Q Services

Audit Dockerfiles for root execution, mutable images, embedded secrets, download-to-shell, unsafe permissions, remote ADD and weak package installation patterns.

Audit any domain's email authentication (MX, SPF, DMARC, BIMI, DKIM) and get a deliverability score with actionable issues.

Extract favicons, apple-touch-icons, web manifest, theme-color and brand images from any list of sites. Great for CRM and directory enrichment.

Gate proposed payments using amount, currency, recipient, daily budget, confirmation, memo and independent-approver policies without executing transactions.

Find AWS, Google, GitHub, Stripe, Slack, JWT, private-key and generic secret patterns exposed in HTML or JavaScript.

Audit workflow YAML for unpinned actions, excessive permissions, untrusted interpolation, risky pull_request_target use and self-hosted runners.

Run bounded non-destructive GraphQL probes for reachability, introspection exposure, GET support, CORS mistakes and stack-trace leakage.

Gate agent-generated GraphQL with AST-based depth, field, alias, operation, list-size, mutation and introspection limits before execution.

Audit Cache-Control, validators, Brotli/gzip, Vary and stale directives to reduce latency and CDN bandwidth costs.

Validate agent JSON against JSON Schema and return deterministic repairs as RFC 6902 patches.

Audit Kubernetes workloads for privileged containers, root execution, writable filesystems, missing capability drops, host access and mutable images.

Check websites for llms.txt and llms-full.txt, extract sections and links for AI readiness and GEO audits.

Redact, normalize, fingerprint and group logs or stack traces for agent incident workflows.

Audit remote MCP servers: connectivity, latency, tools/list schemas, duplicate names, descriptions and mutating-tool signals.

Find HTTP resources on HTTPS pages, third-party scripts/styles without SRI, and invalid integrity attributes.

Audit Apple AASA and Android assetlinks.json files for missing apps, certificate fingerprints, relations and deployment mistakes.

Audit package-lock.json files for missing integrity, insecure or non-registry sources, install scripts, duplicate versions and unsupported formats.

Turn OpenAPI 3.x or Swagger operations into agent-ready tool names, input schemas, response schemas, auth and risk metadata.

Gate agent-generated REST requests against OpenAPI operations, required parameters, authentication, scopes, media types, body limits and mutation confirmation.

Audit OpenAPI and Swagger specifications for unsecured operations, unsafe server URLs, weak auth schemes and missing security responses.

Audit OIDC discovery documents and JWKS for issuer mismatches, unsafe endpoints, weak keys, insecure algorithms and missing PKCE.

Gate agent-generated email by recipient and domain policy, external-recipient confirmation, BCC, header injection, attachment and sensitive-content controls.

Check HTML, JavaScript, CSS, image and font weight against configurable performance budgets without a browser.

Scan webpages or text for prompt injection, secret exfiltration, hidden instructions and Unicode control characters.