Keystone. by Tech-Bharat
A platform of software-audit agents

AI agents that find what's broken — before your users do.

Keystone runs specialist agents that audit your software and hand back prioritized, fix-ready reports. Two are live today: a deep code, security & reliability audit, and an SEO audit that crawls your site and reads it the way search engines do.

Request an audit Meet the agents
Read-only — no code changed No PRs · no Docker OWASP Top 10 + CWE HTML + PDF report
5
checks in one pass — code, deps, secrets, config, live app
HTML + PDF
professional report, fix-ready for your team or AI
~8 min
typical repo, start to report
The platform

One platform. A growing team of specialist agents.

Each agent is a focused expert with the same promise — read-only, and one prioritized, fix-ready report. Start with the audit you need.

</>
Available now

Code Audit

Reads your actual code — plus dependencies, committed secrets, and config — and drives your live app in a browser. Five lenses, one severity-ranked report mapped to OWASP & CWE.

Request an audit → What it checks
⌕
Available now

SEO Audit

Crawls your live site and reports what's holding back search — and AI-search — visibility: crawlability, structured data, international, Core Web Vitals, plus a content, E-E-A-T & AEO review.

Request an audit →
◑
Planned

UX & QA Audit

Drives your running app like a real user across its key journeys and reports the broken flows, dead ends, and slow paths they hit — with reproduction steps.

On the roadmap

An audit you'd want run as an agent? Tell us what to build next.

Code Audit · one pass, five lenses

A code review, a scanner, and a QA tester — in a single audit.

Most tools do one of these. The Code Audit agent runs all five and consolidates them into one severity-ranked report.

Code review

Reads the actual code

An agent opens your controllers, guards, and queries — tracing each issue to a real line — across four specialist lenses. Not a filename scan.

Dependencies

Known-vulnerable packages

Resolves every dependency (root and sub-packages) and checks it against the OSV vulnerability database, with the fixed version.

Secrets

Committed keys & passwords

Finds real credentials committed to the repo — with an allowlist that ignores test fixtures and placeholders, so the count is trustworthy.

Build & config health

What breaks the build

Catches install-breaking dependency conflicts and security headers configured in a way browsers silently ignore.

Live-app testing

Drives your running app

Logs in with a test account and clicks through in a headless browser — surfacing crashes, failed loads, and slow pages real users hit. Navigation only.

Compliance

Mapped to standards

Every finding tagged with its CWE and OWASP Top 10 category, with a coverage table — ready for a security review.

Code Audit · how it works

Repo in. Report out. Nothing touched.

STEP 01

Point it at a repo

Connect a GitHub repository. For live-app testing, add a staging URL and a test account — the password is encrypted, never stored in plain text.

STEP 02

Keystone audits it

It clones read-only and runs all five checks in parallel. No code is changed, no pull request is opened, no infrastructure is touched.

STEP 03

Get a fix-ready report

A professional report in HTML and PDF — plain-language headlines for stakeholders, exact file:line and fixes for engineers or your AI assistant.

Every finding, two ways

Readable by a founder. Actionable by a machine.

One report serves both audiences — the stakeholder who needs the risk, and the engineer (or AI) who needs to fix it.

Critical

A logged-in customer can reach another customer's data

In plain terms

The app decides which customer a request is for by reading a value the caller can freely set — before checking who's logged in. Nothing re-checks it, so a user of Customer A can put Customer B's ID in a header and act on Customer B's data.

The fix

Add a guard that runs after auth and asserts req.user.tenantId === req.tenant.id on every tenant-scoped route (allowing designated super-users). Location and the exact code path are in the report.

Proven on real code

On a live multi-tenant SaaS, Keystone went from surfacing almost nothing to a full report: three criticals — cross-tenant data access and an unauthenticated open proxy — plus build-config issues and client-facing bugs it reproduced by logging in.

0 → 32real findings surfaced,
consolidated
3criticals — incl. cross-tenant
access & unauth SSRF
2,048dependencies scanned
(monorepo, all packages)
0changes made —
strictly read-only
Request an audit

Tell us the repo. We'll send you the report.

We run the audit and deliver a prioritized report you can hand straight to your team — or to your AI assistant — to fix. Priced per engagement.

Opens your email client with the details filled in — or write to manan@tech-bharat.com directly.

What you get
  • A prioritized report (HTML + PDF), every finding with the exact file and line
  • Plain-language headlines for stakeholders, fix-ready detail for engineers
  • Code review, dependencies, secrets, build/config health — and live-app checks
  • Every finding mapped to OWASP Top 10 & CWE
How it works
  • You send the repo (read-only access is enough)
  • We run the audit — nothing is changed, no PRs, no deploys
  • You get the report, and a walkthrough if you want one
Know before you ship

See what your codebase is hiding.

Send us the repo and we'll send back a prioritized, fix-ready report. Nothing is changed — you decide what to fix.

Request an audit See a sample finding