# Cyber security

_A gate, not an afterthought_

- Built in: Review gate on every PR
- Focus: Code & agent harness

Static analysis, dependency audits and a human review on every pull request, plus a permissions review of any agent in the loop.

Security that lives in the pipeline gets done. Security that lives in a quarterly audit gets postponed. We put it in the pipeline.

## What you're aiming for

- No pull request shipping without a human and the tools looking at it.
- Dependencies you actually know about.
- Agents that can't reach further than they should.
- A report your team can act on, not a scanner dump.

## What we review

- Static analysis on every pull request, findings triaged by a person.
- Dependency and supply-chain audit.
- Agent permissions: what tools it can call, where secrets live, where prompt injection could enter.
- Access and secrets handling across the deployment.

## What we've shipped this way

Every line Pilot ships to our own repositories passes this gate first. Our open-source Auth Service on GitHub is one piece of that stack you can read yourself.

## How to start

From you: repo access, the deployment picture, and any agent already in the loop.

From us: the review, the report, and the pipeline gates if you want them kept.


---

Hire us: hello@quantflow.studio · https://quantflow.studio/#contact