01 / CONTRACTAVAILABLE
Authorization that executes.
Compile hosts, paths, methods, rate limits, data handling, and abort conditions into the same policy the collector enforces.
RUNNER
PRODUCT PREVIEW · BOUNDED EVIDENCE
EVIDENCE-BACKED REMEDIATION 01
Find what matters. Fix it safely.
Prove it stayed fixed.
Vuln Runner turns authorized surfaces into inspectable evidence, owner-ready implementation briefs, and comparable retests—without confusing a signal with an exploit.
SCOPE-AWARE · EVIDENCE-PRESERVING · AGENT-READY · REGRESSION-ACCOUNTABLE
OPERATING CONTRACT / PRODUCT PREVIEWVR 0.2.0
01
Contract compiled
authority · surface · budget02
Evidence normalized
facts · provenance · confidence03
Change packaged
owner · tests · rollout · rollback04
Candidate retested
comparable · drift-aware · sealed4PROOF GATES
- ScopeLOCK
- EvidenceSEAL
- ChangeOWN
- RetestPROVE
01 / CONTRACTBounded
authority, methods, budgets, and stop conditions
02 / EVIDENCETraceable
facts, provenance, confidence, and counter-evidence
03 / DELIVERYAgent-ready
owning layer, minimum change, tests, and rollback
04 / CLOSUREComparable
same scope, workload, rules, and visible regressions
00
GUIDED RUN DESIGN
LOCAL WORKSPACE SETTINGS
Tell the runner what
decision you need.
These settings change the recommended operating mode, control priority, evidence threshold, next actions, and delivery packet. They stay on this device and never broaden network authority.
01
THE PRODUCT
One control plane for
evidence and change.
Start with what the evidence can prove today. Add owner context, source, runtime journeys, and infrastructure only when the engagement authorizes them.
02 / OBSERVEAVAILABLE
Evidence, not mystery scores.
Preserve the exact observation, rule version, confidence, blind spots, and counter-evidence behind every classification.
03 / DELIVERAVAILABLE
Fix briefs an agent can execute.
Name the owning layer, minimum safe change, regression checks, rollout guardrail, rollback, and verification condition.
04 / PROVEAVAILABLE
Retests that expose drift.
Compare the same target, scope, workload, and rule versions; separate resolved controls from regressions and incomparable runs.
05 / OWNER LAYERSOWNER-ENABLED
Source, runtime, and architecture.
Reconcile public signals with source, dependencies, deployment configuration, critical browser journeys, and owner telemetry.
06 / CRYPTOGRAPHIC AGILITYLOCAL TOOL
Post-quantum readiness, boundary by boundary.
Inventory long-lived data and crypto dependencies, retain hybrid key-exchange evidence, sequence migration, and retest every trust boundary.
Open the CBOM inventory02
POST-QUANTUM READINESS / INVENTORY + PROOF
CRYPTOGRAPHIC EXPOSURE GRAPH · EIGHT CONTROLS
A green edge can hide
a classical core.
Vuln Runner maps long-lived data to every cryptographic trust boundary, then binds each result to the exact adapter, destination, containment policy, and transcript digest.
REFERENCE MODEL · SYNTHETIC EVIDENCE
REFERENCE READINESS STAGEPILOT
Readiness is a graph, not a badge.
One reference boundary negotiates hybrid ML-KEM. The next is still classical. The internal database path has no authorized probe. A single green handshake would conceal both gaps.
- Data assets
- 2
- Trust boundaries
- 3
- Hybrid observed
- 1
- Controls
- 8
BOUNDARY EXPLOREREvery result keeps its coverage and non-claims attached.
synthetic reference fixtureTLS TRUST BOUNDARYHybrid observed
client→public-edge
NEGOTIATED GROUPX25519MLKEM768
VERIFICATIONattested isolated
BOUNDARY OWNEREdge Platform
LONGEST-LIVED DATA15 YEARS
MAPPED DATA
customer records15Ysession material2Y
WHY THIS IS NEXThybrid observed; verify authentication and downstream coverage
Prioritize by data lifetime and path.
The queue follows sensitive data across every boundary instead of ranking endpoints in isolation.
Bind the claim to how it was measured.
Destination, adapter, sandbox policy, certificate result, and transcript digest travel together.
Retest hybrid, fallback, and failure.
A migration closes only when comparable runs expose classical fallback, incompatibility, and regression.
The reference run is synthetic. It demonstrates the evidence model without claiming anything about YC or a production system.
03
CASE STUDY / YC-001
PUBLIC-PASSIVE · 2026-07-27 · PRELIMINARY
The 25-page count belongs to this bounded case study. Every engagement compiles its own surface and page budget.
- Observed
- 25 pages
- Classified
- 27 controls
- Verified
- 15 controls
- Collection
- 0 errors
A real evidence packet,
properly scoped.
This YC observation retains final URL, response status, timing, bounded metadata, body length, and content digest. Response bodies were analyzed in memory and not stored.
