Skip to main content
Symbiotic Code is a security-first coding agent. In the default Balanced security mode (and in Strict), code it edits or creates is checked for security vulnerabilities before it finishes. To test its capabilities, you can try the following scenarios:

​
Implement a feature with guardrails

Guardrails ensure all code generated follows your company’s security standards and best practices.
  1. Connect your GitHub account in the Symbiotic Portal
  2. Create guardrails for one of your repositories
  3. Open a local clone of that repository in Symbiotic Code and ask it to implement a feature
On startup, Symbiotic Code fetches your organization guardrails and the repository guardrails matching the project’s git remote, then applies them while implementing.

​
Security scanning while coding

A deterministic scanner (securityscan) and an agentic OWASP Top 10 review (securitycheck) run while you code, providing feedback on your implementation.
Create a new project from scratch to see all security features in action:
  1. Ask the agent to create a simple project (e.g., a weather app, to-do list, or CRM)
  2. Run /generate-guardrails to generate project-level security guardrails from the code
  3. Ask for a new feature and watch security checks run during implementation
  4. See the final security scan validate the code. Findings in code the agent just wrote are fixed or surfaced to you depending on their severity

​
Audit an existing codebase

  • /scan-codebase [path] runs code and infrastructure scans, filters out false positives, and summarizes the true positives alongside an OWASP Top 10 audit.
  • /owasp-security-review [path|commit|branch|pr] runs a dedicated OWASP Top 10 reviewer subagent in the background.
See Security tools for details.