Continuous web and API security scanning for teams that don't have an enterprise budget - with findings a developer will actually act on, and a pull request that fixes them.
Role
Product · UX/UI · Full-stack
Type
B2B SaaS · DevSecOps
Stack
Next.js · NestJS · FastAPI
Scope
3 services, one monorepo
What it is
Most development teams can't tell you what's exposed to the internet. The application-security tools that answer that question are built for enterprises - expensive, heavy, and they produce reports nobody reads.
CyRook closes that gap. It gives SMBs, startups and agencies practical security visibility on web and API, without an enterprise procurement cycle.
The problem
No visibility - Nobody can say what's actually exposed: headers, TLS, endpoints
Blind APIs - No clear security picture for the API surface
Unusable reports - Hard to read, harder to act on
One-off scans - Instead of continuous monitoring and regression detection
The solution
Continuous scanning - Web, API and repository
Structured findings - Severity, evidence and remediation
Auto-Fix - Opens a PR with a stack-aware patch
Inside the workflow - GitHub, Jira and Slack
Brand
The name joins cyber and rook - the chess piece that guards the corners of the board - and the mark is the rook itself: a single solid tower, crenellated top, stepped base, white with a violet glow. In the wordmark Cy is regular and Rook is black, so the guard is what you read first.
Symbol and logotype, in black, in white and in colour. On the dark UI, the rook carries a violet glow.
Violet#9463E9 The brand, primary actions
Violet light#A379EC Focus rings, links
Navy#080C16 The ground
Card#151C29 Panels
Alert#DC2828 Critical findings only
Severity colours are kept for findings; the brand stays violet on navy.
CyRookInter BlackThe wordmark
Aa 123InterThe interface and docs
CVE-2026InterFindings, code and paths
One family at every weight - a security tool should look consistent before it says anything.
The product on a laptop, a tablet and a phone - real screens from the live product
A cast rook for the deskTeam tee
How it's built
Frontend
Next.js 14
TypeScript · Tailwind shadcn/ui · React Query
API
NestJS
PostgreSQL · Prisma Redis + BullMQ · WebSocket
Scanner
Python FastAPI
30+ OWASP modules SAST · Secrets · Dependencies
Distribution
CLI + Action
GitHub Action shared packages
The screens
Positioning
The headline answers the objection developers actually hold about security tooling - that it slows them down. Instead of leading with a feature list it promises speed: “Security that doesn't break your velocity.” The dark purple palette is deliberately the language of developer tools, not enterprise software.
Business model
A land-and-expand structure: Free on a single asset removes the entry barrier, and expansion is by assets, scans and AI credits. Starter carries the Most Popular badge to anchor the choice on the second tier rather than the cheapest - a design decision with a direct effect on ARPU.
The core workflow
This is what turns CyRook from a thing you check into a quality gate inside the pipeline. Deployments can be blocked on security posture. Every screen opens with a “What is…?” card - a pattern repeated throughout the product that makes security concepts legible to people who aren't security engineers.
Ecosystem
This is where the product becomes sticky. Once findings turn into Jira issues and Slack alerts, CyRook enters the daily workflow instead of remaining a dashboard someone opens monthly. Three integrations only - deliberate focus over a long catalogue.
Enterprise readiness
Abstract standards translated into a single percentage per framework - PCI-DSS, GDPR and SOC 2. Colour carries meaning: green and amber say immediately where attention is needed, and each score expands into the requirements and findings behind it. This is the screen that opens the door to mid-market.
The core loop
Scan → finding → fix. Every finding carries a severity, evidence and remediation guidance. Auto-Fix detects the stack - Next.js, Nginx, Express, NestJS - and opens a pull request ready for review. Empty states aren't left empty: they explain the concept and show the severity taxonomy.
Design decisions
01
Explain, don't assume - Every screen opens with a “What is…?” card. The audience is developers, not security engineers, so the product teaches while it's used.
02
Speed as the top-line message - The main objection to security tooling is that it slows you down. So the promise is velocity, and pricing starts free on one asset.
03
Close the loop - A product that only reports problems creates work. Auto-Fix and the integrations carry it from finding to merged PR.
04
Colour carries meaning - Purple is brand only. Red, amber and green are reserved for severity and status, so a screen can be scanned for urgency.
05
Empty states as opportunity - Empty screens explain the concept, show the severity taxonomy and offer the next action.
06
A deliberate monorepo - Web, API and scanner in one repo with shared packages - consistent types, and distribution as both a CLI and a GitHub Action.
