Frequently Asked Questions

A platform that measures whether your developers can review code — a colleague’s or an AI assistant’s — and lets you show their progress to your customers. Your developers take twenty-question assessments scored against the OWASP Top 10:2025; you get their level by vulnerability family, a recommended training level for each of them, and a shareable report that proves their engagement over time. We do not sell training: we measure.

CIOs, CISOs and lead developers who have to allocate a training budget or answer a vendor security questionnaire, and developers themselves, who use the whole platform free of charge to gauge their level. Company accounts require a professional email address.

Yes, up to ten developers, with no time limit and no credit card. The Free plan includes the core product: the whole question bank, in all four languages, expanded as the news develops, the dashboard, the CSV export and the shareable report. Admin and manager roles, teams and member removal are reserved for the Pro plan. Beyond ten developers, the Pro plan costs €40/month, billed yearly (€480/year excl. VAT), with no limit on developers. The Enterprise plan, for deployment on your own infrastructure, is quoted on request.

The OWASP Top 10:2025: access control, misconfiguration, software supply chain, cryptography, injection, insecure design, authentication, integrity, logging, and the handling of exceptional conditions. Questions across all ten families, spread over three levels, including code to review in JavaScript, Python, C#, Go, Java, PHP, SQL, TypeScript and YAML; the others cover the principles, mechanisms and design flaws you meet when reviewing. Each assessment draws twenty of them at random. What sets the bank apart is not its size but its movement: we keep watch on newly exploited flaws, changes to OWASP guidance and regulation, and whatever changes a development practice becomes a question in the next update of the bank. Every answer is explained.

No. Nothing connects to your code: no repository, no pipeline, no token. We assess your developers, not your applications.

Yes. Reviewing code is one single skill, whoever wrote it — a colleague or an AI assistant. We test the person who approves the code, not the tool that wrote it.

No. It reports your developers’ progress, family by family. It names neither your tools nor your repositories.

No: NakamaCyber does not issue certificates; it measures over time. Your developers regularly take code review assessments on the OWASP Top 10:2025, and the report shows their engagement, regularity and progress month after month: dated evidence that your customer or auditor opens without an account.

No. We assess, we recommend a training level per developer, and then we measure the gap. The choice of provider is yours: a judge who sells their own courses is no longer a judge.

It is the level immediately above the highest level the developer has already passed with a score of at least eighty per cent. A developer who has not yet reached that threshold at beginner stays recommended at beginner; one who has passed expert is flagged as having completed all levels. The rule is simple on purpose: it has to be explainable to the person concerned.

It is a read-only document you publish in one click from the Compliance tab and send to a customer, a prime contractor or a procurement department. It opens without an account, in the language of your choice, and shows your developers’ participation, their month-by-month regularity, their progress indexed to 100 over twelve months and the measured coverage of the ten OWASP families. It contains no personal data: no names, no email addresses, no individual results. Below five active participants, it automatically falls back to a reduced version. The link is revocable, expires after thirty, ninety or one hundred and eighty days, and its content is frozen at the moment of publication. A full example is available on the Sample report page.

See a sample report

No, and that is not its role. The shared report is deliberately anonymous because it is meant for a third party. For your internal audit, admins and managers export a twenty-three-column CSV file containing, developer by developer, the average score, the scores per level, the priority category, the date of the last assessment and the recommended training level. Two documents, two recipients.

No. NakamaCyber attests to no compliance and issues no accreditation. The report cites these texts to help you place what it contributes to a file — a dated record of regular assessments of your developers, which is what PCI-DSS expects every twelve months under requirement 6.2.2 — and it states, row by row, what it does not provide: the mandatory nature of the modules, coverage of all staff, or the named proof an auditor asks for.

A developer sees only their own results. A manager sees only the developers in their team. An admin sees the whole company and can promote admins, appoint managers and publish reports. The owner account does not take assessments: it is a management account. This separation is enforced server-side by the database access rules, not only by the interface, and it is re-verified at every deployment by a dedicated test suite. The interface and the questions are available in French, English, Spanish and Portuguese.

The application’s database (Firestore) is hosted on Google Cloud, in the European multi-region eur3, between Belgium and the Netherlands; sign-in accounts are managed by Firebase Authentication, whose location and transfers are described in our privacy policy. We neither sell your data nor pass it on; the same policy details how it is processed and by which processors. NakamaCyber is operated by Nakama, Sociedade por Quotas, Lda, a Portuguese company, and funded by its Pro and Enterprise subscriptions, not by advertising or by reselling data. The Free plan is our acquisition channel: we have no plans to withdraw it, but we do not write “free for life”, because nobody can write that honestly.