Opportunities › Affordable static code analysis for developers › Proposed app
Unhush
Static analysis that also finds the warnings your team silenced
- Score
- 54
- confidence 40
- Evidence
- 3
- items on the page
- Rivals
- 3
- named in sources
- First version
- 45 d
- estimate
- Type
- Desktop app
- PWA: runs in the browser, installs on Mac and Windows
- Market since
- 2001
- Mature market · AI estimate
ScreensConcept
Desktop app: Engineering teams use this for codebase security review and audit workflows that involve dense dashboards, detailed suppression ledgers, and pull request checks—work done from a desk with keyboard. Sample screens on a computer, in the proposed brand. Their numbers are sample data.
Overview
Last scan 6 min ago31 hidden
About this appAI proposal
Unhush scans your repositories for security vulnerabilities and shows the ones hidden by ignore comments and suppression directives, next to the new ones. Every silenced warning gets an owner, a reason and a review date, so it is either fixed or knowingly accepted.
It is meant for engineering managers and development teams who cannot get budget for enterprise analyzers such as Coverity or Fortify, and who have been working around that gap with suppress comments or lightweight tools. Pricing is set to fit a team budget, not a procurement cycle.
Unhush does not claim to match an enterprise analyzer's depth on day one. It aims to make the problem visible and manageable: what is flagged, what was silenced, who decided that, and what changed since the last scan.
- Tagline
- Stop hiding known vulnerabilities. Fix them or own them.
- Voice
- DirectCalmPractical
- Why this name
- Hush is what a suppress comment does to a warning. Unhush brings those silenced warnings back into view. It is short and easy to say.
In the first version
Members say which features they would use. It tells PWAS what people want; it changes no score.
Suppressed-issue detection
Finds findings hidden by ignore comments and directives and reports them as if the directive were not there.
No member yet
Suppression ledger
Each silenced warning needs an owner, a reason and an expiry date. Expired ones come back as open findings.
No member yet
Pull request checks
Scans changed code on each pull request and comments on new findings. Adding a suppress comment is flagged too.
No member yet
Manager overview
One page shows open, fixed and silenced findings per repository and team, with the trend over time.
No member yet
Brand identityAI proposal
Check the name against trademark registers before using it.
Palette
#B3402ASignal Rust · primary#F7F3ECPaper · surface#1E2328Ink · text#1F6F6BDeep Teal · accent, fixed status#E2A93BAmber · data, warnings
Typography
Aa
Unhush
ABCDEFGHIJKLMNOPQRSTUVWXYZ 0123456789
Stop hiding known vulnerabilities. Fix them or own them.
PricingAI proposal
The material gives no competitor prices, only that Coverity and Fortify are too expensive for some organizations. Paid prices are left open to test against team budgets, by team size, codebase size or scan frequency.
Starter
Free
- 1 repository
- Weekly scans
- Suppression ledger
Team
Contact us
- Price to test, per team size
- Unlimited repositories
- Pull request checks
- Shareable report links
Org
Contact us
- Price to test, per developer
- Manager overview across teams
- Import from other scanners
- Priority support
What it could be worthEstimate
What a software business making this much sells for today, from real deals. Pick a monthly revenue.
If it makes
Worth about
$190,000
Sale range $132,000 to $263,000
$120,000 a year in revenue
From 87 software businesses listed and sold on Empire Flippers in the last year, revenue vetted by the broker: they sell for about 19× their monthly revenue, most between 13× and 26×.
Measured on profit, the middle deal is 32× monthly net profit: about 2.7 years of profit.
An estimate, not an offer or financial advice. A real price depends on profit, growth, churn, how much of the work is the owner's, and the buyer.
How it would growAI proposal
How the product would reach new customers through its own use, and how the first ones would be found. A plan to test, not a result.
- Built-in loop
- Shared outputs. Pull request comments and read-only report links reach reviewers, auditors and managers who do not have accounts. Each carries the Unhush name and a view of the findings and silenced issues.
- Do they become customers?
- Developers who see a pull request comment can become users, but a one-time viewer may not. Test how many report and PR viewers sign up and whether any of them hold a budget.
- First customers
- Engineering managers of 10 to 50 developer teams in C and C++ shops, where an enterprise analyzer was rejected on cost and ignore directives are already in the code.
- Where to reach them
- Hacker News and developer forums: Post a scan of public open source repositories showing how many findings are hidden by ignore comments, and invite readers to try it.
- Direct outreach on LinkedIn: Message engineering managers who posted about security tooling budgets and offer a free scan of one repository.
- First milestone
- Five teams in one vertical each pay for a plan after a free scan of their repository, with at least one reporting a fix to a previously silenced issue.
Why people already pay for this
- Public claimCoverity and Fortify are prohibitively expensive for many organizations
- Public claimOrganizations attempt workarounds instead of paying for proper analysis tools
- Public claimKnown vulnerabilities are suppressed and left unaddressed in codebases
Tech stack
Every proposal builds on the same PWA base, installable from the browser on any phone or computer. Dashed boxes are what this app adds.
- AppNext.js and TypeScript
- PWAManifest and service worker
- UITailwind CSS
- Data and authSupabase Postgres
- PaymentsStripe
- EmailResend
- HostingVercel
- This app · Analysis engineSandboxed scan workers running open rule setsScanning source code needs isolated, time-limited jobs with language parsers, which the shared stack does not provide.
- This app · Job queueManaged queue for scan jobsScans run for minutes and must retry, so they cannot run inside web requests.
RisksAI inference
- TechnicalDetection depth: a small team's engine may find far fewer real issues than enterprise analyzers, and false positives could make teams suppress findings again.
- CommercialBuyers may accept free or lightweight scanners as good enough. The material only shows complaints, so willingness to pay at a lower price is unproven.
- DataCustomers must trust a new vendor with source code access. Security reviews or demands for on-premise scanning could slow sales.
- PlatformDepends on GitHub and GitLab app permissions and rate limits, and on their review processes for listings.
- Intellectual propertyOpen rule sets carry licenses that may restrict commercial use. Each one needs checking before it is bundled.
Everything marked AI proposal or AI inference was written by a model from the evidence on the opportunity page. The proposed name must be checked against trademark registers before it is used.