Agentic Security Review

You point it at a codebase

A folder of source files. Could be a small library or a full application. The framework first locks down the target so it cannot read outside that folder.

Automated scanners run first

Standard security tools (like virus scanners for code) check for leaked passwords, known weak patterns, and dependencies with known vulnerabilities. Plus a scan for "prompt-injection" — text inside the codebase that could trick the AIs.

Three AI agents read in parallel

Each gets the same hashed prompt and the scanner results. They look for security weaknesses independently and write structured findings. One AI alone misses things; three together catch more.

Each finding is fact-checked against the source code

The framework opens the file the AI cited, finds the exact line, and confirms the quoted code is actually there. AIs sometimes hallucinate — citing line 247 when the code is on line 142, or quoting something that doesn't exist. Those findings are flagged as unverified before they get consolidated.

Severity comes from a fixed rule — not AI opinion

Each finding is scored on six factors: what an attacker could do, what access they need, what environment is hit, where the input comes from, how easy to trigger, and whether the code is actually reachable. The combination determines Critical / High / Medium / Low — deterministically. The same finding always gets the same severity.

Every finding gets one of five states

Nothing is filtered away — every finding is preserved and labelled. You see exactly which ones are firmly real, which need a human glance, and which look like noise.

Eight rules decide: ship, review, accept, or block

A release policy engine evaluates every finding against eight standard rules ("any confirmed Critical → block", "exposed secret → block", "auth-bypass at Medium+ → needs review", etc.). All rules are tested and logged. You get a clear verdict, not a maybe.

You get a report + a full audit log

A single HTML file with an executive summary, per-finding business-risk narrative, evidence citations, and the 6×6 coverage matrix. Plus a JSON audit log with every hash needed to reproduce the result later — schema, rubric, policy, prompt, every agent's raw output.