About AISG

What AISG Is.

One pipeline, two halves. A small worker on your computer runs 23 open-source security sensors; the cloud orchestrates the run, scores the results, and builds the report. That covers secrets in code, vulnerable dependencies, static analysis findings, infrastructure checks, URL assessment, and — for applications that use LLMs — red-team sensors that probe prompt injection, jailbreak resistance, and prompt leakage.

Everything is grounded in the same principle: your code never leaves your machine. Only findings metadata (sensor, rule, title, file and line, severity) is uploaded. File contents, configuration values, and API keys are not.

What AISG Is Not.

We would rather lose a sale than mislead you. AISG is not a penetration test, and it does not replace a security professional. Specifically:

• Results are indicative, not proof. Findings show patterns worth examining; they do not prove a vulnerability is exploitable in your environment.
• No active exploitation. Destructive and intrusive tooling (for example SQL injection automation and port scanning) is deliberately excluded from the service.
• No server-side authorization testing. AISG cannot verify whether your production database permissions are correct. If you use Supabase, Firebase, or a similar platform, check their built-in permission advisors first — that is the right tool for that job.
• Business logic is out of scope. Whether your pricing rule or approval flow can be abused is a human judgement call, not a scanner output.
• Human review is required. Every report is a starting point for a person who knows the system being assessed.

Contact & Updates.

Support and questions: support@aisg.web.id — product announcements and security notes are published on our LinkedIn page. Technical write-ups, including the honest limits of automated scanning, live on the AISG blog.

Scanning a target is allowed only when you own it or have explicit written permission from its owner. See Terms and Trust & Legal.