Your coding agent stopped asking permission. This keeps the receipt.

Claude Code, Copilot CLI and Codex land in one live timeline on one machine — every command, file touch and network call. No tenant, no account, nothing uploaded.

• Sequence engine — reading .env is fine, running curl is fine; doing both ninety seconds apart is exfiltration
• 673 detection rules, every custom regex compiled through RE2 so a rule can't hang your host
• Blocks what can't be undone before it runs, with a protected-path floor
• Ed25519-signed, hash-chained evidence packs — prove your own log wasn't edited
• Also scans MCP servers and skills, plants honeytokens, exports to Prometheus and webhooks

Four scanners in. One honest list out.

Burp Suite, ZAP, Nuclei and Dalfox normalised into one schema, deduplicated, and re-tested automatically when someone claims a fix.

• 531 raw findings → 37 real ones — a 93% cut in triage volume
• 99.2% precision · 99.4% recall · 0.8% false-merge _{(DVWA benchmark, every merge manually reviewed)}
• ~2 seconds to confirm a fix, against 10–30 minutes by hand
• SUS 82.14 from 14 practising security engineers — the "excellent" band, against a 68 cross-study average
• Deliberately not machine learning. Wrongly merging two findings can hide an exploitable one, so every merge shows its score and method and can be overridden in one click

Security questionnaires gate enterprise deals. They shouldn't eat a week.

Draws answers from a team's own evidence, cites the document behind each one, and routes every answer through human review before it leaves.

• It refuses rather than guesses — below a confidence floor it escalates to a person instead of writing something plausible
• Every generation writes a ten-field decision record, so an auditor can ask why any answer was given
• Append-only audit trail, enforced by database trigger and withheld grants — not by convention
• 83 pgTAP tests across row-level security and roles, blocking in CI
• EU by design — data in AWS Ireland, EU analytics, EU error tracking

A live multi-tenant SaaS where the permission model is the product.

Landlord, property manager, broker and tenant each sign in and see only their own part — enforced in the database, not hidden in the screen.

• Six roles across four kinds of user, with access rules in row-level security
• I found a cross-tenant leak in my own design and measured it with real tokens: 137 foreign rows visible → 0, with an RLS matrix suite to keep it there
• ~4,400 executed test cases across 219 files · 105 migrations
• Custom static checks beyond off-the-shelf tooling: SECURITY DEFINER search-path hardening, plan-limit sync, public-identity leak detection
• Properties, units, leases, renewals, maintenance, documents, broker commissions

"Is this tool SOC 2? Do they train on our data? Where does it live?" — the three questions every AI shortlist dies on.

A catalogue where those fields are recorded once, comparably, with a link to the vendor page that proves each one.

• Every true compliance flag carries a source URL on the vendor's own domain, and every certification in a trust report carries a verbatim quote
• null means unverified, never false — enforced in the schema, not the style guide
• Refuses whole categories, and delists tools whose claims stop checking out
• Our own products appear with the same fields, no ranking advantage, and an on-page conflict disclosure
• Static and pre-rendered — no backend, no tracking, MIT code and data