Branch A is safe. Branch B is safe.
The merge is not.
The worst vulnerabilities don’t live in a single pull request. They appear when two independently-safe branches merge — and every diff scanner on the market reviews one PR at a time, so none of them can see it. This is the one thing Stateward does that nobody else does.
An SSRF that exists only after the merge
Adds a handler that forwards a user-supplied URL to the internal HTTP client. No sink is reachable yet — safe alone.
app.post('/fetch', (req) =>
http.get(req.body.url)) // forwards user URLRefactors the HTTP client to follow redirects and drops the host allowlist. No caller passes user input yet — safe alone.
function get(url) {
// allowlist removed, redirects on
return fetch(url, { redirect: 'follow' })
}Clean ✓
Each PR reviewed in isolation. Nothing to flag.
SSRF 🔴
The user URL from A now reaches the allowlist-free client from B. Flagged, attributed to both branches, and confirmed by a full audit of the merged state — verdict: REJECT.
Reproduced end-to-end in our test suite (the housing-calculator demo repo), offline.
Knowledge base
A model of your whole codebase — call graph, trust boundaries, dependency reachability — kept warm across PRs.
Virtual merge
The prospective merged graph is computed from the base plus each branch’s changes, without actually merging.
Confirm & attribute
A full adversarial audit runs over the merged state to confirm the flaw, attributed to both contributing branches.
Cross-branch analysis and the whole-codebase audit are Stateward’s deep-reasoning layer, validated on our labeled evaluation suite. Like the rest of the product, they’re rolling out in private beta now.
Built to be trusted with your code
Read-only & ephemeral
Stateward can comment, but never pushes, merges or stores your keys.
EU-sovereign hosting
Code and security data stay EU-hosted via Citadea — built for NIS2, DORA and the CRA.
Whole-codebase aware
Reasons over your call graph and trust boundaries, not just the diff.
Stateward is in beta and onboarding design partners. Built by Yggdrasil Digital.