Agent-C Security

The 8 checks

Eight dimensions. Each one graded 0 to 4, on evidence.

Every Checkup scores the same eight things, the same way. Here's what we look at in each one, and what every level looks like.

  1. 0Absent
  2. 1Ad hoc
  3. 2Basic
  4. 3Managed
  5. 4Robust
  • Security counts double. A 0 or 1 there caps the grade at Fragile.
  • What we can't see is "not assessed", never scored 0.
  • The grade is a maturity level, not a percentage.

Source control & hygiene

Who can change what, and whether you'd know. Everything else builds on it.

What we look at

  • Branch protection and required checks
  • How changes get reviewed and merged
  • Secrets anywhere in your git history
  • Lint and formatting enforced before merge

Anchored to SLSA v1.2 Source track

A read-only repo scan (Spot) shows up to level 2. Verifying the merge gate is enforced (level 3 and up) needs your repo host’s settings (Deep).

What each level looks like

0

AbsentNo version control, or code without a shared history.

1

Ad hocGit on a single branch with large mixed commits; no review or lint.

2

BasicA remote repo, a branch convention, a proper .gitignore, and focused commits. Review is optional.

3

ManagedEvery change goes through a pull request into a protected main branch that no one can bypass, with lint and secret scans required to merge.

4

RobustAdds required review from a second person, code owners, signed commits, and no secrets anywhere in history.

CI/CD

How code gets from a commit to production, and how quickly you can undo a bad release.

What we look at

  • Automated build and test on every change
  • The path through staging to production
  • Deploys gated on passing tests
  • Rollback, and the pipeline kept as code

Spot reads your pipeline configuration, up to level 2. Seeing real runs and deploys (level 3 and up) needs Deep.

What each level looks like

0

AbsentBuilds and deploys are done by hand from a developer's machine.

1

Ad hocA script run by hand; tests are not part of it.

2

BasicCI builds and tests on every push; deploys are partly automated.

3

ManagedBuild, test and deploy run automatically through staging to production, gated on green tests, with a rollback path.

4

RobustContinuous delivery with canary or blue-green releases, automatic rollback on failed health checks, and a preview environment for every pull request.

Infrastructure & environments

Where your app runs, how it's separated, and what's exposed to the internet.

What we look at

  • Separate development, staging and production
  • Infrastructure defined as code
  • How secrets are stored and managed
  • Public exposure: open ports, reachable databases, firewall rules
  • WAF and rate limiting

We credit what your host provides and score only what you control. Spot and Deep infer this from infrastructure-as-code, up to level 3. Verifying the live setup and perimeter (level 4) needs Full.

What each level looks like

0

AbsentA single hand-configured server; databases or admin tools reachable from the internet.

1

Ad hocA production server set up by hand, config and secrets mixed into code, and wide-open network rules.

2

BasicSeparate development, staging and production; secrets in environment variables; the host's built-in protections and no public data stores.

3

ManagedInfrastructure as code, reproducible environments, a secrets manager, least-privilege firewall rules, and WAF and rate limiting turned on.

4

RobustImmutable, automatically provisioned infrastructure, rotated secrets, full network segmentation, DDoS and bot protection, and alerting on anomalies.

Testing

Whether you can change code without breaking something you didn't touch.

What we look at

  • Unit, integration and end-to-end tests
  • Tests running in CI on every change
  • Coverage of the critical paths
  • Tests against real dependencies, not only mocks

Spot sees which tests exist, up to level 2. Seeing them pass in CI (level 3 and up) needs Deep.

What each level looks like

0

AbsentNo automated tests; changes are checked by hand.

1

Ad hocA few tests, run occasionally and not part of CI.

2

BasicUnit tests on the core logic run in CI, with some integration tests.

3

ManagedUnit, integration and some end-to-end tests run on every pull request, covering the critical paths against real dependencies.

4

RobustThe full testing pyramid plus contract, load and security tests in CI, with coverage gates enforced.

Security×2

The first things an attacker probes: logins, inputs, dependencies and secrets.

What we look at

  • Known vulnerabilities in your dependencies
  • Secrets in your code and your git history
  • Authentication and access control
  • Input handling and the OWASP Top 10 basics
  • Security scanning in your CI

Anchored to OWASP ASVS 5.0

A read-only repo scan (Spot) shows up to level 2. Level 3 needs your pipeline (Deep). Level 4 needs the running app (Full).

What each level looks like

0

AbsentNo working login, or credentials exposed in the browser; dependencies with known vulnerabilities.

1

Ad hocLogin and HTTPS are in place; dependency checks and input handling are still manual.

2

BasicHTTPS everywhere, secrets out of the code, dependencies scanned, and access reviewed. The OWASP ASVS Level 1 baseline.

3

ManagedCode, dependency and secret scanning run in CI on every change; access control is tested; security events are logged.

4

RobustAdds scheduled dynamic or penetration testing, threat modeling, and release-blocking security gates. Evidences the controls ASVS Level 2 expects, the bar for apps handling logins, personal data or payments.

Observability

When something breaks, whether you find out first, and whether you can see why.

What we look at

  • Centralized logs
  • Error tracking
  • Uptime monitoring
  • Metrics, dashboards and alerts

Spot sees your logging, error tracking and metrics tooling, up to level 3. Level 4 needs Full, which checks tracing, alerts and SLOs in your cloud; at Deep it can come from your own answers, marked as attested.

What each level looks like

0

AbsentNo logs or metrics collected.

1

Ad hocLogs scattered across machines; no alerts.

2

BasicCentralized logs, error tracking and an uptime check. Many hosting platforms provide this baseline.

3

ManagedStructured logs, key metrics and dashboards, alerts on what users actually feel, and errors tied to releases.

4

RobustLogs, metrics and tracing together, service-level objectives with error budgets, and quiet, actionable alerts linked to runbooks.

Disaster recovery

If you lost your database today, how much you would get back, and how fast.

What we look at

  • Automated backups and retention
  • Restores that have actually been tested
  • Recovery targets: how much data, how much downtime
  • Deploy rollback and a recovery runbook

Backups and procedures can be confirmed with you (Deep). A restore that has actually been tested needs the running system (Full).

What each level looks like

0

AbsentNo backups.

1

Ad hocOccasional manual backups that have never been test-restored.

2

BasicAutomated, scheduled backups with retention, and a written restore procedure.

3

ManagedRestores tested on a schedule, defined recovery targets, deploy rollback, and a runbook.

4

RobustRegular restore drills, tested failover, recovery targets measured and met, and backups protected from ransomware.

Documentation

Whether someone new, or you in six months, can run and safely change the system.

What we look at

  • A README with setup steps that work
  • An architecture overview
  • Records of key decisions
  • Runbooks and API docs

Fully visible from the repo at every tier.

What each level looks like

0

AbsentNothing written down.

1

Ad hocA short README with out-of-date setup steps.

2

BasicA README whose setup steps mostly work, and some inline docs.

3

ManagedAccurate setup, an architecture overview and decision records; a new developer is productive within a day.

4

RobustDocs kept current in CI, runbooks and generated API docs; onboarding is tested on purpose.

Find out if it's safe to ship.

A grade across all 8 dimensions, a fix list in priority order, and a fixed quote before any work begins.

Check my appSee pricing