Every change gets a look
Push code and it is checked before it reaches the people using your product.
SECURITY FOR SMALL TEAMS
Ship fast.Without leaving the door open.
AiSekur points security agents at the site you just launched, shows you what someone could actually reach, and hands you the fix in plain language. No security team required.
- Every merge
- a fresh pass across whatever changed
- 42 min
- median time to a finding we proved
- Zero
- unverified reports left for you to sort through
WHAT WE LOOK AT
Everything you put online, checked.
Your site, the APIs behind it, the code you shipped and the account it all runs on. One pass, one plain answer.
AddressStatusFound
api.acme.dev
Checked
3
7
4
staging.acme.dev
Checking
1
3
2
auth.acme.dev
Checked
2
5
8
checkout.acme.dev
Waiting
1
3
graph.acme.dev
Checked
1
2
5
Your site and its APIs
Login flows, forms, payment steps and the endpoints behind them, probed the way someone trying to get in would probe them.
aisekur-agentbotOne customer can download another customer's invoices
Risk: High · Customer data exposed
We did it on staging.acme.dev · the file we got back is attached
The invoice download at GET /v1/invoices/:id/pdf looks up the invoice by its id and never checks who is asking. We signed in as a second customer, changed the number in the address, and got someone else's invoice.
The change that closes it
| 45 | const { id } = req.params; |
| 46 | const inv = await Invoice.findById(id); |
| 46 | const inv = await Invoice.findOne({ |
| 47 | _id: id, org: req.org.id, |
| 48 | }); |
Apply this fix ▾
The code you shipped
Including whatever an assistant wrote for you. Keys left in the repo, queries that can be tricked, packages with known holes.
What we foundRiskFix
Uploaded files readable by anyone
Critical
5 minOne key can do anything you can
Critical
10 minServer login open to the internet
High
2 minDatabase stored unscrambled
Medium
1 hrA break-in would leave no trace
Medium
20 minWhere it runs
Storage left open to the world, keys with far more rights than they need, ports facing the whole internet. The mistakes that take a minute to make and cost the most.
WHAT YOU GET BACK
No jargon. Just what to change.
Every finding says what it is, what someone could do with it, and the exact change that closes it.
app.aisekur.com
←What we found/AS-1042
Your link preview can be pointed at your own private network
We proved itHigh riskCloud keys exposed
What it is
The link preview at /v2/link-preview fetches whatever address it is handed. We handed it an address inside your own network, and it went and fetched it for us.
What someone could do
Pull the keys your app uses to reach your cloud account from 169.254.169.254, then list the other machines sitting on your private network.
Where it lives
acme/edge-api · link-preview.ts:23GETapi.acme.dev/v2/link-preview?target=
Risk
High
Open to
AnyoneTime to fix
MinutesProved
12 min agoSee it for yourself
We show you the request that worked. You know it is real, not a scanner guessing.
app.aisekur.com
The fixThe proof
What we changed
Check the address against a short list you allow before the server fetches anything, turn down anything on your own network, and require a secure connection.
link-preview.ts:23-29Copy
| 23 | 23 | const target = req.query.target; |
| 24 | const resp = await fetch(target); | |
| 24 | const parsed = new URL(target); | |
| 25 | if (!ALLOWED_HOSTS.has(parsed.hostname)) { | |
| 26 | throw new ForbiddenError("host not allowed"); | |
| 27 | } | |
| 28 | const resp = await fetch(parsed.href); | |
| 25 | 29 | return res.json(await resp.json()); |
✓We tried the same trick again on the fixed code — it no longer works
→Pull request #1042 aisekur/as-1042-link-preview opened and waiting for you
Then close it
You get the corrected code. Connect your repository and we open the pull request for you.
AS YOU KEEP SHIPPING
Checked again every time you deploy.
Security that keeps up with the pace you actually ship at, instead of once a year.
The bad ones get stopped
If a change opens something serious, you hear about it before it is live.
Watches what you expose
New subdomains, certificates about to expire, fresh holes published in the tools you use.
Proof, never noise
You only see what we managed to reproduce. No pile of maybes to work through.
Learns how you built it
It reads how your app fits together and how people log in before it starts.
Remembers what you fixed
Anything you closed once gets checked first on the next pass.
YOUR DASHBOARD
See where you stand.
One page telling you whether you are better than last month, what is still open, and what is waiting for you to hit merge.
app.aisekur.com
Your score
82/100+14
up from 68 on your first scan
7d30d90d
Still open
47
31 fewer than last quarter
Serious ones
3
2 fixed, 1 waiting on you
Average time to fix
3.4d
1.8 d faster
Things we check
128
12 new ones found
Still open
last 90 daysAprMayJunJulAugSep
WHEN SOMEONE ASKS
When a customer asks if you are secure.
Sooner or later a client or an investor sends over the security questionnaire. This is what you send back.
A report you can forward
What was tested, what was found, what you fixed. Dated, readable, ready to attach to an email.
A history that holds up
Every pass is kept, so you can show a problem was found in March and closed in March.
Your code stays yours
We do not train on it and we do not keep it once the run is finished.
Someone to ask
If a finding does not make sense, you get a person who explains it, not a ticket queue.
See what you left open.
Put in your domain. The first report lands in your inbox.