VerifyYourCode Reviews

First let me be clear - I've talked with folks at this company and I think they are true believers in their product. That's important and positive.

But it isn't enough.

I opted for the "upgraded" version of this LTD to get access to the "enterprise" features (really the ones you probably want).

I didn't think the 100,000 lines of code limit would be an issue but it's amazing how quickly a project blasts way past that number. So then the costs skyrocket as the total codebase you are examining increases. Just a few projects and you can be well north of the limit by several factors.

Which in and of itself might not be a problem if the system delivers true value.

For me, it didn't.

First the user interface is muddy. There are clearly issues in its rendering engine. So parts of the screens are malformed. From a company that is "inspecting" code I would expect better in their own project.

But beyond that the real issue is that this system is very rigid in its approach. In my case it has done nothing but flag false positives. That's an incredible waste of time. Basically it has its own opinion about what "best practices" look like. Your code may follow different "best practices" that are as good (or better) but the evaluation engine has no apparent option to be "trained" so you are stuck constantly getting called out for "high" security risks that are, in fact, nothing more than a different way of implementing security. It's a real problem.

Worse, once items are tagged as false positive - nothing in the scoring engine "improves". This is an issue because if you want to use their badges and you've "cleared" all the false positives - your score doesn't reflect the cleared status so your badge shows the pre-fix scores. I'm not going to put a badge on my project saying I have security holes when I actually don't.

Another annoyance is that if your codebase changes and something you've previously flagged as a false positive moves from say line 800 to line 1050 - the system sees that as a "new" issue. It isn't. It just moved. But the system doesn't appear to track things very intelligently.

Which is really my problem about this tool...

Yes the "other" reports seem cool at first blush. But really what I care about is a system that accurately helps me enforce good secure coding in a way that is affordable, consistent, and reliable.

For my purposes this tool simply misses the mark.

Why 2 tacos:
* Expensive upsell (even at 50% off) once you get past the 100,000 line limit which is very easy to do across just 2 or 3 projects.
* Way too many false-positives relative to "findings".
* No way to tune the engine and it doesn't seem to learn from false-positives.
* Doesn't adjust score once false-positives are identified making the scoring and the badges they offer useless.
* Messy interface with some broken bits.

This is exactly the misleading part: you do not clearly state that the 100,000-line limit applies only to one project and not to the entire account. The offer is presented as “Unlimited code verifications per month,” which makes it sound like there is no real restriction on usage. If the limit is only for a single project, that should be stated very clearly in the main offer, not hidden in the FAQ or support replies. As written, the listing gives the wrong impression and is misleading to buyers.

Misleading “Lifetime Access” Offer

This offer is very misleading. It claims “lifetime access” and “unlimited code verifications,” but there is actually a hard limit of 100,000 lines of code.

Once that limit is reached, the service effectively becomes unusable. There is no clear way to reset or remove the limit, and no practical lifetime access after the quota is consumed.

Calling this “lifetime” while restricting the total amount of code that can ever be checked is deceptive. Buyers should be clearly informed that the 100,000-line limit is permanent and cannot be reset.
Why
Currently users with restricted access are limited to 5 chat messages with me each week. Please wait and try again...

Great solution for people building AI-powered applications. I already have access to a similar platform, so I thought my code was in good shape - but VerifyYourCode still discovered two new vulnerabilities.

If you've built a large application, you might want to consider increasing the Tier 2 limit. My SaaS, for example, has around 106,000 lines of code.

I'm very happy with the app, and its fairly easy to use. I especially love the PDF reports. I had some difficulty initially but I was able to get a 1 on 1 troubleshoot and walkthrough, now it's all sorted. I highly recommend getting this if you have to do any type of code reviews or fixes and especially if you are vibe coding.

It's been really useful, and it gets you an holistic view about the status of your code. And the support has been really fast and proactive to find any issue found.