Evidence-backed application security

Turn findings into defensible decisions.

Q² Assure connects every security signal to exact source, independent validation, and a governed path to action. See what the code does, why the weakness matters, what a safe change affects, and where post-quantum migration must begin.

Watch product demos Open the live console

Exact source replay · human-governed AI · scan-scoped PQC readiness

replay: byte-exact ✓

cwe-755 · exception path

Authorization error path fails open

CRITICAL

Detector match

ASSURE-JS-005 · case_001.ts:13

found

Independent replay

evidence c722c49f…dfa087cad411

matched

Adversarial review

no dispositive counter-evidence

survived

Attributable human decision

operator · 2026-08-12 00:36 UTC

confirmed

snapshot snap_eb6f72f7…4ec9266 replay matched

implemented-and-tested product capability groups in the governed registry

permission-mapped API routes across operations, findings, reports, remediation, DAST, GitHub, and AI

557

findings with 557 replay-matched evidence records in the latest bundled scan

demonstrated PQC migration surfaces: key generation, signing, and key exchange

Evidence that survives scrutiny

Every finding carries its proof.

Move from scanner output to an engineering decision without reconstructing what the tool meant. Q² Assure keeps exact source, independent replay, challenge history, impact, and remediation in one review.

01 Open the sourceSee the exact cited bytes in context.
02 Replay the evidenceVerify the frozen file and snippet hashes.
03 Defend the decisionPreserve challenge and human rationale.

Explore the review console

VERIFIED DEMO FINDING

Authorization error path fails open

Critical Confirmed 4V Replay matched

Exact source evidence

segment-11/auth-fail-open/case_001.ts

12} catch {
13return true;
14}

SNIPPET c722c49f…dfa087 · FILE 8b868366…c18c683

ATTACK TRANSITION

Exception becomes access

A failed authorization dependency returns allow, so the protected operation proceeds.

FUNCTIONAL CHANGE

Deny every error path

Authorized behavior stays unchanged; dependency failures become attributable denials.

The validation ladder

The finding is the one
under suspicion.

Every scanner result stands accused of being a false positive, and normally the burden of disproving it lands on you. Here it lands on the finding. Every one of the 554 in the published scan is examined three times — by the rule that will claim only what it can point at, by a validator that re-derives it from the frozen source, and by one whose whole job is to argue against it — and it arrives carrying what all three recorded. That record is the alibi. On fourteen the third examination could settle nothing either way; all fourteen stopped there, waiting on a person, which is the only reason the other 540 count for anything.

1V

Detector match

Performed by a detection rule

A rule matches parsed source and records exactly what it is claiming — the rule ID, the file, and the byte range. Nothing is asserted beyond the match, and a match on its own is never enough to reach you.

22 of the 67 rules fired in the published scan
2V

Independent replay

Performed by a separate validator

What makes it independent is that it does not read the detector’s output. A second component re-derives the finding from a content-addressed snapshot manifest and checks every byte range the finding cites against the frozen source. Mutation or a missing range fails closed rather than passing quietly.

557 of 557 findings matched byte-for-byte
3V

Adversarial review

Performed by a second validator — not a person

A different validator argues against the finding: it looks for source evidence that contradicts the claim, and records what it assumed. A finding passes only where that search returns no dispositive counter-evidence. Where the review has no basis to settle the question, it says so, and the finding stops on this rung — recorded as needing a human and never promoted behind one.

543 passed · 14 held for a human · 0 refuted
4V

Attributable human decision

Performed by a person, and only a person

A named operator decides, and the decision is stored against them with a timestamp. This is a constraint in the schema rather than a convention: a fourth-rung record whose actor is not a human violates a table check and cannot be written at all.

1 finding in this scan carries a 4V decision

No model participates in any verdict. 1V, 2V, and 3V are deterministic code that produces the same answer on the same bytes every time, so every finding's disposition is replayable. The only judgment in the ladder is the human one at 4V, and it is signed. What the product does carry by way of a model, and how far it reaches, is stated in the limits.

Coverage

One proof pipeline,
every analysis family.

Whichever engine produced it, every finding passes through the same 1V–4V ladder before it reaches a reviewer. No engine gets a pass.

JavaScript & TypeScript

AST-based dataflow over the whole file. Request-shaped sources and every function parameter seed the taint set, which propagates through assignments to a fixed point before it reaches a sink.

Python · Go · Java · C#

Tokenized analysis extended with call-graph and taint-to-sink propagation, tiered by proof strength rather than promoted to certainty it hasn’t earned.

