AGI AEGIS
How it worksRun a scan

BOUNDED SECURITY REVIEW

Your site has security gaps.
We show you how to close them.

Aegis reviews your public site and source with frontier security agents, verifies the evidence, and gives your team the shortest safe path to a fix.

https://

Deterministic checks are live; agents require OpenRouter plus distributed rate limiting.

No destructive tests Same-origin pages only Secrets stay server-side

EXAMPLE OUTPUT

Evidence first. Fix second.

61SECURITY
POSTURE
ATTACK PATH 013 CONFIRMED SIGNALS
Public siteexample.com
Open API/api/account
User datacross-origin access
Confidence 94%
Observed in live response + source
PRIORITIZED FINDINGS3 OF 12
critical

01

Authenticated API accepts any origin

The response reflects arbitrary origins while allowing credentials.

/api/account
high

02

Login has no observable request limit

Repeated failures are accepted without a delay or lockout signal.

/api/auth/login
medium

03

Session token is readable by page scripts

A token-shaped value is written to localStorage after sign-in.

auth-client.ts:42

THE REVIEW LOOP

Not a checklist.
A line of reasoning.

  1. 01

    Observe

    Map pages, headers, public endpoints, authentication boundaries, and relevant source files.

  2. 02

    Corroborate

    Run independent agent passes, then keep only findings supported by concrete evidence.

  3. 03

    Repair

    Translate each issue into an owner, exact code change, verification step, and safe fallback.