Security vulnerabilities introduced in PRs often look harmless in a diff because the real risk only surfaces at runtime. LLM-based code review tools help but suffer from low precision, causing alert fatigue. ProjectDiscovery's Neo addresses this by combining diff analysis with actual runtime testing: it spins up isolated sandbox environments, authenticates against staging deployments, and makes real HTTP requests to confirm whether vulnerabilities are exploitable. It catches three classes of issues that static review misses — ORM/framework defaults leaking data, business logic gaps with valid inputs, and incomplete state transitions. Neo integrates into GitHub PR workflows, posts findings with full HTTP evidence, creates Linear issues for confirmed High/Critical findings, and retests after fixes merge. It also accumulates codebase knowledge across reviews, improving accuracy over time.
