About Zelsis
Zelsis checks every pull request before it merges: logic bugs, performance, risky deploys, privacy gaps, accessibility, vulnerable dependencies and security. It was built because the mistakes that cost money or customers pass code review all the time, since each line looks reasonable on its own.
Who is behind it
Zelsis is built and run by Bedirhan Elibol at Zelsis Software Technologies in Istanbul, Türkiye. If you write to contact@zelsis.com, the person who builds the product reads it.
The code is public in BedirhanElibol/zelsis-saas, rules and benchmark included, so you can read what a finding is based on.
How the results are measured
We scan pinned open-source projects: apps that are vulnerable on purpose, to measure what we catch, and maintained production apps, to measure noise. The numbers are published as they come out, including the flaws we miss and the clean projects where a finding blocks the check. Anyone can rerun them. See the benchmark.
We also compared Zelsis with an AI reviewer on five pull requests with flaws written down in advance, and published every comment from both tools, including the case where the other tool did better. Read Zelsis vs CodeRabbit.
Only rules that have caught a documented flaw, or were reviewed as true positives, can fail the check. Everything else is reported as a warning. A check that cries wolf gets switched off, and then it protects nobody.
What happens to your code
Files are fetched into memory, scanned and released. We keep the findings and a short snippet around each one, and the snippets are erased after 90 days. Scans send no code to an AI model. The only exception is the optional AI double-check on paid plans, which is off by default. Details are in the privacy policy.
When we find a real bug in someone else’s project
We tell the maintainers privately first and give them 60 days. We only name a project once the bug is fixed or the maintainers agree. Until then we describe findings in general terms, without the project name or the details that would let someone exploit it.
Try it on a repository you know
Public repositories scan free. If a finding looks wrong, tell us: false alarms on well-kept projects are how the rules get better.