Approach
Most scanners flag patterns. Deton proves exploits.
Traditional static analysis matches code shapes against known-bad patterns and hands you a pile of maybes. Deton runs each candidate through a sandboxed proof contract and only calls something a finding once a deterministic oracle confirms it.
| Dimension | Pattern-matching scanners | Deton |
|---|---|---|
| Detection | Flags any code shape that resembles a known-vulnerable pattern | Same candidate detection, but nothing is reported until it clears a sandboxed proof contract |
| Output | A backlog of possible matches that still need manual triage to confirm | Confirmed, not-proven, inconclusive, and stale states — labeled honestly, no guessing |
| False positives | Common — pattern matches don't account for runtime context | Reduced by design — a candidate without oracle evidence is never called a finding |
| Evidence | Rule ID and code location | Evidence packet: proof contract, oracle observation, redaction policy, and PR action |
| Review time | Every result needs a human to confirm exploitability | Only confirmed findings need review — unproven candidates stay out of your queue |
This page describes Deton's own proof-gate mechanism against the general category of pattern-matching static analysis. It does not name or benchmark a specific competing product.
See pricing