About Magdox
Magdox builds security products for software and connected devices. We focus on the path from a technical finding to an engineering decision: understanding the affected code or component, choosing an action and verifying the next release.
The problem we work on
An engineer needs to know where an issue occurs and how to investigate it. A security owner needs to know which application or product is affected. A release owner needs a current decision and enough context to understand what remains unresolved.
Those questions become harder when source code spans many repositories or a firmware image includes components maintained by several suppliers. A useful product connects the evidence to the actual workflow, keeps missing coverage visible and preserves the reason behind a decision.
We built two products because source analysis and firmware assessment have different inputs and operating requirements. They share a company and an approach to review, while keeping their application workflows and data boundaries explicit.
Two focused products
Local analysis for supported source, dependencies, secrets and configuration. Optional uploads let teams collaborate on findings and recognised inventories; application risk and governance help organise work across the participating repositories.
Explore Code SecurityFirmware analysis and release intelligence. Inspect recovered components, candidate vulnerabilities and supported runtime evidence, compare releases and prepare inventories and assessment records for the people reviewing the device.
Explore FDIE01 / Developer machine or CI
The licensed CLI runs analysis locally with verified rules and advisory data.
02 / Metadata by default
Explicitly send findings and requested inventories. Source snippets require permission.
03 / Code Security console
Review findings, group repositories and follow remediation across applications.
Workflow illustration. Local-only results remain outside the console until uploaded. Authentication and component updates have separate network paths.
How that shapes the products
Connect a result to the affected location or component and its available explanation. The reviewer should be able to investigate the basis of the result.
Skipped, failed, unsupported and unassessed work matters to the decision. A summary should not hide the scope that produced it.
Retain a reviewer's reason and reconsider it when the relevant evidence changes. Reuse investigation without silently assuming that the old conclusion still applies.
Local source analysis, optional metadata uploads, matched snippets and firmware processing have different data paths. State them in the product and deployment guidance.
Support the findings and inventory formats engineers, customers and assessors can use, with the scope of each output stated.
Describe supported methods and operating requirements without turning a technical check into a blanket detection or certification claim.
Working with Magdox
Code Security offers a 14-day self-service trial with a card. FDIE's first payment has a 14-day money-back guarantee for organisations that have analysed three or fewer new images. Use representative work and involve the engineers who can assess the results. Review the appropriate product plan for access, resources and cancellation.
For Enterprise, discuss the expected users, repository or image types, hosting requirements, offline operation and procurement process. Agree deployment responsibilities, licence provisioning and contractual commitments before the rollout.
The security and legal centre brings together the product data boundaries, provider register, customer agreements and disclosure programme. Questions about the company or either product can come to the same Magdox team.