Inventory
Read source files as text, detect frameworks, package managers, config files, and project shape.
Methodology
How A-DAP-T reviews AI application security
A-DAP-T performs a static, evidence-led review of project files to map release risk, weak controls, policy blockers, and fix-first actions before deployment.
Review pipeline
From project files to release decision
The scanner turns project evidence into a release decision. Each step creates an artifact used by the report workspace.
Map surface
Build dependency, API, AppSec, context, capability, and trust-boundary artifacts.
Check controls
Look for visible auth, rate limits, approval gates, audit logs, allowlists, masking, and isolation.
Apply policy
Combine score, hard blockers, and required controls into BLOCK, REVIEW, or ALLOW.
Plan remedy
Turn evidence into a fix-first sequence with expected gate impact and validation steps.
Security surfaces
What gets reviewed
Dependencies
Package hygiene and supply-chain drift.
Missing lockfile · unpinned spec · direct git dependencyAPI Surface
Routes and endpoint controls.
Auth · rate limit · CORS · upload boundaryAppSec Sinks
Risky static code paths.
SSRF · path traversal · command sink · unsafe extractionCapabilities
What the app can actually do.
Tool action · external effect · sensitive dataGuardrails
Whether risky behavior is protected.
Approval · audit · allowlist · masking · isolationPolicy & Remedy
Whether the release can move forward.
Decision · blockers · fix sequence · validationScoring and policy
Score is not the whole decision
A-DAP-T produces a security score, but release status also depends on required controls and hard blockers. A high score can still need review if a critical guardrail is missing.
Score checkRequired controlsHard blockersFinal decision
AI role
AI explains report evidence
- Explain the policy decision
- Summarize release risk
- Prioritize fix-first actions
- Write developer handoff briefs
Boundaries
AI does not invent the verdict
- Does not execute project code
- Does not confirm live exploits
- Does not guarantee production safety
- Does not replace manual review
Limitations
What A-DAP-T does not claim
Static review is not runtime proof
A-DAP-T reads project files and configuration. It does not execute uploaded projects or confirm live exploits.
Missing evidence is not always absence
Some controls may live outside the scanned repository. The report says what was visible in the submitted project.
AI explains, policy decides
The assistant helps interpret report evidence. It does not invent the verdict or replace manual security review.
Ready to review a project?
Start with the built-in demo, then scan your own GitHub repository or ZIP project.