ProofStackNVIDIA MODEL
Sign in
NVIDIA Nemotron 70B · Compiler & Test Verified Gates

Security findings backed by evidence.
Fixes verified by compiler gates and live tests.

ProofStack identifies security flaws, proves them with live container probes, and synthesizes scoped patches using NVIDIA Nemotron. Before anything merges, 8 deterministic compiler, linter, and test gates verify that the vulnerability is gone and existing code still works.

Open Remediation Cockpit
12 CWE Container Probes8 Compiler & Test GatesSigned Audit LedgerIsolated Container Sandboxes
proofstack-cockpit.local/continuous-verification-feed
Ephemeral Pod: ReadyOpen in Full Cockpit
Posture & Health8/8 PASS
Deterministic Gate Pass Rate
100.0%
Compiler, linter & test gates verified
Active Severity Triage
Critical (CVSS > 8.5)3
High (CVSS 7.0–8.4)4
Remediated & Sealed8
System Invariants
AST Syntax Invariant
Dynamic DAST Assertion
HMAC-SHA256 Merkle Chain
Chain Root: 88a29b...142f9b
Findings Explorer4 Active
CWE-639 · 9.1TASK-9142
SEALED
Broken Object-Level Auth (IDOR) in Workspace Billing
backend/api/workspaces.py:84-89rules.python.tenant_isolation
CWE-89 · 8.4TASK-8201
SEALED
SQL Injection in Audit Log Filter Parsing
backend/db/queries.py:112-115rules.sql.parameterized_queries
CWE-918 · 8.9TASK-7419
SEALED
Server-Side Request Forgery via Outbound Webhook
backend/webhooks/fetcher.py:45-51rules.network.dns_rebinding_guard
CWE-400 · 7.8TASK-6102
SEALED
ReDoS Catastrophic Backtracking in Slug Parser
backend/utils/slug.py:14-17rules.regex.linear_time_ast
Evidence & RemediationNemotron 70B
EXPLOIT PROBE ORACLE
Active DAST probe: GET /api/v1/workspaces/ws_org_victim_8819/billing succeeded with tenant_4401 token (HTTP 200). Post-remediation: HTTP 403 Forbidden.
SYNTHESIZED AST DIFF100% Gated
-86 return serialize_billing(workspace.billing_profile) # No tenant check
+86 if workspace.tenant_id != session.tenant_id and not session.is_super_admin:
+87 audit_log.record_violation(session.user_id, 'IDOR_ATTEMPT', workspace_id)
+88 raise HTTPException(status_code=403, detail='Tenant mismatch')
+89 return serialize_billing(workspace.billing_profile)
AST Syntax Pass
Linter Clean
DAST Replay Pass
Merkle Chained
Core Capabilities · Architectural Breakdown

Engineered for verification, not speculation.

Static analysis tools often produce high rates of false positives. ProofStack confirms vulnerabilities by replaying dynamic exploit probes in isolated containers and verifying fixes against deterministic compiler gates before merging.

Live Exploit Testing

12-Vector Dynamic DAST Probing

Before proposing a fix, ProofStack dispatches exploit payloads against ephemeral container targets to confirm the vulnerability is actively reachable.

Ephemeral Probing Sandbox · IDOR / BOLA Authorization Bypass
curl -i -X GET https://sandbox.proofstack.internal/api/v1/workspaces/ws_org_victim_8819/billing \
  -H 'Authorization: Bearer attacker_token_tenant_4401' \
  -H 'X-ProofStack-Probe: CWE-639-ACTIVE'
[BASELINE: EXPLOITED][REMEDIATED: 403 FORBIDDEN]
HTTP/1.1 403 Forbidden
Content-Type: application/json

{
  "error": "Tenant authorization mismatch",
  "audit_ref": "SEAL-SHA256-88a29b",
  "violation": "IDOR_ATTEMPT_RECORDED"
}
Launch Full DAST Sandbox
Compiler & Test Verification

8-Gate Deterministic Interlock

Generative models propose candidate patches, but deterministic gates decide. Every proposed diff must pass AST syntax compilation, Ruff linting, negative exploit replays, and unit test suites.

Gate 1: AST Syntax Validator
Python 3.12 grammar compile
12ms
Gate 2: Ruff Strict Style Checker
Zero formatting regressions
24ms
Gate 3: Negative DAST Replay
Original exploit fails cleanly
110ms
Gate 4: Pytest Unit Regression Suite
100% test cases pass
240ms
Gate 5: HMAC-SHA256 Merkle Seal
Signed block appended
6ms
Tamper-Evident History

Cryptographic Evidence Ledger (HMAC-SHA256)

Every verification verdict and patch diff is hashed into an append-only ledger. Any retroactive tampering invalidates downstream block hashes and flags the change immediately.

Verify Ledger Audit Trail
Remediation Workflow · Step-by-Step

From vulnerability alert to verified pull request.

An end-to-end pipeline designed to reproduce vulnerabilities, synthesize targeted fixes, and verify code safety deterministically.

01
01

Taint & Alert Ingestion

AST parsers map control flow graphs to identify vulnerable taint sinks from incoming SAST alerts.

AST PARSER
sink: cursor.execute(query)
type: TaintSink.SQL_RAW
02
02

Dynamic Exploit Probe

Replays targeted HTTP probes against isolated test containers to verify exploitability.

PROBE PAYLOAD
curl -i GET /workspaces/8819 \
  -H 'X-Probe: IDOR-TEST'
03
03

Constrained Patch Synthesis

NVIDIA Nemotron generates scoped candidate diffs restricted to the affected statement.

AST DIFF ENGINE
+ if tenant != session.tenant:
+     raise Forbidden(403)
04
04

Deterministic Gate Verification

Runs compiler checks, linter rules, negative exploit replays, and signs the verification ledger.

LEDGER SEAL
SEAL-SHA256-c77a9142
VERDICT: 8/8 PASS
Frequently Asked Questions

Frequently Asked Questions

Technical answers on how deterministic verification, containerized DAST probes, and audit logging work.

ProofStack is a security verification platform designed to remediate code vulnerabilities with evidence. It uses NVIDIA Nemotron to generate candidate repairs, and subjects every candidate to deterministic compiler gates, linter rules, and containerized exploit tests before creating a pull request.
Generative models only propose fixes; deterministic tools decide whether code is accepted. Each candidate patch is compiled, checked for style regressions with Ruff, re-tested against the original exploit payload in an isolated container, and verified against unit test suites. If any check fails, the patch is rejected.
The platform includes dynamic DAST exploit probes for 12 common CWE vectors, including SQL injection (CWE-89), IDOR/broken object-level authorization (CWE-639), path traversal (CWE-22), SSRF (CWE-918), and hardcoded credentials (CWE-798).
Every test run, container probe result, and accepted patch diff is hashed and recorded with HMAC-SHA256 signatures in an append-only audit trail. This provides auditors with a verifiable record of why a fix was accepted and proves that the evidence has not been modified after the fact.
You can inspect findings and diffs directly in the Remediation Cockpit or sign in using pre-configured evaluation personas (Developer, Auditor, Admin, Super Admin) to test role-based access control and live features without manual setup.
Deterministic Compiler GateZero LLM Commits PolicyHMAC-SHA256 Merkle Provenance

Ready to inspect verified security evidence?

Launch the remediation cockpit to inspect real findings, run containerized DAST reproductions, or sign in with any of the 4 pre-configured evaluation personas.