A prompt can look harmless. The tool, API or data path behind it may not be.
HAIEC helps uncover source-visible security risks across agents, prompts, RAG, MCP tools, identities and downstream services. Explore findings first, then connect the relevant authority and runtime evidence to a defensible decision.
Explanatory diagram. No customer source, live threat or runtime effect is being analyzed on this page.
Choose the workflow that fits your team. HAIEC supports authenticated source analysis, GitHub App repository connections and source uploads. Local developer packages are a separate path.
Authorize only the repositories you select. Connect a verified repository to an AI System for scoped remote scanning and Assurance. GitHub App credentials are issued server-side.
Explore GitHub App setup →Analyze an authorized GitHub repository or supported source archive. Review file scope, findings and coverage through the HAIEC dashboard.
Start a source scan →Run separately scoped static checks locally or through a compatible coding agent. Inspect findings and coverage without using the hosted scan engine.
Explore AI AppSec →Install the HAIEC GitHub App and grant access only to repositories you choose. No personal access token needs to be provided to HAIEC.
Select a source scenario to understand how HAIEC can expose security-relevant code patterns, where a source path may lead and what still needs independent evidence.
Instructional cases grounded in the supported analysis model
An AI agent reads retrieved content while its source exposes a route toward a customer-record export tool. The combination creates a relevant review question.
const context = await retrieveDocuments(query)const decision = await agent.respond(context)const tools = registerTools([exportCustomerRecords])await dispatchTool(decision.tool, decision.args)Source relationships may show a tool registration and dispatch path that deserves authorization review.
A sensitive tool route in code does not establish that customer records were accessed or exported.
Each evidence plane answers a different question. Select one to see what it can establish for the chosen source scenario. No missing plane is automatically a failure or a pass.
Supported source findings, bindings and reachability can show code-capable operations or security-relevant patterns, including uncertainty. Source relationships are not necessarily full reachable action proof.
Explore how supported static evidence, local tools and authorized runtime observations contribute to different security questions. Each family has its own boundaries.
Untrusted prompts and instructions may steer model-driven workflows toward unintended actions or content.
Prompt construction, context interpolation, trust-boundary and validation patterns in supported source.
Supported prompt injection, jailbreak or role-confusion tests only where eligible and actually executed.
Explore a source finding summary, review what was analyzed and identify the next question. A real HAIEC scan binds results to an actual run, source revision, scope and producer metadata.
Source testing, runtime testing and HAIEC Assurance make different claims. Use each where it creates evidence for your actual security or operational decision.
Identify supported source risks, candidate agent actions and configuration exposures without executing the target application.
Analyze source →Exercise eligible test categories on a permitted endpoint, then inspect actual response evidence, held scope and findings.
Explore runtime lab →Evaluate qualified source, authority, runtime and control evidence for bounded conclusions and accountable decisions.
Explore Assurance →Get hands-on with the tools and learning resources that extend HAIEC's core application-security experience.
Local static analysis for supported AI application and agent code, including source-linked findings and coverage.
Explore local scanner →Examine source-level patterns that may expose cross-tenant context or shared resources.
Explore MCP checks →Run separately scoped local model input/output checks. Its results are not automatically a platform assurance verdict.
Explore LLMVerify →Practice tracing adversarial agent behavior to security exposure and potential business effects.
Explore the atlas →Choose the right source, connection and proof for specific AI assurance questions.
Open field guide →See how applicable control objectives, source coverage, delegated authority and evidence support assessment.
Explore assurance controls →No. Source inspection can reveal supported paths and risks. An actual invocation or downstream effect needs separately qualified observation or target evidence.
No. Installing and scoping the App grants access to selected repositories. Pull-request analysis and full remote Assurance are distinct workflows with their own configuration and initiation conditions.
Yes. Authenticated source analysis supports other authorized repository and upload workflows. AI AppSec is also available as an independent local developer package.
Static source findings address code patterns and possible action paths. Authorized runtime testing observes endpoint responses under admitted tests. Neither automatically establishes the other.
No. It can organize relevant technical evidence for control reviews. Certification, legal compliance and operating effectiveness have separate requirements.
HAIEC distinguishes findings from coverage and limitations. Unanalyzed paths and missing sources do not become evidence that the system is safe.
Source code is handled transiently for authorized analysis. HAIEC retains scan findings, coverage, metadata and evidence artifacts; raw source is not retained as a customer evidence record after the scan completes.
Start with a source scan, connect the repositories you own or explore a focused enterprise assurance engagement. Follow the evidence to the consequential decisions that matter.