Corgea
corgea.com
Actively hiring
Application Security
View 7 jobs
Follow
Overview
News
Technologies
Salaries
Products
People
Growth
Offices
Jobs
Financials
Funding and backers
Team
51-200
employees, estimated range
Hiring now
7
open roles
Backers
2
Y Combinator, Shorooq Partners
Momentum
15/100
in the news
Last sign of life
this month
a posting or a news item
The story so fareach stage dated by its source: the company's releases, the press, registers, filings
Apr 2, 2025
Launched Corgea Launches BLAST: Transforming Cybersecurity with AI-Driven Code Security Platform · PRNewswire
Jun 2023
Went through Y Combinator
2023
Founded
Tractionpublic signals, read monthly
Web presence
top 2%
of 133.2M domains by links, Common Crawl
Hacker News stories
5
best: 75 points
Backed byfrom the funds' portfolios and accelerator catalogs
Y Combinator 
Shorooq Partners Investors in similar startupsfunds that back the companies most like this one
Similar startupsby what they do, their industry and backers
Escape builds automated application programming interface security testing. Its scanner discovers shadow APIs and business logic flaws. The…
Secure AI-generated code before it ships. StackHawk enables coding agents to find, fix, and verify exploitable vulnerabilities…
Security that actually understands your codebase. Gecko finds business logic flaws and multi-step vulnerabilities that traditional SAST…
Semgrep is a software security company that develops static analysis tools for finding bugs and vulnerabilities in source code. Its…
Dam Secure prevents 20% of vulnerabilities, catches 40% more of what's already there, and ships PRs 32% faster. Security for AI-enabled…
Hacktron AI is a security company building a system that autonomously reviews code, finds vulnerabilities and writes exploits. Its small…
Overview
Corgea uses large language models to find and automatically fix security vulnerabilities in application code. Founded in 2023 in San Francisco, it focuses on business logic flaws that traditional static analysis tools miss. The product proposes patches as pull requests for developers to approve.
News
CVE-2026-94185: malicious .nvmrc values can make nvm read .npmrc, .aws/credentials, and other local files
A 21 September 2026 disclosure shows that nvm = 0.40.7 resolves alias names as filesystem paths under $NVM_DIR/alias without rejecting .. components. That lets an attacker-controlled .nvmrc or alias name escape the alias directory and disclose readable lo
Read more
Report
CISA moved three Linux kernel CVEs into KEV
CISA added CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 to KEV on 18 September 2026. The three Linux kernel flaws sit in kTLS, ebtables, and AF_ALG, and they matter to application-security teams because a malicious package, compromised CI job, or lo
Read more
Report
Weekly Briefing - 19-09-2026
Corgea's briefing for 16-19 September 2026 leads with google-protobuf's new unknown-group recursion DoS, then covers CrowdSec's final TanStack follow-up report and explains why the requested Aikido, Wiz, Socket, and Endor Labs scans did not produce a sepa
Read more
Report
CVE-2026-89418: google-protobuf lets unknown group fields recurse until Node.js crashes
Published on 17 September 2026, google-protobuf up to 4.0.2 can recurse indefinitely between its group-skipping reader paths when it sees deeply nested unknown group fields, letting a small protobuf payload crash Node.js services that use generated protob
Read more
Report
Changelog - September 17, 2026
This week's Corgea changelog makes the Agent easier to reach, adds a daily digest for agent learning recommendations, and expands Advanced Vulnerability Search.
Read more
Report
PhantomRaven on npm: transform-jsbi-to-bigint and sort-imports-es6-autofix hid credential theft behind URL dependencies
A 15 September 2026 incident report tied real PhantomRaven compromises to two npm packages that looked like developer tooling, then pulled the actual stealer from attacker infrastructure through URL-based dependencies and a preinstall hook.
