Understand the codebase
Build context across repositories and components, including how data moves and where permissions matter.
The product
A tireless security reviewer for your codebase.
Find security vulnerabilities, understand their impact and give your developers evidence and suggested fixes. Dokima provides always-on security review and vulnerability scanning for code repositories. It keeps the review history as your code changes, using your preferred AI model. Dokima supports Claude and Codex directly, and other models through OpenCode, including Gemini, open models and privately hosted local models.
What you get
A review your team can act on.
Investigate vulnerabilities
Search for security issues, challenge initial findings and check the evidence and impact.
Deliver actionable findings
Give developers source locations, verification reasoning and suggested fixes in a report they can work through.
Inside the dashboard
The current review state stays visible.
Filter findings by severity and validation status, inspect the evidence behind each issue and keep the review state in one place.
See the setup path
How the review works
Each stage has a specific job, from reading the code to checking findings and preparing the report.
- 01
Understand
Map repositories, components, trust boundaries and security assumptions so later work starts with context.
- 02
Plan
Choose focused review work for each component rather than spending the same effort everywhere.
- 03
Hunt
Apply specialised security lenses and record candidates with evidence tied back to the source.
- 04
Challenge
Peer-review candidates, ask for missing information and separate plausible issues from weak ones.
- 05
Validate
Check impact, scope and evidence; normalise and deduplicate the findings that remain.
- 06
Explain
Add a plain-English description, detailed remediation and a report developers can work through.
- 07
Repeat
Schedule later passes, revisit assumptions and review changed code without discarding the project history.
Review the review
Findings are challenged before they are presented.
Candidate findings can be peer-reviewed, sent back for more information, validated by severity and deduplicated against overlapping work. Dokima records accepted and rejected runs so the schedule only advances on structured output that passes its checks.
The final report separates confidence from severity and keeps verification reasoning beside the issue. Developers can mark accepted risk, mitigation, false positives, duplicates or items needing human review without rewriting the original evidence.
Choose the right depth
Run the part of the review you need.
Understand the system and revisit its assumptions.
Plan and run focused searches for new security issues.
Clean up, validate, expand and report existing findings.
Run the complete lifecycle across due work.
Local control
CLI when you need it. Dashboard when you want the whole picture.
Open the terminal dashboard with dokima, run a single step, complete the next stage or let a full sweep progress through the workspace. The scheduler records its state in .dokima/ and produces a static HTML report you can open locally.
See what Dokima finds
Put an AI security reviewer to work on your codebase.
Start a full-product 21-day trial for your engineering team. No payment card required.