App Security

Manage .env secrets with Varlock so keys stay out of logs and prompts

Audit code changes for auth, crypto and input handling flaws

Scan project dependencies for known vulnerabilities using the Google OSV database

Trace system flows across code, API, auth, data and network layers with Mermaid export

Compare session, JWT and OAuth auth designs and pick a provider safely

Scan code for vulnerable dependencies, leaked secrets and OWASP-style flaws

Review code for OWASP Top 10 flaws and suggest concrete fixes

Explain common web vulnerability classes and how to spot them in APIs and apps

Coordinate a supervised fleet of auditors to find and verify vulnerabilities in a target

Run OWASP checks, vulnerability scans and adversarial red team tests on code

Validate URLs and sanitize untrusted external content before using it

Assess AI and MCP systems for prompt injection, tool abuse and data leaks

Match discovered service versions to CVEs and rank them by CVSS and exploitability

Prevent injection, SSRF, path traversal and secret leaks in Go services

Find which secret files such as .env and keys reached an agent session

Show all tracked vulnerabilities and their current remediation status

Check exploit intelligence for a vulnerability against this repository

Search exploits by ecosystem, severity, source and EPSS score

Propose concrete fixes for a vulnerability in the current repository

Score a live app or site for exposed keys, open tables and weak headers

Check a package's security risk before adding it as a dependency

Build a remediation plan for a vulnerability with fix checks

Run a deep security audit covering OWASP Top 10, auth, secrets and dependencies

Block prompt injection, PII leaks and social engineering in a mortgage assistant

Look up a vulnerability by ID or list vulnerabilities for a package

Keep API keys, tokens and passwords out of source code and handle them safely

Check code that handles input, auth, file I/O and queries for common vulnerabilities

Keep API keys and passwords out of AI context by using asm-exec secret references

Create AWS Secrets Manager secrets with KMS keys, rotation and least privilege

Run a fast AWS Security Agent scan on only the code changed since a git ref

Pull AWS Security Agent pentest and code review findings and drive fixes

Upload a workspace to AWS Security Agent and return ranked, verified code findings

Run an AWS Security Agent threat model on spec and design documents with STRIDE

Configure AWS WAF web ACLs, managed rules, rate limits and bot control

Set up Cloudflare Turnstile bot checks and server-side verification in an app

Create and manage X.509 certificates in Azure Key Vault from Rust

Create and use RSA, EC and HSM keys in Azure Key Vault from Rust

Create, rotate, encrypt and sign with keys in Azure Key Vault from TypeScript

Manage secrets, keys and certificates in Azure Key Vault from Python

Store and retrieve secrets and API keys in Azure Key Vault from Rust

Store and retrieve application secrets in Azure Key Vault from TypeScript

Create, rotate and use cryptographic keys in Azure Key Vault from .NET

Create and use RSA and EC keys in Key Vault for encrypt, sign and verify in Java

Store and fetch passwords and API keys in Azure Key Vault from Java

Check code edits against threat models and past vulnerabilities before you change code

Build an interlinked architecture knowledge base for a security review loop

Score security findings by risk using empirical evidence and architectural impact

Configure and preflight-test Mantis vulnerability review sandboxes and AI models

Filter findings to those triggerable in production builds with assertions disabled