Read more
Report
openaii, ollamaa, langgrap, and transfomers used .pth startup hooks to backdoor Python environments
Between 11 and 13 September 2026, multiple PyPI typosquats aimed at OpenAI, Ollama, LangGraph, and Hugging Face consumers used auto-executing .pth files, XOR-obfuscated payloads, and runtime-downloaded second stages to turn routine Python startup into hos
Read more
Report
Weekly Briefing - 13-09-2026
Corgea's briefing for 10-13 September 2026 leads with active JFrog Artifactory exploitation across three CVEs, then covers the quarantined python-fork PyPI package, and explains why the rest of the requested Aikido, Socket, and Endor Labs feed scan did no
Read more
Report
CVE-2026-82329, CVE-2026-42018, and CVE-2026-42016: active JFrog Artifactory exploitation turns package hubs into an admin foothold
September 2026 exploitation of three JFrog Artifactory flaws gives attackers two practical routes into self-hosted artifact hubs: a one-request admin-token minting path through CVE-2026-82329, and a two-step chain where CVE-2026-42018 leaks an internal an
Read more
Report
universal_file_viewer on pub.dev shipped XCSSET build hooks in retracted 0.1.5 and 0.1.6 releases
The Flutter package universal_file_viewer published two retracted pub.dev releases on 8 September 2026. Version 0.1.5 added an Android preBuild ProcessBuilder hook plus iOS and macOS PBXBuildRule downloaders that curl shell stagers from .ru infrastructure
Read more
Report
Show more news
Tech stack
Technologies named in job postings at Corgea over the last 12 months, by layer, with the share of postings for each.
Technologies in use
24
Postings analysed
7
Stack modernity
75/100
Languages
Go
JavaScript
Python
TypeScript
Cloud & platforms
AWS
Amazon CloudWatch
Azure
Datadog
Sign in to see how your skills match this stack
Sign In
Full Corgea tech stack
24 technologies · by team · pay by technology · changes · similar stacks
Salary insights
Compensation ranges based on this company's open jobs
Median
$180k
Typical range
$40k – $220k
Open positions
7
7
Jobs
Junior
28.6%
Middle
28.6%
Senior
42.9%
| Level | Jobs | Median | Typical range |
|---|---|---|---|
| Junior | 2 | $110k | $40k – $180k |
| Middle | 2 | $126k | $42k – $210k |
| Senior | 3 | $200k | $65k – $220k |
Highest paying role
Security Researcher
$220k
Normalized to USD per year
All salaries at Corgea
By role, level and city, against the market · 7 jobs with pay
Growth
Hiring Momentum
58/100
Growing
Open positions
7
0 opened / 0 closed in 30 days
ATS activity
Every ~4 hours
Today
Hiring Dynamics
+100%
Hiring Focus
The percentage next to each role is its share of the company's job openings over the last 90 days; the arrow shows the shift versus the previous period.
Backend
57% ▼
DevOps
29% ▼
Security
14% ▼
Activity Timeline
Added Linux to stack
Sep 2026
Added IAM to stack
Aug 2026
Added GitLab to stack
Aug 2026
Added GitHub to stack
Aug 2026
Added Amazon CloudWatch to stack
Aug 2026
+7 jobs in a week
Aug 2026
Offices
Where the company hires and what each office is for
Cities
1
Hiring now
1
Countries
1
Busiest office
San Francisco
San Francisco
United States
HQ
4 open roles 4 posted in 90 days 100% engineering 75% remote 50-200 est. staff $203k Avg Salary
hires for Backend, DevOps, Security
Jobs
$20k – $65k per year • Equity 0.1–2% • Remote (Jordan) • Full-Time • 6+ years exp
Prompt Engineering
Apply
$120k – $200k per year • Equity 0.5–2% • Remote (United States) • Full-Time • 6+ years exp • San Francisco
Prompt Engineering
Apply
$25k – $42k per year • Equity 0–0.2% • Remote (Jordan) • Full-Time • 3+ years exp
Python
Go
JavaScript
TypeScript
Bash
Terraform
GCP
GitHub Actions
Datadog
Prometheus
GitLab CI
Azure
CI/CD
AWS
Docker
Kubernetes
Grafana
Platform Engineering
Incident Management
IAM
Amazon CloudWatch
Linux
Cybersecurity
Least Privilege
Apply
$100k – $180k per year • Equity 0.2–2% • Remote (United States) • Full-Time • 1+ year exp • San Francisco
Prompt Engineering
Apply
$17k – $40k per year • Equity 0.1–2% • Remote (Jordan) • Full-Time • 1+ year exp
Prompt Engineering
Apply
$120k – $220k per year • Equity 0.2–0.8% • Hybrid • Full-Time • 6+ years exp • San Francisco
Python
Go
JavaScript
TypeScript
C++
Apply
$100k – $210k per year • Equity 0–0.5% • Remote (United States) • Full-Time • 3+ years exp • San Francisco
Python
Go
JavaScript
TypeScript
Bash
Terraform
GCP
GitHub Actions
Datadog
Prometheus
GitLab CI
Azure
CI/CD
AWS
Docker
Kubernetes
Grafana
Platform Engineering
Incident Management
IAM
Amazon CloudWatch
Linux
Cybersecurity
Least Privilege
Apply