Attack Surfacedigital twin
Trust boundaries become navigable evidence.
Entrypoints, identities, stores, providers, and privileged transitions stay connected to the findings that depend on them.
Evidence-first AppSec · Apache-2.0
Security findings are claims.SecHelix proves them.
SecHelix is an open-source AppSec Agent Skill for application-security audits in Claude Code, Codex and Copilot. Scanners discover. Agents investigate. It turns every signal into an auditable evidence path, challenges the claim independently, fixes the root cause, and proves the release decision.
- structured hypothesesstable coverage IDs
- 546
- security familiesAUTH → AI/MCP
- 21
- analysis lensesper hypothesis
- 26
- specialist rolesone evidence contract
- 17
- JSON contractsmachine-checkable
- 15
- tool adapterssignals, not verdicts
- 9
canonical fixture / evidence console live ui
SHX-AUTHZ-L02-DEMOSeller boundary omission
A missing seller identity widened the repository query beyond the caller ownership boundary.
VERIFIEDHIGH
- Attacker controlObserved
- ReachabilityObserved
- Boundary failureObserved
- Independent verifierConfirmed
- RegressionPASS
- Release gatePASS
Signals in. Verdicts earned.
SemgrepCodeQLOSVGitleaksTrivyPlaywrightZAPNucleiSARIFSemgrepCodeQLOSVGitleaksTrivyPlaywrightZAPNucleiSARIF
// the standard
A scanner alert is not a vulnerability.A model suspicion is not a vulnerability.Two models agreeing is not independent proof.
Verify before you accuse.One operating model
AppSec that behaves like an investigation, not an alert feed.
Each layer changes the confidence state. Nothing jumps from “scanner said so” to “Critical” without a traceable reason.
Security intelligence surface
See the system the way the verifier sees it.
The interface exposes the security model itself: boundaries, identities, object access, state changes, variants, and evidence provenance.
Authorization Matrixrole × object × action
Broken access control stops being a vague category.
Expected and observed permissions can be compared across identities and object ownership boundaries.
Variant Hunterroot cause → siblings
One bug should teach the review where to look next.
Verified root causes become focused variant searches instead of another broad scan.
Model + Tool Meshmodel-agnostic
Different lanes. One evidence contract.
Models and scanners contribute observations; none can promote their own output to truth.
Release Gatefail closed
The release decision is an artifact, not a mood.
Unknown integrity-critical coverage can never silently become a green check.
Knowledge Graphprovenance first
Research stays attached to definitions, versions, and rights.
Canonical mappings, live research, lesson cards, and source trust are separate from local vulnerability proof.
The Evidence Workbench
A finding is a journey, not a red card.
Follow the exact transition from hypothesis to observed evidence, independent verdict, root-cause repair, regression, and gate decision.
Open the canonical findingEvidence / SHX-AUTHZ-L02-DEMO
VerifiedHigh
Can a seller read listings outside their ownership boundary?
Selected by applicability engine- attacker control
- reachability
- boundary failure
- root cause
Independent verdictVERIFIED
Regression PASS · Release PASS
Truth has a schema
One layer measured. The rest still isn’t.
The blind label suite has a single uncontaminated run — one question per file, one label back. That is not a measurement of the SecHelix workflow: applicability, the independent verifier, remediation, regression proof and the release gate remain NOT_MEASURED.
blind evaluationMEASURED
Signed inputs Reproducible runner Evidence outputs Publish measurement
Open intelligence, governed quality
Extend the security knowledge. Keep the evidence bar.
ProposeGold Pack, adapter, fixture, or researchValidateSchemas, tests, provenance, and safe controlsReviewSecurity and maintainer quality gatesPublishVersioned official capability
Open Agent Skill
Put verification discipline inside the tools you already use.
Install the portable SecHelix skill, authorize the repository or environment, and start from system understanding—not from a pile of alerts.
terminalSecHelix installer
npx skills@latest add omarmohelal/SecHelix --skill sechelix