Skip to content
ATARUS. OFFENSIVE SECURITY

Products

Products

We are building a small set of security tools that will run on your own machine and report what they find. The local tools will be free and open source.

This page is the changelog. Nothing on it has been released yet, and a release is not done until it is listed here with its notes and the means to check it.

Products

  • Atarus Platform

    In design

    One local program that will run our open-source security tools, driven from your own AI client or the command line, and keep the results as evidence.

    Being designed. No code for it has been released.

  • Exposure Check

    In development

    A Mac app that will show what an infostealer would find on your Mac, by checking where sensitive files exist without opening them.

    Being built. Nothing has been released yet.

  • Extension Watch

    In development

    An inventory of the browser and code editor extensions on a Mac, with a readable diff of what changed in each update.

    Being built. Nothing has been released yet.

  • OT Asset Inventory

    Idea gate

    An offline tool that would build an asset inventory of an industrial network from a saved packet capture, without touching the live network.

    An idea under review. Work starts only if it passes.

How we build

Every product here is held to the same rules. The security page covers them in full, along with how to report a problem to us.

Auditor by default
Every tool observes, inventories and reports. Read-only is the default and needs no confirmation.
Active only on targets you placed in scope
Anything that probes a live system runs only against a target inside a scope you set, after a confirmation that software, including an AI model, cannot give on your behalf.
Never a false clean
Results say what was checked and what was not. No tool will tell you something is safe.
Threat model before code
Each module gets a written threat model at its design review, before any code.
Fuzzing on every parser
Anything that reads untrusted input gets a fuzz harness and limits on size, depth and paths.
Signed and reproducible builds
Releases will be signed, with separate keys for separate jobs, and built so that anyone can match the published source to the published binary.
Outside review once there is revenue
A security firm checking its own work is not an independent check, so an outside firm will review the platform once it earns.

Follow: release notes will go out in the research feed as posts of kind Tools, and our open-source code is on GitHub.