each request. It is off by default and only reaches the network when you explicitly enable it.
No. Hunting only reaches package registries and OSV, sending each dependency's name@version. It audits the dependency's public source; your private code stays put. Disclosures are always drafts a human decides to send.
The open-source core is a complete command-line auditor with everything CI needs. The enterprise edition adds a desktop app, local dashboard, enterprise report layouts and supply-chain hunting, all reading the same scan JSON.
GET STARTED