Dependencies (SCA)

A sealed advisory snapshot spanning npm, PyPI, Maven, and Go, hash-verified on load and refused if it does not match. License policy classifies every component; nothing is inferred when a license is absent.

Secrets

Bounded-signature detection across your working tree. Matched values are redacted in every output.

Infrastructure as code (IaC)

Policy packs for Terraform, Kubernetes, and CloudFormation — 24 rules, three of which correlate across resources rather than inspecting one block in isolation.

Containers

A seven-rule Dockerfile policy pack — root execution, floating base tags, credential-shaped build arguments, remote scripts piped into a shell, and a cross-stage correlation that catches a build secret copied forward into a shipped layer — analyzed inside the same immutable snapshot as your source. Nothing in a scan reaches a registry: the deny-by-default pull gate is a library no product surface calls.

Dynamic testing (DAST)

Implemented API and console workflow for explicitly authorized targets under a recorded rules-of-engagement record. Host allowlists, safe methods, request budgets, expiry, and a kill switch bound every run; results become first-class findings.

Shipped · authorization gated

Post-quantum readiness

Three shipped detectors identify asymmetric key generation, classical signing, and key exchange in JavaScript and TypeScript. Each result is scan-scoped, replay-backed, mapped to CWE-327, and paired with hybrid migration guidance and source context.

Shipped · demonstrated

Product demonstrations

Ten workflows.
Every claim shown in the product.

Follow a defender from an executive metric to exact source evidence, post-quantum migration, independent replay, human judgment, and governed remediation. Ten caption-free films combine authentic Q² Assure interaction, OpenAI narration, and an original score while keeping the interface, the code, and the resulting decision on screen.

Ten verified product workflows

Every demo uses authentic Q² Assure interaction, OpenAI narration, and an original restrained score. No caption or subtitle track is included.

Demo 01 · 0:54

SAST: From Dataflow to Decision

Authorization fail-open in real TypeScript
Dataflow, reachability, and exact source bytes
Attack path and counter-evidence
Fail-closed remediation with functional tests

Open demo 01 ↗

Demo 02 · 0:55

SCA: Signed Dependency Intelligence

Exact package and version identity
Signed vulnerability advisory snapshot (CVE, GHSA, and OSV)
Published identifiers without invented CVEs
CWE and OWASP remain weakness taxonomies, not advisories

Open demo 02 ↗

Demo 03 · 0:54

Secret Scanning Without Secret Exposure

Provider-shaped credential detection
Redaction and stable fingerprinting
Replayable evidence without raw secret retention
Rotation, removal, and history response

Open demo 03 ↗

Demo 04 · 0:57

IaC: Prevent Privileged Workloads

Privileged Kubernetes workload declared in YAML
Not a Digital Twin or the Dockerfile build container
Effective security impact around the snippet
Least-privilege remediation sequence
Source policy separated from runtime enforcement

Open demo 04 ↗

Demo 05 · 0:50

Containers: Make Runtime Assumptions Visible

Missing non-root boundary in a Dockerfile
Privilege impact tied to exact source
User, ownership, port, and startup checks
Build-time policy bounded from deployed state

Open demo 05 ↗

Demo 06 · 0:52

PQC Readiness: Migrate the System

Complete file role and exact snippet behavior
Prerequisites, affected assets, and business consequence
Validated CWE and OWASP coordinates
Functional impact and verification plan
Mosca urgency calculation is scoped on the capability roadmap

Open demo 06 ↗

Demo 07 · 0:55

Evidence Replay: Prove the Exact Bytes

Parse failures and unsupported surfaces retained
Blocked, stale, unknown, and not-started cells
Owner, reason, and next action
Coverage describes examined surface—not universal safety

Open demo 07 ↗

Demo 08 · 0:49

Finding Assurance: Challenge Before Confirmation

Scan, source, severity, status, replay, and family scope
Shareable URL serializes the investigation
Authorized export uses the same exact query
Visible rows, facets, and export reconcile

Open demo 08 ↗

Demo 09 · 0:53

AI Security Brief: Intelligence Without Authority

Draft, preview, approve or reject, generate, and verify
Attributable rationale at each transition
Expiry, rollback, and rules of engagement
Explicit view-only boundary and zero source mutation

Open demo 09 ↗

Demo 10 · 0:55

Governed Remediation

Policy disposition preserves truth and evidence
Attributable rationale remains in audit history
A new immutable scan receives a fresh decision
Suppression never masquerades as refutation

Open demo 10 ↗

Governed remediation

Fixes are proposed, verified,
then decided by a person.

A fix never lands because a tool felt confident. It moves through an authorized lifecycle where every transition is recorded and reversible.

