Cette page existe en français. Voir en français
Esta página está disponible en español. Ver en español
Esta página está disponível em português. Ver em português
Developers now review more than they write.
Prove your developers can review code. Know who reviews well, and who to train. Show your customers the progress.
Human code, AI assistant code: one skill. Short assessments on reviewing real code, an explanation on every answer, and a progress report your customers open without an account, with no personal data. Free for up to ten developers, in four languages.
- Ongoingquestion bank updates, following our security watch
- 4languages: questions, options, explanations
- 12months of shareable proof, no account needed
- 10developers on the Free plan, no credit card
What's new
What's new in the question bank
The latest batch of added or revised questions, and the risk families it covers.
Latest batch
- 20 questions added
OWASP Top 10:2025 families in this batch
- A01 Broken Access Control
- A02 Security Misconfiguration
- A03 Software Supply Chain Failures
- A04 Cryptographic Failures
- A05 Injection
- A06 Insecure Design
- A07 Authentication Failures
- A08 Software or Data Integrity Failures
- A09 Security Logging and Alerting Failures
- A10 Mishandling of Exceptional Conditions
Can you review this?
Four real questions, taken verbatim from the question bank. Three are code to review, the fourth a mechanism you apply when reviewing: in a real assessment, not everything is code. Here, each answer is checked on the spot; in the assessment itself, the explanations come with the results.
What stops you approving this display code?
Review the code below before you answer.
const name = new URLSearchParams(location.search).get('name');
document.getElementById('greet').innerHTML = 'Hello ' + name;What your developers, your managers and your customer see
An assessment developers are willing to take, indicators a CIO can act on, a document procurement can forward.
20 questions, 3 levels, real code
Each assessment draws 20 questions from the chosen level, never the same set. All ten families of the OWASP Top 10:2025, with code to review in JavaScript, Python, C#, Go, Java, PHP, SQL, TypeScript and YAML; the other questions cover the mechanisms you apply when you review. The bank is not frozen: it is updated regularly, following our watch on exploited flaws, changes to OWASP guidance and regulation. Every answer, right or wrong, is explained — that explanation is the only training we provide, and it is enough to move the score.
2 db.query(q);
Review level, family by family
Percentage score, grade from A+ to F, radar of the ten Top 10:2025 families, progress over time and daily streak. And, when the sample allows, where they stand among the other developers assessed.
Who can review, and who cannot yet
Owner, admins, managers — roles and teams come with the Pro plan: a manager sees only their own team. Headcount, average score, inactive for thirty days or more, recommended level per developer. And a dated CSV export, developer by developer, for your internal audit, included from the Free plan up.
Why CIOs and CISOs assess with NakamaCyber
A measurement, not a claim
Every question is tied to one of the ten families of the OWASP Top 10:2025. You replace “our teams review code carefully” with a score per family, comparable from one developer to the next and from one quarter to the next.
Who to train, at what level — and nothing else to sell you
A recommended level per developer — beginner, intermediate, expert — derived from the highest level passed at 80%. We sell no training: our only interest is that the measurement is accurate.
Proof for your customer, proof for your auditor
A revocable link, with no personal data, that your customer opens without an account — and a CSV export, names included, developer by developer, for your internal audit. Two documents, two audiences.
Free up to ten developers, no credit card
The Free plan includes the whole question bank, the dashboard, the CSV export and the shareable report. Admin and manager roles and teams come with the Pro plan. Beyond 10 developers: €40/month, billed yearly (€480/year excl. VAT).
Prove the ability to review, not attendance
Your competitors attach a policy and an attendance sheet. You send a measurement: engagement, regularity, progress over twelve months.
Your customer’s vendor questionnaire now carries a new line: how do you control code written by AI assistants? Your competitors answer with a policy and an attendance sheet. You answer with an address, which they open without an account and in their own language — French, English, Spanish or Portuguese: your developers’ participation, their month-by-month regularity, their progress indexed to 100 over the last twelve months, and the measured coverage of the ten families of the OWASP Top 10:2025. No personal data enters the calculation, and below five active participants the document switches to a reduced version.
- Answer a vendor questionnaire with a URL, not a hand-filled spreadsheet — and keep your dashboard’s export, names included, for your internal auditor.
