Axiom Guard

Axiom Guard scans a website you own for security exposure and hands you a graded, remediation-ready report. Exposed API keys, missing security headers, DOM XSS, insecure cookies, source maps left in production — each finding carries a CVSS v4.0 score, a CWE reference, and the specific fix.

What It Checks

33 checks, in three classes:

  • Class A — Critical (5 checks) — exposed secrets, API keys, database credentials, JWT tokens
  • Class B — Serious (12 checks) — missing CSP, missing HSTS, clickjacking exposure, DOM XSS, insecure cookies
  • Class C — Informational (16 checks) — server disclosure, deprecated headers, sensitive comments

Plus 44 sensitive file-path probes (exposed .env files, backups, admin panels, version-control directories).

Not an AI Hacker — and That’s the Point

Guard is a deterministic rule engine. It does not use an LLM to decide what’s wrong with your site, and it never exploits anything.

Offensive AI-agent pentesters try to break in and prove a vulnerability with a working exploit. Guard checks that the doors are locked. Those are different jobs, and if you need the first one, we’ll tell you so.

Deterministic buys you three things:

  • Reproducible. Same site, same grade, every time. We keep a fixed corpus of 17 real sites and re-scan all of them whenever a check changes, so we can show that a fix improved the result and broke nothing.
  • Cheap to repeat. No AI tokens per scan, so continuous re-scanning doesn’t come with a bill that grows with it.
  • No hallucinated findings. Every result maps to a concrete rule you can look up.

You verify you own the domain — by DNS record or meta tag — before Guard will scan it. We don’t scan sites you don’t own, and we don’t run destructive checks against production. This is a hard constraint in the product, not a policy page.

Status

Built, tested, and running — not yet open for signup.

The scanner is complete and deployed on our own hardware, and we’ve used it to produce real audit reports. What’s missing is company setup, not code: we’re finishing the business and payment side before we take anyone’s money. Pricing isn’t published yet — we’d rather show you nothing than quote a price we can’t honour.

If you want to be told when it opens, email us.

Built under the 10 Immutable Rules.