The runtime writes its own audit trail as it works.
SecHive is a local-first research workbench: scope policy, recon, skill routing, hypothesis planning, runtime validation, proof packaging, and human-reviewed reporting composed as one operator-controlled pipeline.
Seven stages. Every artifact hashed.
Each stage emits artifacts. Artifacts are hashed. Hashes are bound to the proof pack. Nothing in the report is reachable without an artifact behind it.
Scope enforcement
Authorization document loaded before any active probe. scope_guard hard-blocks out-of-scope action at the skill level — not just at the UI.
Negative evidence
Refutations are first-class artifacts. When a hypothesis fails, the failure is recorded and retained in the proof pack rather than discarded. This preserves useful negative evidence for review.
Deterministic replay
Every promoted finding ships with a replay.sh bound to the same artifact hashes. A reviewer can reproduce the finding on any lab that matches the target configuration.
Specialist skills, not one prompt.
SecHive routes signals into focused agents. A nonce in a signed payload should not be reasoned about by the same skill that handles JavaScript route inventory.
- SK.01recon_routerInventory of routes, APIs, JavaScript bundles, sitemaps and link graphs.core
- SK.02bizlogic_hunterBusiness logic invariants, replay, race, sequence and value-state mismatches.core
- SK.03api_securityAuthentication, authorization, IDOR, mass-assignment, OpenAPI deviation.core
- SK.04validation_bypassDenylist gaps, finality downgrade, controller revocation, policy boundary skew.core
- SK.05cross_domain_logicAsset rebind, forwarding mismatch, cross-domain auth confusion.core
- SK.06poc_validatorBenign-PoC execution under scope guard. Emits replay artifacts.core
- SK.07apk_inspectorExported components, broadcast paths, binder surfaces, signature trust.core
- SK.08re_triageBinary triage, anti-tamper, protocol field reasoning, negative-evidence keeping.core
- SK.09scope_guardPre-flight scope and policy enforcement. Hard-blocks out-of-scope action.enforcement
- SK.10report_rendererMode-specific report generation with redaction manifest and provenance.core
Two parallel outputs, always.
The human-readable report for the reviewer and the machine-readable proof pack for downstream systems. One is not a derivative of the other — they are emitted by the same pipeline stage.
Report
Mode-specific Markdown + HTML render. Executive summary, findings table, severity histogram, evidence excerpts, remediation guidance, redaction status.
Proof Pack
JSON manifest with provenance, sha256 artifact index, replay scripts, reviewer disposition, and model-cost accounting.
Mission control, on your machine.
SecHive is local-first. The operator UI shows running campaigns, hypothesis graphs, evidence drawers, replay buttons, runtime health and approval queues — all served from the same machine that holds your scope.