App Security

Mine repository history for past vulnerabilities and security fixes

Launch automated vulnerability review campaigns on files or repositories with Mantis

Generate minimal security patches in isolation, apply them and verify the fixes

Build a targeted defensive security review plan from the threat model

Write a stakeholder security review report from confirmed findings and exploit chains

Audit production source files for security flaws with static analysis and deep reviews

Validate security findings against source code and drop the false positives

Build a content-addressed index of code units for structural context in security review

Generate security-focused summaries for each directory before planning a review

Write a living threat model with trust boundaries, attack surfaces and attacker profiles

Assess AI model supply chains, poisoning, membership inference and agent risks

Check if pages can be framed and whether clickjacking reaches sensitive actions

Test CORS settings for origin reflection, credentialed reads and preflight bugs

Test state-changing flows for CSRF, SameSite gaps, login CSRF and OAuth state

Check CSV exports and spreadsheet imports for formula injection in Excel and Sheets

Check package manifests for dependency confusion that could pull malicious packages

Find exposed .git folders, backups and .env files during authorized recon

Test LLM apps for prompt injection, indirect RAG attacks and MCP tool abuse

Review OAuth and OIDC redirect URIs, PKCE, state and nonce handling for flaws

Find open redirects in URL parameters, form actions and JavaScript navigation sinks

Find prototype pollution in merged JSON, query parsers and deep-assign code

Escalate prototype pollution to server-side code execution and client-side gadgets

Test WebSocket handshakes for cross-site hijacking and flaws in real-time channels

Design and audit authentication, permissions, SSO, MFA and offboarding access

Decide security strategy, risk acceptance and when to halt risky work

Classify data and set up encryption, key rotation and secret handling in apps

Review architecture and code changes for security issues before shipping

Map assets, entry points and trust boundaries to find threats before building

Triage scanner findings by real exploitability and track fixes to done

Check package.json dependencies against live advisories from the last 48 hours

Read 1Password secrets through an agent-safe layer over the official CLI

Audit authentik users, tokens and health with an offline SQLite cache

Search the National Vulnerability Database for CVEs, CVSS scores and affected versions

Harden Django apps against CSRF, XSS, SQL injection and weak auth settings

Run a security checklist on auth, user input, secrets, APIs and payment features

Scan Claude Code configs, hooks and MCP servers for injection and misconfiguration risks

Secure Spring Boot APIs with Spring Security authentication, CSRF and rate limits

Encrypt, decrypt and redact sensitive files and check password strength before sharing

Implement OAuth 2.0 and 2.1 flows with PKCE, refresh rotation and JWT checks

Implement secure backend input validation, authentication and API protections

Scan dependencies for known vulnerabilities, license issues and outdated packages

Scan dependencies for vulnerabilities, license risks and outdated packages

Find and fix XSS risks in React, Vue, Angular and plain browser JavaScript

Write frontend code that prevents XSS and handles output sanitization safely

Write secure mobile code with input validation and WebView protections

Audit systems for vulnerabilities, OWASP risks and DevSecOps gaps

Scan project dependencies for known vulnerabilities and generate SBOMs

Harden applications and infrastructure with layered security scans and fixes

Find code vulnerabilities with static application security testing across languages