Nika

Open-source secure code scanner from PhonePe that combines cross-file, inter-procedural taint analysis with rule-based detection to trace attacker-controlled input across controllers, DTOs and service layers to security-sensitive sinks. Covers eleven vulnerability classes including SQL injection, SSRF, path traversal, command injection, deserialization and XXE, with optional AI-assisted false-positive reduction. Runs via Docker or local build.