About codelake
Security that thinks
like an application.
Traditional security scanners were built in an era of monoliths. They analyze code file by file, report findings line by line, and leave teams to figure out the context. In today's world of microservices, AI-generated code, and complex data flows, that approach is fundamentally broken.
codelake was built from the ground up to understand applications as systems — not collections of files.
Our Mission
Make application security accessible, actionable, and complete.
Security shouldn't require a dedicated team of specialists to be effective. codelake's mission is to give every development team — from solo founders to enterprise engineering organizations — the same depth of security insight that was previously only available through expensive manual pentesting and consulting.
We believe security tools should produce context-rich, prioritized, actionable findings that developers can act on immediately — not pages of noise that get ignored. Every feature we build is measured against a simple question: "Does this help a developer fix a real security problem faster?"
Accessible
Free tier for everyone. No security expertise required to get started. Clear findings with remediation guidance that any developer can follow.
Actionable
Correlated risk narratives instead of isolated findings. Priority based on real impact, not just CVSS scores. AI-powered remediation suggestions.
Complete
Code to cloud coverage. From URL scanning to compliance automation. One platform that replaces the patchwork of specialized tools most teams cobble together.
The Company
Built by Akyros Labs.
codelake is built and operated by Akyros Labs LLC. We're a focused, product-driven team that believes the best security tools are built by people who understand both security and software engineering deeply.
Our vision extends beyond scanning. codelake is designed to become the complete security operations platform for modern engineering teams — starting with application security and expanding into continuous security testing, automated pentesting, and real-time threat detection.
Security First
Every architectural decision prioritizes security. Your code is analyzed in ephemeral, rootless containers with no network access. We never store your source code.
Developer Experience
We obsess over developer experience. Clean UI, fast scans, actionable results, and seamless integration with your existing workflow. Security should help, not hinder.
Transparency
Honest comparisons. Clear pricing. Public roadmap. We believe in earning trust through transparency, not lock-in and marketing claims.
Technical Philosophy
How we think about building security software.
codelake isn't just another wrapper around open-source scanners. Our architecture is purpose-built for application-aware security analysis with strict isolation, audit-first design, and multi-tenant safety.
Rootless Docker Isolation
Every scan runs in a rootless Docker container with no network access and all capabilities dropped (cap-drop=ALL). Your code is analyzed in complete isolation and the container is destroyed immediately after the scan completes. We never persist source code.
3-Tier Queue Architecture
Scan jobs are routed through dedicated queues based on plan tier — free, paid, and enterprise. This ensures fair resource allocation and SLA guarantees for paying customers while keeping the free tier available and responsive.
UUID-First Routing
All public-facing resources use UUIDs instead of sequential IDs. This eliminates enumeration attacks, prevents information leakage about system size, and ensures cross-tenant safety at the routing level.
Team Isolation
Every database query is scoped to the authenticated team. This isn't a filter — it's a non-negotiable architectural constraint enforced at the query layer. Cross-tenant data access is structurally impossible, not just unlikely.
Audit-First Design
Every state change in the platform generates an immutable audit event — finding status changes, team member additions, policy updates, scan triggers. The audit log is the single source of truth for compliance evidence and incident investigation.
Finding Fingerprinting
Findings are normalized across all scanner tools with deterministic fingerprinting. This enables deduplication across scan types, consistent tracking across time, and meaningful trend analysis even when underlying scanner rules change.
Architecture
Built on proven foundations.
Backend
Laravel 12
PHP 8.2+
Auth
Sanctum
Token-based
Queue
Redis
3-tier routing
Database
MySQL 8.0
Team-scoped
Frontend
Alpine.js
Tailwind CSS
Isolation
Docker
Rootless, no-net
Our principles
- ✓ No silent refactors — every merge includes route, permission check, audit event, and test impact assessment
- ✓ Team isolation is non-negotiable — every query must be scoped to the authenticated team
- ✓ Findings are normalized — across all scanner tools with fingerprinting for deduplication
- ✓ Plan limits at queue level — enforced at infrastructure level, not application level
- ✓ Soft deletes for everything — auditable entities are never hard-deleted
- ✓ Event-driven architecture — JobStarted/JobFinished pattern for all async work
Ready to see codelake in action?
Start with a free scan. See what application-aware security looks like. No credit card. No commitment.