Introducing DOM-0.8B

Today we’re introducing DOM-0.8B, an 800M-parameter code-security model, alongside VAKT, our local scanner. Our mission is to make security review accessible to everyone, regardless of nationality or budget. It’s free, open weights and fully local. You can now optimize your code review without using cloud models.

Our tool VAKT extracts functions from your repository, scores them with DOM-0.8B and ranks them for further investigation. Rather than generating a written review of every function, DOM returns severity and vulnerability-family scores. The aim is to focus human review and generative-model tokens where they are most useful, before the code reaches production.

Running locally

VAKT runs on Apple Silicon through Metal, NVIDIA GPUs through CUDA 13, and Linux CPUs. The fp16 weights are approximately 1.5 GB to download; runtime memory use depends on the input and backend.

Install VAKT with one command.

curl -fsSL https://get.vaktex.com/oss-vakt | bash

wget -qO- https://get.vaktex.com/oss-vakt | bash

Access to the gated weights may still require approval on HuggingFace.

Then scan the current repository:

vakt .

VAKT uses AST-aware parsing to extract functions, with a scanning window of 16,384 tokens. Results are available as a terminal report or structured JSON, and cached scores avoid repeating work on unchanged inputs. Use the scores to prioritise investigation, then check callers, reachability and assumptions. A score is not proof of an exploitable vulnerability.

Benchmarks

Severity AUROC measures how well a model ranks vulnerable code above non-vulnerable code across thresholds. Higher is better; it is not percentage accuracy.

An AUROC of 0.5 represents chance-level ranking; 1.0 represents perfect separation on the evaluated examples. DOM-4B’s score of 0.8371 means a randomly chosen vulnerable example ranks above a randomly chosen non-vulnerable example about 84% of the time, counting ties as half. It does not mean 84% of findings are correct.

DOM-0.8B scores 0.5731, below the character n-gram baseline at 0.6009. That baseline uses recurring text patterns rather than explicit program analysis, making it a useful check on what the model adds. The graph reports a stronger result for DOM-4B, but establishing an improvement requires evaluating the builds on the same held-out examples. For review workflows, precision and recall at the chosen threshold also matter: they determine how much code gets flagged and how many issues are missed.

Architecture

DOM-0.8B uses a 24-layer text backbone with a hidden width of 1,024. Each of six groups combines three linear-attention layers with one full-attention layer. In the current recipe, the lower 16 layers remain frozen while the upper eight are adapted.

One backbone pass per input chunk produces token representations. Learned four-head attention pooling in fp32 combines them into a representation for a severity score and 18 CWE family scores. A separate 256-dimensional training projection is discarded for inference.

A generative model processes the input and then decodes its answer one token at a time. DOM processes each input chunk and returns classification scores, without generating a written report. That removes answer-generation work and gives VAKT fixed outputs it can rank and threshold. The engineering advantage is a narrower task; its effect on review time and accuracy still needs to be measured.

What’s next

This release is a big first step in making security reviews more accessible. We’re excited to share more in the coming weeks about our security developments and how they advance our goal of accessible security for everyone.

If you’re an existing Vaktex customer, you may be eligible for DOM-4B. If you’re interested, we’d love to hear from you.