Goshawk

Name: Goshawk
Brand: DeltaCoders

Self-service source-code security audits

The audit methodology we deliver by hand, turned into an application: run a scan on demand, or order the full audit with senior human verification.

Get in Touch The Audit Service

How a finding earns its place

Nine lenses sweep the code

Each reads the repository with its own question, in parallel.
A blind reviewer attacks each finding

It sees only the claim, and is told to refute it. What falls is dropped.
Severity is computed

A full CVSS v4.0 vector, scored by a deterministic library.
A defensible report

Mapped to ISO 27001, NIS2 or the Portuguese national regime.

Where it runs Fully managed, or hybrid: scanning inside your perimeter, judgment in the cloud

The harness is the product

Goshawk turns the source-code security audit into software. It sweeps a repository with nine independent lenses, hands every finding to a blind second reviewer instructed to refute it, computes severity deterministically instead of letting a model estimate it, and produces a report mapped to the compliance framework you answer to. Run the automated scan on demand, or the full audit tier where senior reviewers drive the verification.

A goshawk hunts inside the forest, not above it: precision flying through dense terrain, eyes on what everything else misses. It is also the bird the Azores are named after.

The challenge

Code review at scale forces a bad choice. Scanners are fast and shallow: they flood you with findings nobody verified, and the report reads like tool output because it is. Manual audits are deep and defensible, and they do not scale past the hours of the people running them.

The quality of an AI-assisted audit turns out to live in neither the tool nor the model. The same frontier model varies wildly depending on the process driving it. The process is where the value is, and a process trapped in an expert's head cannot be bought, scheduled, or repeated.

The solution

Goshawk encodes the methodology behind our delivered audits as software: the lenses, the blind verification workflow, the deterministic scoring, and the report that maps findings to the compliance measures you are accountable for.

You create an audit over one or more repositories, choose the execution mode and the compliance profile, and the system runs the sweep, drives the verification queue, and produces the report. What stays human is the judgment, and the product never pretends otherwise.

Two tiers, and the difference in writing

Where quality depends on human judgment, the report says so. On the report itself.

The automated scan gives you the systematic sweep and verified-by-construction mechanics in hours, and carries a written statement of what an unreviewed scan can and cannot claim. The full audit adds senior reviewers driving the verification queue, reconciliation of disputed findings, and an SLA in days. A self-service scan never presents itself as equivalent to a reviewed audit, which is exactly why its results can be trusted for what they are.

Fully managed

The default mode: your repository is ingested into a single-tenant instance, the sweep and the judgment run on frontier models, and nothing is shared with any other client. Fastest to start, reference quality.

Hybrid, inside your perimeter

Where the code cannot leave, the scanning lenses run on local models inside your perimeter and only the judgment steps reach a frontier model, as directed excerpts rather than the repository. The split is enforced by configuration, not by discipline, and what each mode gives up is stated in writing before the engagement starts.

Key features

Nine independent lenses

Each pass reads the code with its own question, from injection to access control, in parallel.

Blind adversarial verification

A second reviewer sees only the claim and its location, and is instructed to refute it. What survives, ships.

Severity computed, not estimated

CVSS v4.0 vectors scored by a deterministic library. No model ever guesses a score.

Compliance report packs

Findings mapped to ISO 27001, NIS2, or the Portuguese national regime, over the same scan.

Four ways to bring code in

A git URL with credentials, a folder, an uploaded archive, or a single file for a quick pass.

Two tiers, stated honestly

Automated scan with its limitation printed on the report, or a full audit with senior review and an SLA.

Cloud or hybrid execution

Run fully managed, or keep the scanning inside your perimeter with only the judgment in the cloud.

Bilingual, defensible reports

Delivered in English and Portuguese, with a read-only portal for the audited party.

How it works

Bring the code in

A git URL with read-only credentials, a folder, an archive, or a single file. Every run works on an immutable snapshot.

Declare the scope

Exposure statement, target verification level, and the compliance packs the report should map to.

Nine lenses sweep

Each lens reads the code with its own question, in parallel, and extracts claims with file and line.

Findings are attacked

A blind reviewer receives only the claim and its location, and is instructed to refute it. Refuted claims are dropped.

The report ships

Computed CVSS v4.0, coverage tables, framework mapping, and a read-only portal for the audited party. In EN and PT.

The rules that define the product

Never model output alone

Goshawk never presents a model's raw output as an audit. Every finding survives blind adversarial verification before you see it.

Numbers you can check

Severity comes from a deterministic CVSS v4.0 library with the full vector shown, so the score can be recomputed by anyone.

Limits stated, not hidden

Where a mode or a tier gives something up, the report says so in writing. That honesty is what makes the rest of it credible.

Goshawk

Nine lenses sweep the code

A blind reviewer attacks each finding

Severity is computed

A defensible report