If it's exploitable,
it doesn't ship.

I · Run the firm

See the team work on a stack like yours.

Pick a stack and press run. Watch the team proving the reachability, writing the fix, and opening a pull request.

acme/checkout-api · src/routes/refunds.jsDemonstration · sample repo

Vesperon shift

Adaon shift

Marloweon shift

Sagaon shift

Wrighton shift

Themison shift

Lyraon shift

The queue

9.8lodash 4.17.20 · prototype pollutionFILED · the vulnerable _.merge path is never called

ALERTexec() in /healthz version handlerFILED · constant argv — no user input reaches it

ALERTPOST /refunds/:id/receipt● REACHABLE · orderRef flows into a shell string

$ a completed run — press ▸ Run the firm to watch it compose

The fix

--- src/routes/refunds.js

const { orderRef } = req.body;

+ if (!/^[A-Za-z0-9_-]{1,32}$/.test(orderRef)) {

+ return res.status(400).json({ error: "bad ref" });

+ }

- const cmd =

- `receipt-gen --order ${orderRef} …`;

- exec(cmd, (err) => {

+ execFile("receipt-gen",

+ ["--order", orderRef, "--out", out],

+ (err) => {

Attack path

↳ POST /refunds/:id/receipt · orderRef in the JSON body● PROVEN

↳ orderRef → shell string · zero sanitizers on the path● PROVEN

↳ exec() runs it via /bin/sh -c · metacharacters interpreted● PROVEN

↳ RCE as the API service account · env holds DB + Stripe creds○ ASSUMED

VALIDATIONbuild npm run build — greentests 216 passing (+2 regression specs)new specs: orderRef with ; $() or backticks now 400s; a valid ref still renders.

PR #4127 — refunds: execFile + allowlist for receipt genyours to merge ▸

a merge-ready PR — or inline in Claude Code, Cursor, and your IDE. Opened, not merged — Wright never merges for you.

▸ Point it at your stack

Filed as noise: the lodash 9.8 (unreachable) and exec() in /healthz (constant argv).

A specimen — your run is composed from your own sources: repos, cloud, IaC, agents, models.

Exhibits · what the firm hands you

The exploit, proven. The fix, written. The PR, opened.

Not findings — deliverables. These are the three artifacts from the run above, exactly as the minds produced them.

Exhibit A · The proof

acme/checkout-api · OS command injection (CWE-78)

• POST /refunds/:id/receiptorderRef in the JSON body
• orderRef → shell stringzero sanitizers on the path
• exec() runs it via /bin/sh -cmetacharacters interpreted
• RCE as the API service accountenv holds DB + Stripe creds — assumed, and said so

Marlowe traced it. Saga proved the way in.

Exhibit B · The fix

src/routes/refunds.js

const { orderRef } = req.body;

+ if (!/^[A-Za-z0-9_-]{1,32}$/.test(orderRef)) {

+ return res.status(400).json({ error: "bad ref" });

+ }

- const cmd =

- `receipt-gen --order ${orderRef} …`;

- exec(cmd, (err) => {

+ execFile("receipt-gen",

+ ["--order", orderRef, "--out", out],

+ (err) => {

Wright wrote the minimal fix — validated, not guessed: 216 passing (+2 regression specs)

Exhibit C · The pull request

#4127 refunds: execFile + allowlist for receipt gen

build npm run build — green

tests 216 passing (+2 regression specs)

The merge is yours — always.

Themis signs only what the firm reached.

II · The firm

A team of nine minds. You set the leash.

The security team you didn't have to build: Lyra the overmind and eight specialists, one discipline each. You run them — set how far the firm acts on its own, and stand any mind down.

00overmind

Eight minds worked the run above. One finding reached you. That ratio is the job.

— Lyra

Lyra the overmind

composes the firm's evidence into the few calls that reach you

01

Three hops proven from POST /refunds to exec(). The fourth — creds in env — I marked assumed, and told you.

— Saga · see the path it composed →

Saga reachabilityOn

composes entry → crown jewel, and says plainly what it only assumed see the path it composed →

02

A security group opening 5432 to the internet — caught in the planned state, before apply. Patch, don't page.

— Mason

Mason cloud & IaCOn

reads IaC and cloud exposure for any door open to the whole internet

03

The AKIA… key in fixtures.py is a documented example — filed. The one in worker/s3.py was live. That one shipped a fix.

— Locke

Locke secretsOn

hunts committed credentials — a live key in source is never acceptable

04

orderRef flows into a shell string with zero sanitizers, then exec() runs it. I claim paths I walked, not patterns I matched.

— Marlowe · see the taint it traced →

Marlowe code-taintOn

walks user input to dangerous sinks; claims only a path it traced see the taint it traced →

05

The lodash 9.8 is real and unreachable — the vulnerable merge path is never called. Filed, with the reason printed.

— Ada · see the noise it files →

Ada dependenciesOn

keeps the bill of materials honest — sets aside what can't be reached see the noise it files →

06

execFile plus an allowlist, 216 tests passing, PR #4127 open for review. The merge stays yours.

— Wright · see the PR it opened →

Wright remediationOn

writes the fix and opens the PR — never merges for you see the PR it opened →

07

I run the queue at 03:00 so the run you drive above is already triaged by morning. A quiet night is the deliverable.

— Vesper · watch it stand watch →

Vesper 24/7 watchOn

stands the night shift — silence is the deliverable watch it stand watch →

08

The refunds fix maps to a control I can cite. What the firm didn't reach stays printed as 'not covered' — I don't sign that.

— Themis · see what it refuses to sign →

Themis complianceOn

signs only what the firm reached; leads with what it does not cover see what it refuses to sign →

A preview — you'll set each mind's leash and shift in the app. The firm proposes; the merge is always yours.

III · The constitution

The minds answer to three laws.

After Asimov, 1942. His guarded a human's body; ours guard the one thing a security firm can break — your trust.

1. IFirst Law

   A Satellite may not claim more than it proved — nor, by staying silent, let you believe you are safe when you are not.

   a blast radius it can't prove is published ○ ASSUMED, never claimed.

   after Asimov — "A robot may not injure a human being or, through inaction, allow a human being to come to harm."

2. IISecond Law

   A Satellite works to the leash you set and no further — except where obeying would break the First Law — and hands you every call that is yours.

   the PR opens, the merge is withheld — yours to make.

   after Asimov — "A robot must obey the orders given it by human beings except where such orders would conflict with the First Law."

3. IIIThird Law

   A Satellite guards the one thing that lets it exist — your trust — but never by hiding a failure, faking a preview, booking a win it did not earn, or reaching past the leash you set.

   a scope it couldn't reach is shown "not covered", never counted clean.

   after Asimov — "A robot must protect its own existence as long as such protection does not conflict with the First or Second Law."