STEP 01

Authorize

A repository needs an explicit, revocable rules-of-engagement record before any fix can be generated.

STEP 02

Generate

A registered template produces a minimal diff for the matched rule — not a guess.

STEP 03

Verify

The proposal is re-scanned independently, in a sandbox, before anyone is shown a verdict.

STEP 04

Review

An operator sees the diff, the rollback plan, and the verification verdict.

STEP 05

Decide

Approve, reject, or roll back. Every transition is appended to the audit trail.

GUARANTEE No code path in the product writes to a repository. Remediation runs under a revocable rules-of-engagement record and is verified by an independent sandboxed re-scan; your authorized root is read, hashed, and left exactly as it was found.

What this does not do

The limits are
part of the product.

A tool that argues with its own findings should be equally precise about where it stops. Nothing below is buried in a footnote.

A detector defect we have not fixed

Our post-quantum key-generation check does not yet filter by algorithm — it will flag a key that is already post-quantum. That is a known defect with a scoped fix, not a trade-off we chose.

Not a production sandbox

Analysis is static only, and the single process Assure spawns is its own worker, with no shell and a scrubbed environment — not kernel-level isolation. That boundary is a promotion requirement, not a shipped claim.

Not the broadest scanner

Breadth today is 67 rules, and 31 of them are Terraform, Kubernetes, CloudFormation, and Dockerfile policy checks rather than language rules. Six languages are parsed — JavaScript, TypeScript, Python, Go, Java, and C# — where mature AppSec suites document many more. Depth of proof is the trade being made here, deliberately.

Not runtime protection

This reviews source and proves findings. It does not block traffic, patch virtually, or replace a WAAP.

Not everything here is demonstrated

The published corpus exercises TypeScript, Terraform, YAML, Dockerfiles, and JSON. The Python, Go, Java, and C# engines, authorized DAST, the post-quantum checks, and provider-pattern secret matching are real and wired, but they are not exercised by the artifact this page links to.

A model integration with a short reach

Assure ships a model integration, and this is the whole of its reach. An owner can ask a configured provider to explain a finding that has already been decided; the prose renders marked as model-generated and is not part of the finding record. They can also request a one-line fix for a hardcoded-credential finding — that one sends the cited line of source, and the drafted line is shown only if a signal independent of the rule that raised the finding confirms the credential is gone from it. Fail that check and the line is withheld, not displayed with a warning. Every other class of finding is refused outright, because no such independent signal exists for it. Nothing applies a patch, accepting one records a judgement and changes no file, and no shipped detection rule was written with a model.

Market map · competitor material reviewed 20 August 2026

Compare security layers,
not slogans.

This table compares published product scope, not detection accuracy. Assure’s row is audited against package source and marks what the published corpus exercises; competitor entries are vendor-advertised and linked below. The full comparison puts Claude Mythos 5 and OpenAI Codex Security first as the two primary 2026 agentic contenders.

Q² Assure alongside three of the seven platforms compared in full in the layer comparison
Platform	Primary job	Current breadth
Q² AssureAudited against source	Prove whether a source finding is supported by exact evidence	Implemented: JavaScript/TypeScript, Python, Go, Java, and C# SAST; SCA across npm, PyPI, Maven, and Go; secrets; Terraform, Kubernetes, and CloudFormation IaC; and a seven-rule Dockerfile policy pack. Exercised by the published corpus: TypeScript SAST, npm dependency matching, Terraform and Kubernetes policy, and the Dockerfile pack.
GitHub Advanced SecurityOfficial source ↗	Find code, dependency, and secret risk inside GitHub workflows	CodeQL supports ten language families plus dependency and secret workflows
SemgrepOfficial source ↗	Fast developer-first static analysis and supply-chain review	35+ languages, cross-file analysis, dependencies, secrets, triage, and fixes
Indusface AppTranaOfficial source ↗	Test and protect running websites and APIs	Dynamic testing, web/API runtime protection, DDoS and bot defense, and virtual patching

Competitor entries summarize each vendor’s own published material, reviewed 20 August 2026 and transcribed unchanged; they are vendor-advertised, not hands-on verification. CodeQL’s ten language identifiers are enumerated in GitHub’s code-scanning documentation ↗. This section was last reviewed 20 August 2026.

Assure should not currently be presented as a wholesale replacement for Claude Mythos 5, OpenAI Codex Security, GitHub Advanced Security, Semgrep, Snyk, Checkmarx, Veracode, SonarQube, or Indusface AppTrana.

Open the layer comparison

Check it yourself

Judge it the way it judges
a finding — by replaying it.

Three ways to check it, and who each one is open to.

Two minutes · open to anyone