Rules in milliseconds. Agents in a sealed box.
Offline rules first. Then AI agents audit a masked copy in a sealed VM.
What the local rules catch.
No AI, no network. Runs before anything else.
| Check | What it looks for | Severity |
|---|---|---|
| API keys and tokens | OpenAI, Anthropic, Google / Gemini, OpenRouter, Groq, xAI, Replicate, Hugging Face, Stripe live and test, Supabase, Discord bot tokens and webhooks, GitHub, AWS, Private keys | Critical or high |
| System prompts | Prompts shipped in client code | High |
| Licence checks | Pro flags and keys kept in the client | High or medium |
| Public files | /.env and /.git/config left on a live site | Critical |
| Peer gaps (DSA) | Routes that skip a check their peers run | Ranked by spike |
The agents never see your real keys.
Sealed VM
A fresh VM per agent, with no network.
Masked secrets
Keys are swapped out before any file is read.
Nothing to us
Only masked code goes to your AI provider.
What you get back.
File, line, evidence and a fix for each finding.
Bring the AI you already pay for.
Your Claude Code or Codex plan, or an API key.
- Claude Code
- Codex
- Anthropic API
- OpenAI API
- Gemini API