Lume (DebtRadar)
AI-Powered Security, Technical Debt & Compliance Intelligence Platform
Software trust and risk intelligence platform transforming codebase ASTs, multi-hop vulnerability attack chains, and architectural fragility into executive trust verdicts and CI/CD gates.
Overcoming Alert Fatigue in AppSec
Engineering and security leadership face crippling alert fatigue: traditional static application security testing (SAST) tools output thousands of noisy warnings without understanding whether a vulnerable code path is actually reachable from public HTTP handlers.
Furthermore, engineering debt and security vulnerabilities are often reported in technical jargon that fails to communicate true business risk, operational downtime impact, or compliance audit readiness to executive stakeholders.
DebtRadar (Lume) was built to change how organizations evaluate software trust. By modeling codebases as comprehensive AST dependency graphs, DebtRadar performs BFS shortest-path exploitability analysis to prove reachable attack chains, calculates an executive Software Trust Score, translates findings into dollar impact, and enforces automated merge gates in CI/CD pipelines.
Key Engines & Platform Highlights
D3.js Codebase Galaxy & Attack Graph
Renders interactive force-directed graph simulations representing symbols, modules, files, and multi-hop exploit paths with dynamic zoom and risk-tinted vector nodes.
BFS Shortest Attack Path Traversal
Traces whether public entry points (routes, controllers) can actually reach internal critical vulnerabilities (SQLi, SSRF, tainted deserializers) up to 6 hops deep.
Unified Software Trust Score (0 to 100)
Blends security exposure, architectural collapse risk, blast radius, and vulnerability hygiene into a definitive deployment verdict (SAFE TO SHIP, NEEDS REVIEW, or HIGH RISK).
Financial & Business Impact Translation
Converts raw CVEs and architectural fragility into executive risk metrics: estimated breach financial exposure ($/USD), downtime probability, and customer trust impact.
Automated SOC 2 & ISO 27001 Compliance Matrix
Automatically maps codebase security controls to SOC 2 Type II (CC6.1, CC6.6, CC7.1) and ISO 27001:2022 (A.8.8, A.8.28), exporting certified Markdown, CSV, and PDF evidence.
Deterministic AI Autofix & GitHub PR Gating
Leverages Hugging Face Mistral-7B to generate deterministic code patches and posts sticky PR comments with automated pass/fail Check Runs.
End-to-End Analysis & Deployment Gate Pipeline
From Git push to executive trust report, how DebtRadar maps and evaluates codebase resilience.
AST Parsing & Symbol Tokenization
Acorn parsers scan repositories, extracting call graphs, imports, exported functions, and third-party dependencies into an architectural graph.
Vulnerability & Threat Vector Detection
Pattern matching engines identify OWASP Top 10 vulnerabilities, leaked API secrets, insecure deserialization, and outdated dependencies.
BFS Exploitability Graph Traversal
Breadth-First Search traverses call paths from public route endpoints to internal vulnerability sinks to calculate reachable blast radius.
Trust Verdict & Business Impact Calculation
The platform compiles the 0 to 100 Trust Score, generates compliance control status, and estimates financial breach exposure.
CI/CD Gating & Sticky PR Autofixes
Enforces merge gates via GitHub Check Runs, posting verified autofix patches directly into pull request review comments.
Artifact Analysis & Screenshots
Click any image to inspect forensic details, telemetry graphs, and terminal outputs at high resolution.
DebtRadar Executive Trust Score & Attack Graph
Unified Trust Verdict, Exploitability Graph & Compliance MatrixThe executive dashboard displaying the overall Trust Score (88/100 Safe to Ship), BFS exploitability shortest path visualization, business financial risk exposure, and SOC 2 compliance readiness matrix.
Architectural Collapse Prediction
Calculates module coupling, circular dependencies, and blast radius of core components.
Interactive Demo Presets
1-click exploration of Core Banking API, Cloud Microservices, and Identity Gateways.
Time-Series Health Tracking
Monitors Trust Score velocity and security posture trends across commits.
Developer REST API v1
Scoped dr_live_ API keys with sliding-window rate limiting for enterprise pipelines.