01
/200 · 340ms · 291kb
02
/about200 · 195ms · 69kb
03
/interviews200 · 125ms · 66kb
04
/faq200 · 109ms · 84kb
05
/people200 · 138ms · 171kb
06
/blog200 · 116ms · 149kb
07
/companies200 · 121ms · 33kb
08
/founders200 · 271ms · 33kb
09
/launches200 · 212ms · 33kb
10
/library200 · 1254ms · 1953kb
11
/partners200 · 259ms · 95kb
12
/subscribe200 · 168ms · 57kb
+13more routes in YC-001
04
YC-001 / THE CONTROL LEDGER
Silence is not a pass.
Every modeled control lands in an explicit state: verified, review, opportunity, issue, or not applicable. Pick a row to see the evidence and the implementation brief.
STATECONTROL / RULEDOMAIN
05
YC-001 / RESPONSIBLE SEVERITY
VR-SEC-002 · MEDIUM · HIGH CONFIDENCE
“Missing CSP” is a hardening review—not proof of compromise.
25/25 observed HTML responses lacked an enforcing Content-Security-Policy. That is useful implementation evidence. It does not establish an exploitable injection path.
OBSERVATIONHeader absent across the observed HTML surface.
COUNTER-EVIDENCE NEEDEDSource, runtime destinations, inline code, integrations, and owner threat model.
SAFE NEXT MOVEInventory → report-only policy → browser journeys → enforce.
06
CONTROLLED PROOF LAB
RUNNER CONCEPTS TEST SURFACE
Same intent.
Stronger delivery.
Measurable proof.
We reproduced the observed implementation patterns on a controlled twin—not a published YC impersonation. The baseline and candidate were scanned on the same host, routes, scope, workload, and rule versions.
LLAUNCH LAB
ProgramCompaniesLibraryApply
BUILD WITH EVIDENCE
Evidence should survive
contact with implementation.
contact with implementation.
Meet the batch ↗
12 TEAMS · ONE CONTROLLED SURFACEVISUAL PARITY / 100%
PROOF STATEAFTER
COMPARABLE
0finding groups
23verified controls
0regressions
+ CSP: default-src 'self'; object-src 'none'
+ Permissions-Policy: camera=(), microphone=()
+ <img alt="Founders..." width="1200" height="675">
+ <script integrity="sha384-..." defer>
11 resolved · 1 improved · 0 regressed11 finding groups removed under comparable measurement.
CONTROLBEFOREAFTERRESULT
VR-A11Y-003Observed images have non-empty alternative textopportunitypassresolved
VR-PERF-002Observed images reserve intrinsic dimensionsopportunitypassresolved
VR-PERF-003External scripts avoid parser blockingopportunitypassresolved
VR-SEC-002Enforcing CSP advertised on observed HTML responsesreviewpassresolved
VR-SEC-003Observed CSP avoids broad script and style allowancesnot-applicablepassimproved
VR-SEC-004Clickjacking policy observed on HTML responsesreviewpassresolved
+ 6 additional positive transitions in the proof bundleDownload comparison.json ↘
07
THE OPERATING LOOP
From curiosity to closure.
The product is not the scanner. It is the reasoning and evidence loop that makes every change safe to ship.
01
Contract
Compile authority, surface, methods, budgets, and stop conditions.
→02
Map
Follow only naturally linked, in-scope routes and preserve coverage limits.
→03
Observe
Normalize facts and provenance before making a claim.
→04
Challenge
Seek counter-evidence, compensating controls, and owner context.
→05
Fix
Name the owning layer, minimum change, tests, rollout, and rollback.
→06
Retest
Compare identical measurements and refuse to hide drift or regressions.
→08
THE HONESTY LAYER
The strongest signal
is knowing where evidence ends.
Automated external observations have not yet been reconciled with owner architecture, source, browser runtime, telemetry, or human review.
A / NOT TESTED
No inflated coverage claims.
- exploitability
- authenticated behavior
- authorization or business logic
- state-changing requests
- port scanning
- directory brute force
B / OWNER GATE
What promotes this to delivery-ready.
- triage each finding with the target's owning team
- record counter-evidence, compensating controls, and accepted exceptions
- validate relevant claims in source, configuration, browser, and representative journeys
- attach patch, regression tests, preview evidence, and before/after comparison
- obtain owner acceptance through the agreed engagement channel
C / NEXT CAPABILITY
Give us context. Get back a working candidate.
With written scope, source, architecture, critical journeys, and an owner-approved preview, Vuln Runner can attach the patch, tests, visual parity, rollback plan, and production retest.
PUBLIC BASELINE→OWNER CONTEXT→PROVEN FIX
START WITH SCOPE
Bring one surface.
Leave with proof.
Start with one authorized surface and a representative journey. Vuln Runner returns inspectable evidence, an owner-ready change, and a before/after record that refuses to hide regressions or limitations.
Start with a local CBOM