Since launch, Constantine has grown from an LLM-powered code vulnerability scanner into an end-to-end discovery-to-remediation engine. It now combines static analysis, LLM reasoning, and live traffic context in a single pipeline, generates and opens fix pull requests, and runs wherever your code lives — with the cost controls and configurability to scale across an enterprise.

What's New

Deeper, more accurate detection

• Code Property Graph analysis — Constantine now analyzes at function and call-graph granularity using joern Code Property Graphs, tracing data flow across even very large repositories (auto-partitioned when needed). Detection was validated against an 82-CVE benchmark spanning 8 CWE classes and 4 languages, and Rust joins as a first-class language.

• Hybrid SAST + LLM pipeline — Semgrep runs against source code at zero LLM cost and feeds its results into the LLM reviewer, cutting scan cost and duration while preserving detection quality. A deterministic static-regex hint layer pre-filters before any LLM call.

• Specialized detectors — a CWE-fanout scanner runs one focused agent per weakness class, and a new agent-trust-boundary scanner finds permission-model flaws in AI coding agents (the class behind recent Cursor, Claude Code, and Copilot CVEs).

• Severity calibration — a post-review "skeptic" stage re-rates each finding against its actual exploitability preconditions, reducing over-promoted Critical ratings; the original assessment is preserved for audit.

• Prompt-injection hardening + ensemble dedup — attacker-controlled content inside scanned files can no longer suppress real findings, and overlapping results from multiple detectors are collapsed by similarity clustering.

Discovery to remediation, inside Guard

• Patch generation → selection → GitHub PR — go from a finding to a proposed fix to an opened pull request without leaving Guard.

• Verified patches — generated patches are authored as structural edits and syntax-checked with tree-sitter after git apply --check, eliminating the diff-format failures that caused most rejections.

• Project-aware exploit validation — when a repo ships a Dockerfile or docker-compose, Constantine launches the project's own deployment to confirm exploitability against the real target.

Hybrid static + dynamic context

• Traffic-aware scanning — augment a scan with captured HTTP traffic (Burp Suite XML or HAR), or a pre-generated OpenAPI spec, so findings are anchored to endpoints that are actually reachable and user-controlled — and tagged with the live endpoint that surfaced them.

Configure and cost every run

• Visual pipeline editor — a structured editor with an inline Monaco YAML editor, per-module configuration knobs and compatibility constraints across all 22 modules, and pre-run cost projection calibrated on 209 production runs.

• Scan controls — a scan-mode selector (auto / full / diff) and run-tier selector (basic / medium / premium), plus a constantine target-metrics preflight that previews repo size and projected cost before you commit a run.

Run it anywhere, at enterprise scale

• ZIP / archive upload — scan a source-code archive directly from Guard, no source-control integration required.

• IP-protected customer-runner mode — run Constantine inside your own infrastructure; the complete findings bundle is age-encrypted before it leaves your environment and is only decrypted inside Praetorian infrastructure. Ships as pre-built, checksummed binaries for linux/amd64, linux/arm64, and darwin/arm64.

• DeltaScan on push/PR — an HMAC-verified GitHub webhook triggers delta scans automatically on new commits and pull requests.

• Cost governance — bring-your-own Anthropic key with per-customer isolation, per-scan AI budget caps (default $250), and expanded model routing (Bedrock via an OpenAI-compatible gateway, plus DeepSeek, Mistral, and Gemma SKUs).

Get Started

constantine target-metrics https://github.com/your-org/your-repo — preview repository size and projected scan cost before running.

Documentation

https://docs.praetorian.com/en/articles/1856234-constantine-locates-fatal-security-bugs-in-software