About
The security engineer small teams can’t hire.
Most software companies with fewer than a couple of hundred engineers don’t have a security team. They have Dependabot, a growing pile of alerts, and an engineer who looks at them when something sounds bad. We’re building what should be doing that job.
Our own App goes first
Our first design partner is our own Laravel business. Every Verdict format, every Advisory profile and every Upgrade pull request runs against our code before it runs against yours. The league/commonmark story on the home page is from that first run: twelve open Advisories for one package, and the first one settled as Not affected, with evidence.
Why Advisories first
Dependency Advisories are the security problem every team feels every day, and the one where most of the work is deciding what doesn’t matter. It’s also where evidence is most checkable: a function is called or it isn’t. Starting here lets us earn trust with Verdicts you can verify in a minute, before we take on harder problems like logic flaws in your own code.
Who’s building it
agentprime is led by Craig Hewitt. Craig founded Castos, a bootstrapped B2B SaaS he grew to multi-seven-figure ARR, after a career in sales and operations at Fortune 500 companies.
How we work
Four things we hold ourselves to.
- 01
Evidence over claims
Everything we say about your App comes with a file and a line. We never call anything a Vulnerability without proof.
- 02
Calm
The point is that you worry less. No red alerts, no countdowns. A weekly digest, and an interruption only when it’s warranted.
- 03
Honest about limits
When we can’t tell, we say Inconclusive and explain why. What we couldn’t determine is as useful to you as what we could.
- 04
A person merges
We open pull requests. Your team decides what goes into your code.