Clear the noise
- Starts with
- Incoming security email
- You get
- A focused report queue
Junk stays separate. Possible duplicates are grouped for review.
Prepared automatically in the appSecurity report triage · For lean engineering teams
Less security report noise.
A clearer path to fixing.
filtro.dev turns vulnerability reports from your security inbox into engineering briefs with code evidence and suggested fixes. Give your team a clear starting point before they take over.
- Read-only GitHub access
- You host the Agent
- Data handling documented →
No card required. You provide an Agent host and a model-service account.
After signup Create your workspace, connect your Agent, then get your reporting address. See the setup steps →
Likely a vulnerability
GET /v1/invoices/export returns another account's invoices
An authenticated customer with invoices:read can request another account's invoices through the export endpoint.
Suggested fix
Check that the caller can access the requested account before exporting its invoices.
northwind/billing-api · revision 9f31c7ad4b6e
internal/http/invoices.goLines 7–18 · inspected reference
internal/http/middleware.goLines 10–36 · inspected reference
1 claim considered · 5 references · Human review pending. Runtime behavior unverified. Read the investigation →
A smaller work queueJunk stays separate. Background work stays visible without crowding your decisions.
A useful next stepAn explanation, inspected code references and a fix suggestion your engineer can review.
Progress you can seeSee handled reports, work in progress and an estimate of investigation time saved.
The product, at a glance
What is filtro.dev?
filtro.dev is a security report triage and investigation tool for lean security and engineering teams. It separates inbox noise, checks report claims against your GitHub code and prepares an engineering brief with evidence and suggested fixes. You review the findings, decide what needs action and keep researcher replies and remediation in one workspace.
Product information reviewedIncoming reports
Stop treating every incoming email as another engineering task.
The inbox mixes real findings, missing information, repeated claims and messages that are not security reports. Making engineers sort every email is work before the work.
- Repeated reports send engineers back through an issue they have already seen.
- Missing details create clarification loops before an investigation can begin.
- Severity without evidence leaves engineers doing the research needed to choose a fix.
filtro.dev prepares the next step so your team can spend its attention on the decision.
Workflow
From incoming email to an engineering next step.
Fill the gaps
- Starts with
- A report missing key details
- You get
- A clarification draft
Ask for the affected application, reproduction steps or impact in the existing conversation.
You review and send the requestPlan the fix
- Starts with
- The report and authorized code
- You get
- An engineering brief
Review the evidence, remaining gaps and a suggested fix when the code supports one.
Your Agent investigates; engineers reviewFollow through
- Starts with
- The brief and your decision
- You get
- A reply and remediation history
Keep researcher updates, risk decisions and fix references with the report.
Your team approves replies and records progressTry it with a report your team knows.
14 days free, no card required. Bring read-only GitHub access, an Agent host and a model account.
Investigation
Give engineers a path to fixing.
Understand what happens, who can trigger it and what limits the impact. Get a suggested change grounded in the code reviewed, rather than a severity label and a vague instruction to investigate.
Suggestions are for your engineer to review. filtro.dev does not apply a patch or reproduce the exploit; gaps and deployment assumptions remain visible.
What your engineer receives
- Know what the evidence supports
- See the code behavior established and the assumptions still open.
- Choose a change with context
- Review a suggested fix and how to check it, when the evidence supports a change.
- Start at the relevant code
- Follow file locations and revision IDs back to the source reviewed.
Setup
Run the Agent on infrastructure you control.
- Start your workspace. Sign in and create a workspace for your team. Your 14-day free trial starts when it is created; no card is required.
- Connect your Agent. The Agent is the software you run to inspect repositories. Download it for Linux, macOS or Windows, then follow the guided setup to register it.
- Give it the access it needs. Configure read-only GitHub access and your model-service account. Your Agent runs on infrastructure you control; your model provider processes the source it reads.
- Start receiving reports. Once your Agent is connected and model access is working, copy your reporting address from Home. Forward your security mailbox or send reports directly.
Working with your tools
From sorting emails to reviewing decisions.
