- Several types of issues like injections, overflows, randomness, race conditions etc
- Cross-file taint. Karma Pro builds a project-wide dependency index across every file. When a taint source is defined in a different file than the sink you're looking at, across imports, requires, includes, the finding is marked Cross-file.
- Mobile rule sets for Android (Java) and iOS/Cocoa (Objective-C): WebView hardening, JavaScript bridges, TLS trust-manager and hostname-verifier bypasses, raw SQL, clipboard/pasteboard leakage, UserDefaults and Keychain misconfiguration, deprecated UIWebView, deep-link exposure, file-protection levels, location and contact access.
- Engines: Karma Pro tells you whether a finding was proven structurally over the parsed AST or matched as a Heuristic pattern.
- ML Training window to feed positive and negative samples and update the model.
- Model import & export so you can back up your classifier (model) or share it with anyone.
- ML Scan a probabilistic sweep across the project that surfaces candidate defects the fixed rules might miss. It's complementary to the deterministic scanner: probabilistic leads plus taint-verified findings.
- Syntax highlighting per language: keywords, strings, comments, identifiers.
- Clickable functions/methods: function/method name in your source is underlined and linked. Click and Karma Pro opens its same-file call graph and dataflow in the bottom pane.
- Definition popups for call sites and a right-click menu that adapts to whatever is under the pointer (the function or method needs to be defined within the project in order for it to popup).
- Control-flow flowcharts. Click any function/method and Karma Pro produces its flowchart, cyclomatic complexity, if/else branches, loops, as an interactive graph you can pan, zoom, drag nodes, and click to jump to the line.
- Follow the variable.Select and right-click an identifier and Karma Pro builds a variable-flow diagram: the enclosing function drawn as a flowchart with every statement that uses your variable highlighted. Pass that variable into a function defined in another file, a callee box appears showing only the lines where the mapped parameter is used, and then it expands recursively, hopping across files, following imports and requires. Blue "call" arrows leave the call, purple "return" arrows rejoin the caller. Click any node to open the exact line.
- The Backtrace Analyser. Right-click anywhere within the source code and choose the backtrace analyser. Paste a crash or stack trace, hit Analyse, and Karma Pro parses the frames into a clickable left-to-right call-stack diagram, resolved against your open project (unresolved frames are red). Click a frame, and you're at the source line.
- Class usage, data flow, call graphs. Karma Pro renders it as an animated graph, the class as the central node, every new ClassName(...) site below it. Data-flow analysis traces assignments, parameter taint, and inter-procedural calls within a file to show how untrusted input reaches a dangerous sink.
Karma Pro The Code Security Review tool
September 19, 2026Karma Pro is an open source security code review tool (source code here) that can assist code reviewers with a multitude of useful tools. Karma Pro is a macOS source-code security scanner (AST base and Heuristics) that statically analyses projects in multiple languages. It's backed by an ML classifier trained on real patches to catch subtle issues. Beyond scanning, it offers interactive call graphs and data-flow diagrams, a bug tracker, a private research wiki, notes, backups, and an AI assistant.
It supports 14 languages
Karma Pro supports: C, C++, Objective-C / Cocoa, Java, C#, Go, Kotlin, Ruby, Python, PHP, Javascript, Rust, Solidity, and Swift (note the Bayesian scanning supports any language as long as it has been trained with the relevant security patches). Each language gets tokenizers and AST parsers so the tool can recognise what a for loop is, what a class method is, and where a function starts and ends.
Open a folder and Karma Pro walks the tree, filters by language, and lets you jump around with file search and code search.
The security scanner traces taint
Karma Pro's scanner does inter-procedural taint tracking over ASTs, it also includes a heuristic engine:
ML classifier trained on patches
Scanners with fixed rules miss issues if they don't have the defined rules for them. Karma Pro's Bayesian vulnerability classifier implements the Karma method (an automated source-code defect identification technique): it's trained on software patches, to learn how often each token appears in buggy code versus safe code.
At scan time, every line is reduced to tokens, and the classifier computes the probability that a line is a defect. Lines that feel like bugs get a confidence score, and a per-file heatmap lets you see risk concentration.
Code navigation
Diagrams
The AI Assistant
Connect Karma Pro to OpenRouter, pick any model from the dropdown (Claude, GPT-4o, Gemini, Llama, DeepSeek, Mistral…), and ask questions about the currently open project, the project path rides along in the system prompt automatically. Right-click any line and choose (AI) How to fix it to get remediation guidance for whatever it was flagged. You can also use Ollama and connect to local models.
Notes and prompts
There's a Notes window to keep annotations on files, a prompt store with template management (add, edit, remove, import, export) for the AI assistant. Everything is indexed once, at load time, and shared across every feature.
The Bugs Tracker
Every finding can be added in the Security Bugs Tracker where you can manage all your findings.
Private Research Wiki
The Wiki tool opens a private research wiki shared across all projects. Write pages in a rich-text editor, hyperlink selected words instantly, and click any link to open the page, creating it if it doesn't exist yet.
Karma Pro works on macOS 12.0 (Monterey) and newer.
Note: You cannot exchange classifier models between Karma and Karma Pro