- Progress indexed to 100 over twelve months: your customer sees an overall curve, never the score of any one of your developers.
- Measured coverage of the ten Top 10:2025 families — including those your team has not worked on — and an OWASP SAMM position. Nothing is published below five active developers.
- Revocable link, server-side expiry at 30, 90 or 180 days as you choose, content frozen at publication: you decide on sharing, never on what it says after the fact.
Cited in support of
- PCI-DSS 4.0 · 6.2.2
- DORA · art. 13(6)
- NIS2 · art. 21(2)(g)
- ISO 27001 · A.6.3 / 7.2
Your customer wants to verify that security is taken seriously at your company. This report gives them a dated record of your developers’ engagement in code review — exactly what PCI-DSS expects every twelve months, what DORA calls an ongoing programme and NIS2 regular training. If you are a supplier to a bank or to a NIS2 entity, Article 30(2)(i) of DORA and Article 21(3) of NIS2 are what prompt your customer to ask the question.
Code review progress report
Example Company
Rolling 12 months
OWASP Top 10 coverage
- A01 — Broken Access Control (reviewed)
- A02 — Security Misconfiguration (reviewed)
- A03 — Software Supply Chain Failures (not reviewed)
- A04 — Cryptographic Failures (reviewed)
- A05 — Injection (reviewed)
- A06 — Insecure Design (reviewed)
- A07 — Authentication Failures (reviewed)
- A08 — Software or Data Integrity Failures (lightly reviewed)
- A09 — Security Logging and Alerting Failures (reviewed)
- A10 — Mishandling of Exceptional Conditions (not reviewed)
Up and running in three steps
-
Create the company account
A professional email address, two minutes. The address is verified by email before the first login. No credit card, no mandatory demo.
-
Invite your developers
One link for the whole company, or one link per manager to build the teams. The developer creates an account, lands in the right team and takes a first assessment within ten minutes.
-
Measure, prescribe, prove
Scores by OWASP family, recommended level, inactive developers flagged, an export for your auditor. And, the day a customer asks you for evidence, a shareable report generated in one click.
Simple, public pricing
Free for individual developers and for companies up to ten developers. Beyond that, a published price.
Free
The core product, up to ten developers
- The whole question bank, three levels, four languages
- Company account and dashboard
- CSV export and shareable report
- Up to 10 developers — unlimited individual developers
Pro
Beyond ten developers
Billed yearly: €480 excl. VAT
- Everything in Free, with no headcount limit
- Admin and manager roles, teams, member removal
- Invoice in your company’s name, VAT handled
- Reply within one business day, in four languages
Enterprise
Your instance, your rules
- Deployment on your own Google Cloud project or on-premise
- SSO, question set and branding specified in the contract
- Your data stays with you
- Negotiated contract, DPA and service commitments
Pro is paid online by card (Stripe): invoice in your company’s name, cancellable at the end of the period. Enterprise is contracted through the form.
Next step · in preparation
Real-world measurement
NakamaCyber already measures how your developers review code, whether it was written by a colleague or by an AI assistant. The next step: measuring that review where it actually happens, in your team’s review workflow.
-
Pull requests with planted flaws
Built from code actually generated by AI assistants, with known security flaws hidden inside.
-
In your usual review workflow
They arrive among the team’s other pull requests and are reviewed as usual, with nothing staged.
-
A team result, never an individual one
We count the flaws the team catches, grouped by weakness class using the public CWE catalogue. The result is about the team, not about individuals.
Three measurements to track progress
- T0 Starting point
- T1 Three months later
- T2 Six months later
At each measurement, the share of flaws caught, class by class.
This offer is not available yet. Leave your address and we will write to you when it opens.
Join the waitlist
You’re on the list.
We will write to you when the offer opens.
A developer with no company to assess?
The whole platform is free for individual developers: the three levels, the whole question bank, your scores by OWASP family, your radar, your history and your daily streak — and, when the sample allows, where you stand among the other developers assessed. Enough to prepare for an AppSec interview, or simply to know your level.
Ready to measure — and to prove it?
Account created in two minutes, free up to ten developers, no credit card. Your first shareable report after a few weeks of assessments.