exec() in /convert
Reached from a route that takes a filename straight off the query string. The fix is written and waiting on your branch.
An attacker on your payroll · the fix included
They exploit it.
They fix it.
You say when.
An autonomous product-security team you employ. They prove a vulnerability by walking the attack end to end, then fix it where it lives — a patch in the code, a corrected resource in your infrastructure, a guardrail on an agent handed too much. And where they can't reach a verdict, they say so, instead of counting it clean.
- Ranked by
- ReachProven exploitability, not CVSS
- Domains
- 3Your code · what you pull in · your AI agents
- Arrives as
- A fixCode, cloud config, agents
- Merged by
- YouNothing ships without your clearance
Who you employ
Five engineers. Not one of them human.
You employ three, one per domain. Two come with every hire — Lyra composes the attack, Wright writes the fix. Only Wright ever touches your code.
Agent security
Calvin
Knows every AI agent, tool and MCP server running in your name — including the ones nobody registered.
“You are running more agents than your inventory says. I find them, and I show you the one left unauthenticated.”
Each works to a clearance you setWatchProposeOpen PR
They propose; today, the merge is yours.
Live demo
See it run on a stack like yours.
Pick a stack and press Run. Ten seconds, nothing to install — watch what gets ruled out, and what gets fixed.
Stack
acme/checkout-api · src/routes/refunds.jsSample
Wright · fix opened — PR #4127 closes the path. The merge is yours.
The queue
9.8lodash 4.17.20 · prototype pollutionFILED · the vulnerable _.merge path is never called
ALERTexec() in /healthz version handlerFILED · constant argv — no user input reaches it
ALERTPOST /refunds/:id/receipt● REACHABLE · orderRef flows into a shell string
The chain — severed
- POST /refunds/:id/receipt● proven
orderRef in the JSON body
- orderRef → shell string● proven
zero sanitizers on the path
- ✓exec() runs it via /bin/sh -cclosed
neutralised — src/routes/refunds.js
- RCE as the API service accountunreachable
the fix closed the path before it got here
The fix
const { orderRef } = req.body;
+ if (!/^[A-Za-z0-9_-]{1,32}$/.test(orderRef)) {
+ return res.status(400).json({ error: "bad ref" });
+ }
- const cmd =
- `receipt-gen --order ${orderRef} …`;
- exec(cmd, (err) => {
+ execFile("receipt-gen",
+ ["--order", orderRef, "--out", out],
+ (err) => {
PR #4127 — refunds: execFile + allowlist for receipt genYours to merge ▸
Filed as noise: the lodash 9.8 (unreachable) and exec() in /healthz (constant argv).
A specimen. Your own run is composed from one source you connect — a repository today; your code, dependencies, IaC and agent configs come with it.
Why this is different
Three findings. One worth your afternoon.
So we say which two you can ignore — with the reason printed next to them — and open a pull request on the one you can't.
lodash 4.17.20
Real advisory, and the vulnerable path is never called from your code. Filed with the reason, so nobody re-opens it next quarter.
credentials in env
We could not show this one either way. It is marked assumed rather than quietly counted as clean.
Book 30 minutes
Bring one repo. You leave the call knowing which of your findings were worth the afternoon.
The limits you set
Three laws. You set how far inside them they go.
Written for machines that act, not assist. They guard the one thing a security team can break — your trust. We wrote them; the clearance is yours.
- First Law
An engineer may not claim more than it proved — nor, by staying silent, let you believe you are safe when you are not.
a blast radius it can't prove is published ○ ASSUMED, never claimed.
Binds Saga and Lyra hardest — the two that make claims. It is why Saga refuses to claim more than it can show, and why Lyra prints every hop it had to assume.
- Second Law
An engineer works to the clearance you set and no further — except where obeying would break the First Law — and hands you every call that is yours.
the PR opens, the merge is withheld — yours to make.
Binds Wright alone, because Wright is the only one with hands. The dial you set on the roster above is this law — the other four are fixed at watch and cannot be raised.
- Third Law
An engineer guards the one thing that lets it exist — your trust — but never by hiding a failure, faking a preview, booking a win it did not earn, or reaching past the clearance you set.
a scope it couldn't reach is shown "not covered", never counted clean.
Binds all five. It is why standing an engineer down leaves its domain marked not covered rather than quietly counted as clean.
Every control on the roster above — the dial on Wright, the shift switch on each engineer, the hops Lyra marks assumed — is one of these three, enforced.
Start here
Stop operating security software. Put the team on retainer.
Pick the domain that's loudest — your AI agents, your code, or everything you pull in. One engineer works it end to end: what is worth fixing, the fix written, delivered where your team already works. The rest gets filed, with the reason printed.
Book 30 minutes →A working call, not a pitch: you connect one source, we run it live, and you leave with whatever it found and wrote.
- One repo to start · read access
- No agent runs without your clearance
- Today, the merge is yours
Rather write than book?
Leave one source and we will come back with what it found and the fix it wrote — however you want it delivered.