Skip to content
Alpha

Catch unintended access changes in your PRs, pipelines, releases, terminal, code reviews, agent workflows, local development and CLI.

Better to meet us in code review than in a post-mortem.Counterbranch runs in your existing workflows to compare authorization behavior. Runs across custom authorization logic, OPA, Cedar, and OpenFGA.

See how it works

Know what changed about access.

Run the same access checks before and after a change. See who gained or lost access, what the app returned, and which checks completed.

  • Compare both versions.

    Test the same user, action, and resource against the current and proposed revisions. See changes like denied → allowed.

    A code diff shows what was edited; this shows whether access changed.

    viewer → read private-document
main      DENY
pr-142    ALLOW    changed

  • Check what the app returns.

    For a prepared app setup, send requests as test users to isolated versions and inspect each response. Counterbranch can also compare decisions from supported policy engines.

    A rule may look correct while an endpoint still returns data it shouldn’t.

    GET /documents/42  as viewer
main      403 Forbidden
pr-142    200 OK   body returned

  • See the evidence and the gaps.

    The report shows the expected result, what each version did, and any check that could not finish. Rerun the same prepared checks after a fix without an AI call.

    Developers can verify the result, and an incomplete test won’t look like a pass.

    checks       128
unchanged    126
changed        1   DENY → ALLOW
incomplete     1   timed out: export-report

Tested on 10,000 open-source repos.

For the alpha we ran discovery, the scan that finds where code decides who can do what, across more than 10,000 public repositories. No model calls, and no setup for any of them.

  • access decisions found · about half
  • none found

Each square is one repository, 10,000 in all. The shares are measured; where each square sits is illustrative.

  • 200,000+ access decisions mapped. No model tokens.

    A mapped decision is a place to look, not a problem found.

  • Covers custom auth, OPA, Cedar and OpenFGA.

    Discovery finds access checks written in application code, and OPA, Cedar and OpenFGA policies with the calls that enforce them. It shows where they are, not whether they are right.

Soft launch the week of September 28.

We’re getting ready to open the private alpha. Installs open when it does.