It finds the vulnerabilities. Then it tries to disprove them.
Yempik Security Audit has AI agents read your code and look for the places where a boundary actually breaks. Every problem goes to a second agent that did not find it and tries to take it apart; only what holds up reaches the report. It also checks the AI supply chain, the way October’s attacks came in, and ends with one page for the people who decide.
Verdict
Two confirmed problems, one serious. The review covers all the code examined; the cloud infrastructure is out of scope.
What is exposed
- SERIOUSAnyone who receives a share link can open other customers’ documents by changing a number in the address.
- MODERATEThe AI service key ships in the code the browser downloads: any visitor can use it on the company’s bill.
Three questions for your team
- When will access to shared documents be closed, and who checks it afterwards?
- Has the AI service key already been replaced?
- Who approves the coding-agent configuration that enters the repository?
Six steps. One of them exists to disprove the others.
The audit does not list everything that could go wrong. It looks for the places where someone can do what they should not, and keeps them only if they survive someone trying to take them apart.
- 1
Map
Who can do what: users, services, keys, trust boundaries. This becomes the ledger of what must be checked.
- 2
Hunt
Several agents, each holding part of the ledger, look for where a boundary actually breaks.
- 3
Disprove
Each problem goes to a fresh agent that did not find it and tries to take it apart. If it does not hold, it is out.
- 4
Record
What remains becomes a structured record, checked by two automatic validators.
- 5
Second read
More agents reread every cited line in the current code before the report is written.
- 6
Report
The detail for the people who fix, and one page for the people who decide.
You decide
What to fix, by when, and who checks it. The audit never changes the code.
October came in through the tools, not the front door.
This month’s attacks did not break a firewall. They came through an AI library, npm packages and coding-agent configuration. That is the part this audit checks on top.
AI service keys and LLM gateways
Where the keys end up, who can read them, how many a single gateway holds.
A compromised release of LiteLLM, the gateway many companies use to reach AI models, stayed on PyPI for about two hours: Wiz counts about 49,000 downloads, and it stole cloud credentials and AI keys. LiteLLM
Coding-agent configuration
Files such as .claude/settings.json, .mcp.json, .vscode/tasks.json: what they run, and who can change them.
The malware in the tensorlake npm package wrote Claude Code and VS Code configuration into every repository it could reach, so it ran again whenever the project was opened. StepSecurity
MCP servers and unpinned packages
Servers launched with versions that change on their own, holding more permissions than they need.
An npm publishing flaw went public: more than 1,500 packages could be published by anyone who re-registered the name of an abandoned repository. Help Net Security
Code that runs before the application
Install scripts and start-up files that execute where the keys already are.
The LiteLLM malware lived in files Python runs at every start, before any application, and also took Claude, Codex, Cursor and Copilot sessions. Datadog Security Labs
What you get.
Five files, written only after the second read. Each one has a reader.
- EXECUTIVE-SUMMARY.md
Executive summary
One page: verdict, what is exposed, three questions for the team, what was left out.
Management - REPORT.md
Technical report
Confirmed problems with severity, the path through the code and the smallest fix that works.
Technical team - FINDINGS-DETAIL.md
Reproducible detail
For every moderate or worse problem, how to reproduce it locally on dummy data.
The fixers - NEEDS-VALIDATION.md
To be checked
What the code alone cannot tell, and who must check it: cloud provider, IT, tooling.
IT and suppliers - findings.json
Ledger
Every record in a validated format. The next run starts from here and covers more.
Next audit
What it does not do.
- It does not touch the code.
- It reads, read-only, and describes the fixes. You make them, or whoever maintains the software does.
- It does not attack real systems.
- No tests against servers, accounts or production services. A fact the code cannot show goes on the to-be-checked list.
- It is not a penetration test.
- It checks the code and the AI supply chain around it. The network, physical access and people stay out of scope.
- One pass is not enough.
- Each run starts from the previous one and covers more. Run it again after every material change.
Installed in a minute.
You need a coding agent that works with sub-agents, such as Claude Code, and Node.js. The skill is public and free: you can read every line before you run it.
- Claude Code or an agent with sub-agents
- Node.js for the validators
- Profiles: quick, standard, deep
npx skills add yempik-ai/yempik-skills --skill yempik-security-auditThen, in the repository to review, tell the agent:
Run a full security audit of this repository.
Read the skill on GitHubQuestions.
What does it cost?
The skill is free. You pay for your AI agent’s usage, which grows with the size of the code and the profile you choose: quick, standard or deep. You can cap the number of agents before it starts.
Does our code leave the company?
The skill sends nothing to Yempik. Your own agent reads the code, under the terms of the AI provider you already use. If that code cannot go to that provider, it does not go into the audit either.
Who should run it?
Whoever looks after the code: the IT lead, an in-house developer or the supplier. Management receives the one-page summary, written in the language the audit was requested in.
How is it different from a vulnerability scanner?
A scanner matches code against a list of known patterns and flags a lot. The audit reasons about the boundaries of your system and keeps only the problems a second agent cannot disprove: fewer alerts, each with evidence.
What if nobody can run it for us?
Write to us. We will tell you how to set it up on your project and who can fix what it finds.
To understand October.
Read your code before the people who want to attack it do.
Tell us what you run in production and who maintains it. We will reply with how to run the audit and what to do with what it finds.
Talk to us about your code