# Paxen Security

> Paxen Security (paxensecurity.com) is an outside-in AI security tester for companies of 5 to 200 people and solo builders. It probes a company's internet footprint every day, the way an AI agent swarm would, and returns a plain-English fix-first list. Built by Epiphani Studios.

## How it works
- Free scan: enter a domain; Paxen reads certificate transparency logs (crt.sh, Cert Spotter fallback) and DNS over HTTPS. The domain's servers receive no requests from a free scan.
- Ownership proof: a DNS TXT record at `_paxen.<domain>` holding `paxen-verify=<token>` (a random 128-bit token), paired with a private claim key held by the claimant. Verified domains get the full outside-in check set (one GET per address, then known sensitive paths) and a daily rerun that re-checks the record first.
- Full check set: exposed files (.env, .git), API routes that answer data without a sign-in while sibling routes require one, keys and webhook addresses in pages and scripts (13 pattern families, reported by pattern name and location), leftover admin and debug pages, workers.dev addresses beside a custom domain, and callback routes that fetch a caller-supplied address and attach a credential (tested with Paxen's own canary address when the owner switches the test on; the canary records only the authorization scheme and length).
- Ranking: Fix today, Fix this week, Tidy up, Good practice. A local model sorts routine findings; GPT and Gemini rank and cross-check each daily list.
- Connectors: Cloudflare, GitHub, Google, 1Password.
- One-click fix: put an address behind Cloudflare Access, turn its workers.dev address off, or remove the record, with an undo.
- Secrets: keys in repos, `.env` files, CI and public pages by pattern name; liveness and scope check; guided rotation into 1Password, Doppler or Cloudflare secrets with the consuming app updated in the same step; key age, owner and SSH key audit.
- Supply chain: pull requests that pin GitHub Actions to commits, images to digests and MCP servers to versions; lockfile and osv-scanner checks; campaign watch within the hour; contributor watch.
- AI agents: inventory of agents, assistants, scheduled tasks and MCP connectors with what each can read, send, pay and delete; least-privilege tokens with expiry; action log; untrusted content marked as data.
- Code review: weekly Semgrep, CodeQL and osv-scanner plus a frontier model on risky paths; fix pull requests written by one model family and reviewed by another.
- Owner's report: one ranked list, a morning email, patch-speed tracker, weekly attacker briefing, evidence pack PDF for insurers and customers.
- API and MCP server: `paxen.fix_first` and `GET /v1/fix-first` for a company's own agents.

## Pages
- [Live demo](https://paxensecurity.com/app/): the Paxen app on sample data
- [Capabilities](https://paxensecurity.com/capabilities): every check, its mechanism and how to verify it
- [Scanner identity](https://paxensecurity.com/scanner): the user agent and what the scanner sends
- [security.txt](https://paxensecurity.com/.well-known/security.txt)