How it works
You stay in the loop
- evaluateYou pick the standards: built-in, your team's rules, or both. The model you choose reads the code and never changes a line.
- knowA grade per dimension and one overall, against the standards you chose. Every number opens the findings behind it.
- decideYou review each finding and its evidence: send it to the fix plan or dismiss it. The last word is yours.
- fixA plan per dimension: which files, what is wrong, in what order. Fix it yourself or hand it to your agent, then run it again.
Real findings
Four findings, exactly as reported
CRITICAL[security · integrity]BenchmarkTest00848.java:72
reason
CWE-89 ASVSSQL injection via concatenated query param
detail
bar = param is concatenated directly into the SQL string and run with Statement.executeBatch.
src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00848.java:72
70String bar = param;7172String sql = "SELECT * from USERS where USERNAME='foo' and PASSWORD='" + bar + "'";
MAJOR[reliability · recoverability]_pty_unix.py:84
reason
CWE-772 CISQ FIO42-CPTY descriptors leak if selector registration fails
detail
The master and slave descriptors are opened before selector construction and _watch, but the cleanup try/finally starts afterward. If selector creation or registration raises, neither descriptor is closed; repeated failed spawns exhaust the process file descriptor limit.
src/quodeq/terminal/_pty_unix.py:84
84self._selector = selectors.DefaultSelector()85self._watch(master)
MINOR[security · integrity]BenchmarkTest00425.java:50
reason
CWE-20 CISQ ASVSUnvalidated parameter stored in session
detail
request.getSession().putValue("userid", bar) stores request parameter with only a suffix appended.
src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00425.java:50
46StringBuilder sbxyz2192 = new StringBuilder(param);47String bar = sbxyz2192.append("_SafeStuff").toString();4849// javax.servlet.http.HttpSession.putValue(java.lang.String,java.lang.Object^)50request.getSession().putValue("userid", bar);
COMPLIANT[security · integrity]BenchmarkTest00932.java:57
reason
CWE-89 ASVSSwitch always selects constant branch
detail
switchTarget is 'B', so bar = "bob" and the SQL contains no user input.
src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00932.java:57
56case 'B':57 bar = "bob";58 break;
Chosen by hand: three from the OWASP Benchmark, whose answer key confirms them, one from quodeq's own code.
Read a whole sample reportTested in public
How well does it find security bugs?
The OWASP Benchmark is 2,740 small Java programs, half with a real vulnerability. A good tool finds those and leaves the safe ones alone.
quodeq + Claude Sonnet 5.5cloud AI
0.77
found minus false alarms
best balance
CodeQL 2.27classic scanner
0.60
found minus false alarms
finds all, many false alarms
quodeq + Qwen 3.8AI on your machine
0.20
found minus false alarms
finds bugs, flags most safe code
These are the latest published runs, measured on quodeq 1.12. Newer versions have not been re-measured yet.
See all resultsThe code map
Watch a codebase get better
Every file is a circle, red where issues pile up. Scroll through the weeks: nothing fixes itself, every circle that turns grey is a change someone made.
week 1 of 11, the first runeleven weeks later, most of the red is gone, and the map shows where
Your standards
Graded against the rules you choose
A standard is any set of rules you want your code held to. quodeq grades each one the same way.
The way you like code to read, even the subjective parts.
- A function does one thing and fits on a screen
- An error is never swallowed in silence
What you and the people you work with agreed, written down once.
- Every endpoint has an integration test
- A feature flag is removed after release
The rule book every team has to follow.
- No personal data in logs
- Services talk through the shared client
The guides of your stack: Kotlin or Swift on mobile, React on the web, Go or Spring on the server.
- React: hooks only at the top level of a component
- Go: an error is returned or handled, never dropped
- Kotlin: never block the main thread
Public standards of quality. These come built in.
- ISO 25010 quality dimensions
- CWE, OWASP ASVS, CISQ, WCAG 2.2
Ask the assistant to write one. Describe the rule and its source; it drafts the requirements, each linked to where it came from.
Custom standardsWorks with
Bring your own model
Your AI CLI
uses your existing sign-in
Common questions
Before you install
- what it costs
- Free and MIT licensed. You bring the model: a local one costs nothing, or use the AI access you already have.
- what languages
- Any the model can read; there is no parser to limit it. The public benchmark covers Java so far.
- where your code goes
- Only to the model you choose. There is no quodeq server, and with a local model your code never leaves your machine.
- does it work in CI
- Yes, on GitHub pull requests:
quodeq reviewposts the problems as a review, and it can write SARIF for code scanning. GitLab is not supported yet. How to set it up - does it replace my linter
- No, use both. A linter checks style and syntax; this looks at intent, data flow and design.