Q Services

Scan webpages or text for prompt injection, secret exfiltration, hidden instructions and Unicode control characters.

Statically gate agent-generated regular expressions for nested repetition, unsafe backtracking, excessive complexity and forbidden features.

Find RSS, Atom and JSON Feed URLs from websites using HTML discovery tags and common feed paths.

Track SaaS pricing pages with persistent snapshots, extracted prices/plans, and added or removed pricing signals.

Audit public SAML metadata for unsafe endpoints, missing roles, SHA-1, duplicate entity IDs and expired or soon-expiring certificates.

Prioritize SBOM vulnerabilities with OSV, CISA KEV and EPSS for agent remediation workflows.

Check websites for security.txt, extract security contacts, expiry, policy, hiring and compliance fields.

Audit pages for noindex, X-Robots-Tag, canonicals, titles, meta descriptions and H1 signals.

Extract every URL from any website's XML sitemaps. Handles sitemap indexes, robots.txt discovery, URL filtering. Great for SEO audits.

Audit in-toto SLSA provenance for subject digests, builder and build type allowlists, source expectations, timestamps and DSSE envelope presence.

Extract authorship, dates, organization, canonical, license, citations, JSON-LD types and content hashes for AI research agents.

Parse SQL and enforce a deterministic single-statement read-only policy before agent execution.

Check SSL/TLS certificates in bulk and monitor expiry dates, issuers, SANs and validation errors.

Extract schema.org structured data (JSON-LD, Microdata, RDFa) from any URLs. Clean output for SEO audits and AI data pipelines.

Compare and canonicalize JSON, YAML, XML and CSV for compact agent context.

Track terms, privacy and vendor policy changes with persistent hashes, change percentage and added/removed sentences.

Analyze Terraform JSON plans for destructive changes, public exposure, disabled encryption, wildcard IAM and sensitive values before apply.

Detect mixed-script identifiers, bidi and invisible controls, normalization changes and common Greek or Cyrillic homographs before agents create names or addresses.

Smoke-test webhook and callback endpoints with configurable methods, payloads, expected statuses, latency and response hashes.

Generate and verify HMAC webhook signatures with constant-time comparison, GitHub and Stripe formats, timestamp tolerance and no secret disclosure.

Extract forms, fields, constraints, submit actions, links, CSRF and CAPTCHA signals so AI agents can plan web interactions.

Inspect PEM certificates and enforce expiry, hostname, CA, key type, RSA strength and key-usage policy without network access or chain fetching.

Validate XML sitemaps against the protocol: URL/size limits, malformed loc, invalid lastmod dates and more. Follows sitemap indexes.

Normalize public status pages, active incidents, component health and RSS updates for AI operations agents and automations.