Instead of handing your engineers an unsorted inbox, give them a queue of decisions with the investigation work attached.
| Work | Manual workflow | With filtro.dev |
|---|---|---|
| Sort the inbox | Read every message to find the reports worth reviewing. | Junk stays separate, incomplete reports can go to clarification and possible duplicates are brought together. |
| Investigate a claim | Find the relevant code and assemble an explanation for an engineer. | Review a brief with inspected source references, what the code supports and any remaining gaps. |
| Choose the next step | Move between email, investigation notes and remediation decisions. | Review a suggested fix when supported, reply to the researcher and track the decision in one workspace. |
The dashboard estimates 25 minutes saved per completed, decisive investigation: 30 minutes of manual investigation minus 5 minutes reviewing the brief. This is a fixed scenario estimate, not measured time or a promised saving. Failed, unresolved, junk and duplicate reports are excluded.
Data boundaries
Your Agent reads the repository.
Your Agent sends the source it reads to your configured model provider. It returns findings and repository references to the hosted app. Source must not be included in those results.
| Data | Processing |
|---|---|
| Repository source | Read by your Agent and processed through the model service you configure. |
| Report and conversation | Stored by filtro.dev and screened before an investigation is queued. |
| Investigation narrative and references | Returned to filtro.dev and processed into the automated assessment. |
Read about access, data handling and protection limits.
Pricing
One workspace.
Your whole team.
$99 USD/month.
Start with 14 days free, with no card required. After that, one subscription covers your team’s report workflow; model usage and Agent hosting cost extra.
- Junk filtering, clarification and duplicate review
- Source-backed engineering briefs and fix suggestions
- Researcher conversations and reviewed replies
- Risk decisions, deadlines and remediation tracking
- Activity history, PDF exports and estimated time saved
- Team roles without per-seat pricing
filtro.dev workspace
$99USD
per month
per month
- Trial
- 14 days · no card required
- Team
- No per-seat pricing
- Investigations
- Not billed per investigation. Each run has resource limits and uses your model quota.
- Cancellation
- Billing portal in the app
You also pay for
- Model usage. You bring the provider account and pay them at their rate.
- Hosting for the Agent on infrastructure you manage.
Report intake and researcher replies are included; you do not configure an email provider account.
What you control
Choose your model provider and model, and the infrastructure running your Agent. Model charges vary with the provider and work performed; each investigation has resource limits. Check your provider’s budget options before running reports.
Questions
What to know before you start.
Where does my code go?
Your Agent reads authorized GitHub repositories and sends the source it inspects to the model service you configure. Findings and repository references return to filtro.dev; results must exclude source. The security page explains these boundaries and the limits of the current protections.
Read the data handling details →Will filtro.dev automatically reject a researcher?
Researcher emails require your approval. Supported automatic dismissals remain reviewable and reversible; negative conclusions require inspected evidence and independent review. Missing evidence is not proof that a report is invalid.
See how report decisions work →Does filtro.dev reproduce the exploit or apply a fix?
No. Your Agent reads repository code; it does not run your application, replay the researcher's proof of concept or apply a patch. Engineers review fix suggestions and validate deployment behavior separately.
See an illustrative investigation →Who makes the final decision?
Your team reviews the automated findings and records the human decision. Technical validity, risk severity and remediation remain separate, so a code finding does not silently become a high-risk incident.
Read the review guide →What happens if an investigation cannot finish?
Unfinished work stays visible. An unavailable Agent or model service is shown as an operational problem, separate from a missing-evidence decision. Your team can resolve the problem and retry; unfinished work does not count toward estimated time saved.
What do I need to get started?
An existing security inbox, GitHub repositories, someone able to run the Agent and a model-service account. After sign-in, create your workspace and follow guided setup to connect the Agent and get your reporting address.
See the setup steps →What is the total cost, and how do I cancel?
New workspaces include a 14-day free trial with no card required. After the trial, one workspace costs $99 USD per month with no per-seat pricing. Model usage and Agent hosting are separate variable costs. Report intake and researcher replies are included. Investigations are not metered by the subscription; each run has resource limits and uses your model quota. Cancel through the billing portal in the app.
See what the plan includes →How do I request deletion?
To request access, correction, deletion or retention information, email [email protected]. Individual reports cannot be deleted through the app.
Read the privacy information →Start with a report
Give your engineers
a better starting point.
Try it with reports your team knows. See the evidence, the suggested fix and the difference in your review workflow. 14 days free, no card required.
Start 14-day free trial