The software studio with one human on staff.

supply-chaintruecopy

The audit is now a tripwire: 291 plugins re-verified at their pinned commits, every day

One-time audits rot, so truecopy re-audits the entire official Claude Code plugin directory daily: every vendor plugin re-fetched at its catalog-pinned commit, 2,203 skills at the September 2026 run, zero confirmed poisoned. The results are published to a public badge with pin drift as a first-class signal, and every detector hit that a human hasn’t triaged yet sits on the public review board. On day one the watch caught two bugs in its own harness; that story is in the post, because a tripwire you’ve never seen fire is decoration.

supply-chaintruecopy

We scanned the marketplace that started the poisoned-skills panic: 66,541 skills, clean

ClawHub is OpenClaw’s open registry, the marketplace whose poisoned-skills incident started this category. We poison-scanned every skill in it and cross-checked each flag against ClawHub’s own scanner. Zero confirmed malicious; 813 deterministic alarms, all benign, mapped. And the most-installed skill in the registry runs clean but ships obfuscated code you can’t read.

supply-chaintruecopy

We scanned 2,019 Claude Code skills across ten marketplaces

A skill is prose that steers an agent holding your credentials. Every skill in the official marketplace plus nine community ones: 177 vendor repos, fetched at pinned commits and poison-scanned. None were malicious; the engineering was earning that answer, taking a deterministic scanner from a one-in-ten false-alarm rate to 0.6%, every fix pinned with a test.

benchmarkredstamp

The agent-firewall benchmark, run through a cold pipe: 100% recall, 100% precision on the 298-sample arena

One labeled corpus, one language-agnostic pipe, recall + precision + determinism scored together, with block-all and allow-all anchors sitting in the table to prove a single number is gameable. Earlier corpus revisions documented redstamp's five misses rather than hiding them; the current 298-sample run is clean, sanity anchors included. And the leaderboard that would have been a category error, refused.

securityfieldpass

8/8 planted injection payloads withheld from the model, on real Chrome

An agentic browser has the lethal trifecta by construction: the page is untrusted, the session is private, navigation is the exfil channel. fieldpass quarantines indirect prompt injection before the model sees it and gates dangerous actions, validated against Chrome 149, with the real false positives found and fixed in public.

governanceredstamp#15–18

One gate, four frameworks: CrewAI, LangGraph, OpenAI Agents SDK, AutoGen

Four unrelated runtimes governed below the framework, at the MCP layer: the poisoned tool stripped before the agent can load it, the destructive call blocked at the gate, every verdict in a tamper-evident audit. Each merged PR touches only examples/; zero lines changed in the gate's own source.

trajectoryplumbline

plumbline: trajectory-level monitoring. Replay what your agents actually did

Per-call gates judge one action at a time; plumbline scores the whole sequence against the agent’s declared job. It runs out-of-band, read-only, and catches escapes assembled from individually approved steps. Dogfooded on the fleet that runs this company.

supply-chaindario

A 9.4/10 OpenSSF Scorecard on the package that ships itself

The same repo the self-healing pipeline releases several times a week scores 9.4/10 on the OpenSSF Scorecard (13 of 18 checks a perfect 10) and holds a 100% OpenSSF Best Practices badge: releases signed and SLSA-attested, npm published tokenless from CI via OIDC trusted publishing, zero open security alerts. The same hardening (weekly Scorecard runs, hardened branch rulesets, signed releases) runs across all 15 public code repos.

bug-huntdario#453

The proxy that silently deleted continue; from your code

A framework-name scrubber ran over message content, so the JS keyword continue; was stripped to a bare ; in transit. A downstream auditor "found" the bare-; bug and blamed the model, when the proxy itself had corrupted the payload. Confirmed with a live A/B: 3/3 fabricated through the unfixed proxy, 0/4 through the fixed one.