SecAI
Linux Server Security
SecAI is an AI-powered security monitoring platform for Linux servers. A lightweight Rust agent watches file integrity, resource usage, access attempts, and network egress across a customer's server fleet. A three-role AI pipeline -> Specialist -> Validator, QA; correlates raw signals into scored, explainable findings and drafts remediation, and nothing touches a production server without one-click human approval.
SOC 2 examines whether an organization followed its controls over a period, sampled by an auditor. StackAttest tests the software directly: it attempts a real cross-account read, sends real injection payloads, and checks TLS, rate limiting and dependency CVEs. Every control carries the grade of evidence behind it, and it can be re-run any day. It does not cover HR, vendors or governance, so it complements SOC 2 rather than replacing it. See how the two compare.
The controls behind this Passport map to OWASP ASVS 5, NIST SSDF, CWE, OWASP API Security Top 10, WSTG and SLSA.
Investors & buyers: request a due-diligence view
Ask SecAI for a technical due-diligence view of this Passport, remediation liability, control posture with provenance, and the trust timeline. The founder chooses which sections and for how long. No source is ever shared.
Verified capabilities
What StackAttest checked on SecAI, and when. Anything that was not verified is not listed here, so this is a shorter list than the full control posture a due diligence view carries.
Encrypted connections enforced
StackAttest connected to the production endpoint and found traffic served over TLS, with plain HTTP redirected to it.
Verified 28 August 2026 · Evidence grade E4, runtime verified · Control SA-CORE-001
Browser security headers served
The production endpoint returned the security response headers StackAttest checks for, covering transport, framing and content type handling.
Verified 28 August 2026 · Evidence grade E4, runtime verified · Control SA-CORE-002
Authentication controls validated
StackAttest sent a burst of authentication requests and the product throttled them, so credentials cannot be guessed at speed.
Verified 28 August 2026 · Evidence grade E4, runtime verified · Control SA-CORE-003
Tenant isolation tested
StackAttest held two separate accounts and tried to read one account's record from the other. The product refused.
Verified 28 August 2026 · Evidence grade E4, runtime verified · Control SA-CORE-004
Server side input validation confirmed
StackAttest sent malformed and oversized payloads to endpoints that change data, and the product rejected them on the server.
Verified 28 August 2026 · Evidence grade E4, runtime verified · Control SA-CORE-005
Injection safe data access confirmed
StackAttest sent query breaking payloads to reachable endpoints and none returned a database error, so those inputs reach the database as parameters rather than as query text.
Verified 28 August 2026 · Evidence grade E4, runtime verified · Control SA-CORE-006
No credentials found in source
StackAttest scanned the connected repository and the running app, and found no credentials, API keys or signing secrets exposed by either.
Verified 28 August 2026 · Evidence grade E4, runtime verified · Control SA-CORE-007
Error responses withhold internals
StackAttest provoked error responses from the production endpoint and none of them returned a stack trace, a database error or an internal path.
Verified 28 August 2026 · Evidence grade E4, runtime verified · Control SA-CORE-008
Database lookups index backed
StackAttest audited the live database schema and found every foreign key index backed, so lookups and joins on them stay efficient as tables grow.
Verified 28 August 2026 · Evidence grade E4, runtime verified · Control SA-CORE-009
Health checks answer on a running instance
StackAttest started the product and called its health endpoint, and the running instance answered.
Verified 28 August 2026 · Evidence grade E4, runtime verified · Control SA-CORE-011
Dependency vulnerability checks completed
StackAttest resolved the product's dependencies, audited them against a public vulnerability database, and found no known vulnerable packages.
Verified 28 August 2026 · Evidence grade E4, runtime verified · Control SA-CORE-012
Production domain ownership verified
StackAttest issued a challenge value, the owner published it on the domain this product is served from, and StackAttest read it back.
Verified 16 August 2026 · Evidence grade E3, deterministically tested
Reviews
My VPS server was under constant attack and I never knew, I kept asking my devs to improve website performance and they were like website is fully optimized and cached, then I heard of SecAI from a friend. It started block attacks in real time and everything runs smooth since then.