$ ls /blog
What we're building, what we got wrong, and where the attack sandbox is headed — straight from the adversarial.sh repo. Every claim here is either recomputed from committed data or labeled as design.
$ cat posts.txt
2026-09-05 — receipts
Our homepage said 312 validated techniques; the committed library had 56. Instead of a quiet fix, we built a claims registry where every marketing number re-derives from committed data at verify time — and a CI gate that blocks deploy when copy and data disagree.
2026-09-05 — keyless
CI security tools die in procurement queues waiting for API keys. Our new
scan --agent mode runs deep triage through the AI coding agent already
on your machine — no keys, no second bill, works offline, and agent silence can
never produce a false pass.
2026-09-05 — replay
Every scan run can now be saved as a recording and replayed by anyone: same
inputs, same engine, byte-identical result — or a machine-checked drift report
naming exactly what changed. With --simulate, attack attempts
execute in an isolated WASM sandbox and the recording carries the executed
traces. Exit 0 means it reproduces, not "trust me."