InsurStaq AI launches local macOS code-security tool

InsurStaq AI has launched a macOS application for local code-security auditing on Apple silicon Macs. It is aimed at developers, engineering teams and security consultants who need to review repositories without moving source code off their machines.

The London-registered company says the application analyses repositories that users own or are authorised to assess, combining repository mapping, security checks, attack-path analysis and AI-based reasoning in a single local workflow.

Its approach centres on keeping code on-device during repository parsing, indexing, scanning, AI reasoning and reporting. The software is intended for situations where code confidentiality limits the use of tools that send source material to external servers, particularly when consultants are working with client repositories.

"Most security tools want your source code on their servers, and a lot of teams can't send it," said Yaman Khetan, Founder, InsurStaq AI.

The software starts by identifying a repository's languages, frameworks and application structure. It then maps routes, input sources, database interactions and authentication controls, allowing users to examine individual findings in the context of the surrounding code.

The workflow is designed to help reviewers assess how external input may reach sensitive operations, rather than treating every alert in isolation. Security checks cover potentially unsafe input handling, missing authentication or authorisation checks, exposed secrets, vulnerable dependencies and infrastructure configuration.

Dependency analysis also supports a software component inventory. These outputs are intended as starting points for investigation, with reviewers still responsible for assessing intended behaviour, deployment assumptions and the practical impact of any finding.

Local review

The local AI component works from evidence gathered from the repository and the application's analysis results. InsurStaq says this is intended to help users explain findings and consider proposed changes while retaining code references that can be checked against the original source.

Users can review a proposed change before applying it and then rescan the affected code. This follow-up step is intended to show whether the original issue is still detected and whether the change creates additional findings, without guaranteeing that an application is free of vulnerabilities.

The networking model is another part of the product's pitch. The company says a network gateway records permitted requests, while an Air-Gapped Mode blocks outbound networking, allowing users to separate the handling of assessment data from the task of receiving software, rule or vulnerability-database updates.

"So everything runs on your Mac," said Khetan.

Compliance mapping

Alongside code review, the application maps technical evidence to selected requirements and controls linked to SOC 2, ISO 27001, PCI DSS and OWASP ASVS. The resulting output is positioned as readiness evidence rather than certification, because organisational processes, staff practices and other controls outside source code still require separate evidence and human assessment.

The product also generates both technical and executive reports from the same assessment. This allows an engineering reviewer and a business stakeholder to receive different levels of detail without running separate processes.

InsurStaq says the product is designed to support security review rather than replace a human penetration test or independent audit. It adds that findings and AI-generated explanations still need validation, and that analysis coverage depends on the repository and framework under review.

Pricing and structure

Published monthly pricing starts at USD $19 for Solo and USD $39 for Pro. The company also offers Team, Partner and Enterprise options for broader organisational use.

InsurStaq AI is a product of KarmSakha, which is registered in England and Wales. Khetan is based in India.