Backed by
Combinator
Proven where the stakes are real.
Nebu watches your code and cloud around the clock. When it’s serious, the same team that’s found zero-days in Chrome and the Linux kernel steps in. Don’t let a breach be your first audit.
1169+
Vulnerabilities found
166+
CVEs assigned
Security vulnerabilities identified, verified, and officially recognized.
CVE-2026-43499
166+
CVEs assigned
Security vulnerabilities identified, verified, and officially recognized.
CVE-2026-43499
$400K+
VRP bounties
Latest advisories
- HOTCVE-2026-43499 — The world's first Android 17 root exploit
- HOTCVE-2026-5865 — Maglev JIT phi-untagging bug → remote code execution
- HOTCVE-2026-42530 — nginx-quicburst: the world's first default config nginx RCE exploit
- CVE-2026-8924 — super-cookie PSL bypass leaks cookies to unrelated domains
- HOTCVE-2026-10702 — IonStack: Full chain browser-to-kernel Android 17 root exploit
Security that meets your team where it is.
Code Security
Continuous codebase monitoring, verified findings, and patches ready to merge.
Coming soonSupply Chain Security
Secure the dependencies, build pipelines, and releases you rely on.
Coming soonCloud Security
Continuous visibility and control across cloud infrastructure, identities, and configurations.
Coming soonAI Pentesting
Continuous pentesting keeps your security posture up to date.
One platform for continuous security
Autonomous vulnerability scan
Every code change gets a comprehensive vulnerability scan with full repository context.
- Scan each code change
- Full repository context
Check Your Motor Oil Before Turbocharging: CVE-2026-7899, When V8's Optimization Engine Builds Up Carbon
Route of Root: Bring a "DoS only" bug to LPE and bypass the existing patch to win $10,500 in kernelCTF
IonStack part III: Rooting Android 17 with GhostLock
IonStack Part I: Unsound IonBanana Peel in Ion Compiler, Slipping Through Firefox's SpiderMonkey JIT
IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years
