Employ the security engineers
that fix it.

I · The security engineers

Five security engineers. Not one of them human.

You employ three — one per domain: your AI agents, your code, everything you pull in. Two come with every hire: Lyra composes what they found into the attack a real adversary would run, and Wright writes the fix. Of the five, only Wright ever touches your code.

01start here

You are running more agents than your inventory says. I find them, and I show you the one left unauthenticated. Wright opens the PR that closes it.

— Calvin

Agent SecurityOn

Calvin · the Robopsychologist

knows every AI agent, tool and MCP server running in your name — including the ones nobody registered

02

Three hops proven from POST /refunds to exec(). The fourth — creds in env — I marked assumed, and told you.

— Saga · see the path it proved →

Application CodeOn

Saga · the Reach Prover

decides whether a flaw in your own code can actually be reached from outside — and refuses to claim a path it did not walk

see the path it proved →

03

The lodash 9.8 is real and unreachable — the vulnerable merge path is never called. Filed, with the reason printed.

— Ada · see what it ruled out →

Supply ChainOn

Ada · the Dependency Ledger

audits everything you pull in and nothing you wrote — third-party packages and the malware planted among them, in a supply chain that now includes the models you load like libraries

see what it ruled out →

And two that work across all three — included

Exploitability

Lyra · the Composition

takes what the three found and composes it into the attack a real adversary would run

Alone, none of the three findings was worth waking you for. Chained, they reach the payments table. That chain is the one call that reached you.

— Lyra · see the chain it composed →

Remediation

Wright · the Fix Forge

writes the smallest fix that holds in any of the three domains, then opens the pull request that carries it — the work arrives done, and the merge stays yours

execFile plus an allowlist, 216 tests passing, opened as PR #4127. Or I plan it and your Claude Code applies it. Either way the merge stays yours.

— Wright · see the PR it opened →

One line they never blur: reachable is not exploitable. That difference is the difference between noise and truth. read the manifesto →

You'll set each engineer's clearance and shift in the app. They propose; today, the merge is yours.

II · Watch them work

Watch one work on a stack like yours.

Pick a stack and press run. Watch them prove what's reachable, write the fix, and open a pull request.

acme/checkout-api · src/routes/refunds.jsDemonstration · sample repo

Adaon shift

Sagaon shift

Lyraon shift

Wrighton shift

The queue

9.8lodash 4.17.20 · prototype pollutionFILED · the vulnerable _.merge path is never called

ALERTexec() in /healthz version handlerFILED · constant argv — no user input reaches it

ALERTPOST /refunds/:id/receipt● REACHABLE · orderRef flows into a shell string

$ a completed run — press ▸ Run to watch it compose

The fix

--- src/routes/refunds.js

const { orderRef } = req.body;

+ if (!/^[A-Za-z0-9_-]{1,32}$/.test(orderRef)) {

+ return res.status(400).json({ error: "bad ref" });

+ }

- const cmd =

- `receipt-gen --order ${orderRef} …`;

- exec(cmd, (err) => {

+ execFile("receipt-gen",

+ ["--order", orderRef, "--out", out],

+ (err) => {

Attack path

↳ POST /refunds/:id/receipt · orderRef in the JSON body● PROVEN

↳ orderRef → shell string · zero sanitizers on the path● PROVEN

↳ exec() runs it via /bin/sh -c · metacharacters interpreted● PROVEN

↳ RCE as the API service account · env holds DB + Stripe creds○ ASSUMED

YOUR CI ON THE PRbuild npm run build — greentests 216 passing (+2 regression specs)new specs: orderRef with ; $() or backticks now 400s; a valid ref still renders.

PR #4127 — refunds: execFile + allowlist for receipt genyours to merge ▸

a merge-ready PR — or planned for Claude Code to apply. Opened, not merged — Wright never merges for you.

▸ Point it at your stack

Filed as noise: the lodash 9.8 (unreachable) and exec() in /healthz (constant argv).

A specimen — your run is composed from one source you connect: a repo — your code, your dependencies, your IaC and your agent configs come with it.

III · The constitution

All five work under three laws. You set how far inside them they go.

Inspired by Asimov, 1942. His guarded a human's body; ours guard the one thing a security team can break — your trust. We wrote them; the clearance is yours.

This is the same charter you were just using. Every control on the roster above — the dial on Wright, the shift switch on each engineer, the assumed hops Lyra prints — is one of these three laws, enforced.

1. IFirst Law

   An engineer may not claim more than it proved — nor, by staying silent, let you believe you are safe when you are not.

   a blast radius it can't prove is published ○ ASSUMED, never claimed.

   Binds Saga and Lyra hardest — the two that make claims. It is why Saga refuses a path it did not walk, and why Lyra prints every hop it had to assume.

   inspired by Asimov — a robot must never hurt a human being, nor stand by while one comes to harm

2. IISecond Law

   An engineer works to the clearance you set and no further — except where obeying would break the First Law — and hands you every call that is yours.

   the PR opens, the merge is withheld — yours to make.

   Binds Wright alone, because Wright is the only one with hands. The dial you set on the roster above is this law — the other four are fixed at watch and cannot be raised.

   inspired by Asimov — a robot follows human orders, unless obeying would break the First Law

3. IIIThird Law

   An engineer guards the one thing that lets it exist — your trust — but never by hiding a failure, faking a preview, booking a win it did not earn, or reaching past the clearance you set.

   a scope it couldn't reach is shown "not covered", never counted clean.

   Binds all five. It is why standing an engineer down leaves its domain marked not covered rather than quietly counted as clean.

   inspired by Asimov — a robot preserves its own existence, unless doing so would break the first two