Most security scanners bury engineers in guesses. winfunc (YC S24) - born as Asterisk - takes a harder path: it runs the exploit in a sandbox first, and only tells you about vulnerabilities it can actually trigger.
Every engineer who has ever run a static security scanner knows the feeling. You point the tool at your codebase, hit go, and get back a wall of red - hundreds, sometimes thousands, of "potential vulnerabilities." Then comes the real work: opening each one, reading the code, and deciding whether it is a genuine hole or a false alarm. By industry estimates, roughly 95% of those alerts turn out to be noise. winfunc, the San Francisco company that went through Y Combinator's Summer 2024 batch under the name Asterisk, was built around a single stubborn question: what if the tool did that filtering itself, and only spoke up when it had proof?
The proof, in winfunc's case, is a working exploit. Rather than pattern-matching on suspicious-looking code and hoping, the platform spins up a sandbox, runs the target software, and attempts to actually attack it. If it can trigger the bug, it reports it - with an executable proof-of-concept attached. If it cannot, the finding never reaches your inbox. The company frames the whole product in one line on its homepage: "Find, triage, and patch codebase vulnerabilities in hours."
To understand why winfunc exists, it helps to see the gap it is attacking. Traditional SAST (static application security testing) tools optimize for recall - catch everything, flag anything that might be wrong. The cost is precision. Security engineers become human filters, and the real bugs hide in the pile.
Share of scanner output that is false-positive noise. winfunc reports only sandbox-verified findings. Figures are the company's stated claims, approximate.
Under the hood, winfunc reads code the way a careful auditor does. It uses tree-sitter queries and language servers to build a structural understanding of a codebase, then layers large-language-model reasoning on top to trace how data flows from a source (say, user input) to a sink (say, a database query). The novel part is what happens next.
That third step is the difference between "we think this might be exploitable" and "here is the payload that exploits it." It is also what lets winfunc claim near-zero false positives without hand-waving - a claim is only as good as the exploit behind it.
Pattern-based scanners are good at the classics - SQL injection, cross-site scripting, the vulnerabilities that leave a recognizable fingerprint. They are close to useless against business-logic bugs: a permission check that can be bypassed, a role that quietly grants too much, a financial transaction that can be replayed. Those flaws are not patterns; they are misunderstandings of intent. Catching them requires reading the code with context, which is exactly where winfunc places its bet.
Security startups tend to lead with claims. winfunc leads with a kill list. Its agent has found - and helped patch - real vulnerabilities in a roster of well-known projects. When your tool ships a merged fix to someone else's production codebase, the demo argues itself.
Selected projects where winfunc's agent surfaced vulnerabilities. The last entry is Anthropic's Model Context Protocol SDK.
winfunc was founded by Mufeed VH (CEO) and Vivek R (CTO). Mufeed's resume reads less like an enterprise-security executive and more like a competitive athlete: gold at the IndiaSkills national cyber-security championship, bronze at the BRICS Skills olympiad, and a spot representing India at the WorldSkills olympiad. He has personally reviewed and patched more than 300 CVEs in open-source software and worked bug-bounty programs for companies including Google, Mastercard, Okta, and Ford. Before winfunc, he built Devika, an open-source alternative to the AI software engineer Devin that gathered more than 18,000 stars on GitHub. Vivek came from distributed-systems engineering, previously at Chorus One.
winfunc has grown from a single scanning agent into a small platform. Alongside detection, verification, and AI-generated patches delivered as pull requests, it offers pull-request scanning that reviews every change before it reaches production, continuous dependency (software-composition) analysis, and a context-aware AI assistant for triage. The most distinctive addition is Dome - an attempt to express security policies as a type system, enforced at build time, backed by a runtime proxy and kernel sandboxing. It is a different philosophy from bolt-on scanning: make certain classes of insecurity fail to compile.
One quietly practical advantage: winfunc claims to support all major programming languages plus a long tail most tools ignore - Haskell, Elixir, Clojure, Lua, and niche languages down to Arc. The codebases nobody else can scan are often the ones running unaudited in production, which makes coverage a wedge as much as a feature.
winfunc lands in a crowded and fast-moving corner of security tooling. On one side sit incumbents like Snyk, Semgrep, Checkmarx, and GitHub's CodeQL - mature, pattern-based, and precise about known categories. On the other side is a new wave of AI security agents chasing the same idea winfunc is chasing. Its differentiation is narrow but sharp: findings backed by a running exploit, business-logic coverage, and continuous per-commit auditing rather than a twice-a-year pentest. The company is SOC 2 certified and keeps a public trust center.
The business model is straightforward B2B SaaS: sell continuous, verified security auditing to engineering and security teams as a replacement for - or complement to - noisy scanners and infrequent manual engagements. At the time of profiling the company was small (two employees on record) and had taken Y Combinator's standard deal. Whether winfunc becomes the default layer between commit and production, or one of several AI security agents that arrived at the same time, will come down to how well the exploit-first approach holds up as codebases get weirder. But the underlying idea - that a security tool should prove its claims rather than assert them - is the kind that tends to matter for a while.
Talks & demos: search "winfunc" or "Asterisk YC S24" on YouTube for the Y Combinator launch and product walkthroughs. No official channel confirmed at time of writing.