We ran an agentic security scan against our own website and published the result as something anyone can check.
The scan covered the aunova.ae source at commit 47ddf73, detection stages S1–S9 only, 46 of 51 files, 90.2% coverage. It produced 11 raw candidate findings. 3 survived the tool's own adversarial verification stage. A person read and reproduced all three, and all three were fixed in commit e442cc4 before anything was published: a dev-server setting that disabled Host validation (developer workstation only, never part of the deployed static site), a privacy-request page that asserted an identity check without stating any procedure (closed by publishing the actual procedure, with no backend added), and an empty-string sentinel in our Nostr delivery code that a hostile relay could match to abort one send.
The tool is the Visa Vulnerability Agentic Harness, an open-source agentic SAST pipeline released by Visa under Apache-2.0. Naming it states which program produced the output and nothing more. Visa had no involvement in this scan, in its findings, or in this site.
Read the result modestly. A static marketing site has no accounts, no sessions and no server-side logic, so a short findings list is roughly what the architecture predicts. The claim here is deliberately small. It is not about how good our code is. It is that the audit is checkable rather than asserted: the tool's unmodified output and run manifest, a hash manifest, a signature over that manifest, an OpenTimestamps proof anchoring the hash to Bitcoin, and the three commands to verify each of those yourself. The artifact describes the scanned commit and nothing after it.
Our position elsewhere is that a control is something you can prove ran, not something a document asserts. It seemed fair to apply that to ourselves first, on a target where the stakes are low, before pointing the same pipeline at code where the claim would carry weight.
Security audit, 27 July 2026 · aunova.ae · Aunova Technologies
The full record of the 27 July 2026 automated security scan of the aunova.ae source: what was scanned, how it was run, the three findings and their...
#AppSec #SAST #AIAgents #OpenSource #Transparency #BuildInPublic
