Now reading DPDP obligations from code

Every finding arrives with its proof attached

Xyla reads your repository into a semantic graph, then returns each finding with the path that proves it, the confidence behind it, and what it could not check.

Scan a repository See DPDP answered from code

Read-only access. Nothing is written back.

DPDP Actcompliant
HIPAAcompliant
ISO 27001 · 42001in progress

Beta · live

Running in beta against the systems behind CampX and Anurag University — together serving 5 lakh+ users.

How it works

Prove the path. Test it. Record the decision.

Three steps, each producing evidence the next one uses.

One graph, not a pattern match

Every detector reads the same graph, built while the code is parsed. Detections survive renames, wrappers and callbacks.

Confirm it against a running target

Authorized probing turns a proven path into a confirmed one — or refutes it. Scope comes from a reviewed manifest, and no caller can widen it.

Keep the paper trail

Suppressions, approvals and lease revocations append to a per-tenant hash chain. A missing row is visible, not silent.

Benchmarks

Six to ten times the real vulnerabilities

Scored on public corpora against pinned versions of both competitors. Not a marketing claim — a repeated, scored result.

Recall, with the methodology attached · Semgrep 1.154.0 · Snyk 1.1306.0

OWASP BenchmarkJava

Java · 2,740 cases

RustMizan

Rust · memory safety

DVNA

JavaScript · 8 OWASP categories

juice-shop

TypeScript · 81 located challenges

Not tuned to these repositories: no repo-specific patterns, function names or directory assumptions. Precision is the other half of the story — 93.97% on BenchmarkJava at 95.83% recall, and 61.2% at located findings on juice-shop, where Semgrep reaches 85.7% on the 51 findings it returns.

Connections

Connect the systems your evidence comes from

Cloud, identity, source control and endpoint evidence — read-only, with credentials sealed on arrival and never returned.