Human-designed security, amplified by AI
We built our own in-house platform of AI agents. It reviews, tests, and monitors the code we ship, with multiple models that cross-check one another. Sensitive decisions, however, remain in human hands.
Online payment: new checkout flow
Pull request · 6 checks
Developer agent
Code written and tested in an isolated environment
AI reviewer, other model family
2 issues flagged and fixed immediately
Cross-check by another model
Alerts refuted by the code are discarded, with supporting evidence.
Security tests on the running application
Authentication, access rights, exposed data
Continuous integration
Tests, type checking and static analysis are all green
Reviewed by an engineer
The final decision is made by a human.
Our agent platform, built in-house
We didn't connect a chatbot to our code. For our own teams, we built a system where each agent has a role, limited permissions, and a controller.
- isolated environment started
- repository cloned, limited access
- tests and type checks passing
- secrets masked in logs
Isolated agents
Our agents operate in isolated, ephemeral development environments, with only the access required for the project.
Review verdict
Multiple models, a single verdict
Code written by one model is reviewed by a model from a different family, then another model cross-checks alerts to rule out those the code itself disproves. Fewer blind spots, fewer false positives.
Write to production database
Requested by an agent · pending
UPDATE orders SET status = 'refunded' WHERE id = …
Humans stay in control
Writing to the production database, adding a secret, sending messages externally: sensitive actions are paused and require approval from a team member, who can approve or reject them.
Multiple families of models that review one another
We choose the best model for each task, and a model from a different family to review it. No model has the final word — our engineers do.
Three rules we won't compromise on
They apply to both our internal tools and the applications we develop for you.
Least privilege
Each agent and each participant has access only to what they need for the duration of their task.
Secrets kept out of the conversation
A secret is entered by a human into a hidden form, stored encrypted, and injected at runtime. It never passes through the AI conversation and remains masked in the logs.
Every correction becomes a rule
When an engineer corrects a review, that lesson is recorded and applied by subsequent AI reviewers. The system improves with each project.
From brief to production, every step is monitored
Here's the path each change takes, from the first line of code to going live.
Scoping
We identify sensitive data, necessary access, and the constraints specific to your industry right from the start.
Isolated development
Code is written and tested in ephemeral, isolated environments on development databases. Production data is accessed read-only solely to diagnose a problem.
Cross-review
Each pull request is reviewed by an AI reviewer from a different model family than its author, then undergoes continuous integration: tests, type checking, and static analysis.
Pre-release swarm testing
Before a major production release, a team of agents maps the attack surface and checks every point of the running application. Each blocking vulnerability triggers its own remediation.
Manual approval
Sensitive operations, such as writing to the production database or adding a secret, require explicit approval from a team member.
Continuous monitoring
Scheduled vulnerability scans regularly re-scan the codebase. Alerts are de-duplicated, triaged by a human, then fixed via a pull request.
AI handles the volume, humans make the decisions
AI-assisted security is not security entrusted to AI. Each does what it does best.
What our agents do
- Review each pull request, line by line
- Re-run security tests before every major release
- Monitor code continuously, even at night
- Suggest a tested fix for every vulnerability
What Our Engineers Decide
- The scope and access of each project
- Alert triage and prioritization
- Approval of sensitive actions
- The rules that agents must follow
What this means for you
Security that’s visible in the project’s day-to-day work, not just in a document.
Enhanced security audit
Our agents comb through your application: authentication, access rights, exposed data, and secrets management. An engineer validates each item before delivering a prioritized report.
Fixes, not just alerts
A detected vulnerability becomes a tested and reviewed pull request, ready to be deployed.
Complete traceability
Every change is linked to a pull request, a review, and an auditable history. You know who changed what and why.
Unsure about your application's security?
Let's talk: we'll review your situation and tell you where to start.
We wanted security that doesn't depend on any one person's vigilance or on a single model. Our agents review everything; our engineers decide. Have a question about how we protect your data? Write to us.
Michel Moccand
Founder, CTO & Head of Security
Report a vulnerability
Think you’ve found a vulnerability on one of our websites or apps we operate? Contact us: every report is read and handled by the security team.
security@impulselab.aiHow to submit a useful report
- Describe the vulnerability and its potential impact.
- Provide steps to reproduce it.
- Do not access or modify other users’ data.
- Allow us time to fix it before any public disclosure.
We acknowledge receipt of every report and will keep you informed until it’s fixed.