Security checks for Solana programs, built for builders who ship with AI, not for security teams. Connect a repo and know what’s risky in minutes, not weeks.
Connecting is free. You pick which repositories Probus can read, and you can disconnect at any time.
The same tools you already use to write the code are the ones you use to secure it.
Ship your program with Claude Code, Cursor, or Nanocoder, however you already work. Probus doesn’t change how you build.
Run Probus against the repo. Findings come back ranked by severity and explained in plain English, not security jargon.
Paste the fix brief straight back into your AI coding tool. Or, if you’d rather not, Ava can fix it for you.
Ask a general-purpose AI to review a Solana program and it reasons from web and Ethereum patterns, because that’s most of what it’s seen. The failure modes here are structurally different.
Solana instructions execute against whatever accounts are passed in. There’s no session or auth token by default. If an instruction doesn’t explicitly require is_signer on the right account, anyone can call it as anyone.
A generic review checks for access control in the web sense, routes, roles, permissions. It won’t know this explicit check is the actual boundary here.
Reading data from an account without confirming your own program actually owns it means a lookalike account can be swapped in and trusted by mistake.
There’s no equivalent failure mode in most codebases a general model has trained on, so there’s nothing to pattern-match against.
Program Derived Addresses are computed from seeds. Change the seed structure in an upgrade without versioning it, and a future address can collide with one that already exists.
PDAs don’t exist outside Solana. A generic reviewer has no concept of a deterministic, seed-derived address to reason about at all.
The rule pack is built around findings like these because they’re the ones raw prompting reliably misses, not the ones any tool would catch.
Probus Verified means an Ava engineer has reviewed the automated findings and confirmed the ones that matter.
It’s the accessible middle layer between shipping with no checks at all and commissioning a full professional audit, not a replacement for one. For a program handling significant value ahead of a raise or mainnet launch, a dedicated audit firm remains the right call.
No automated tool, including this one, catches everything. A review reflects what was found in the code as it stood at one commit. If an issue surfaces later, that reflects the limits of a point-in-time review, not a guarantee that was made and broken — see our terms.
Connecting a repo is free. You pay when you want the review.
A full review of one program, and a re-scan once you’ve fixed things.
Connecting is free. The report is £15 for one repository, and includes a re-scan once you’ve fixed things.