Request early access

Docs · how Secure Raven works

Fixed rules, written down.

What Secure Raven inspects, the order it runs in, what it keeps and how to call its API. Secure Raven is in private early access: once you are invited, step-by-step setup is in the dashboard under Getting Started.

Inspects
Public websites, and Supabase or Postgres databases. Today only the website checks run in production.
Order
01 Connect, 02 Static posture, 03 Detector. A failed stage skips the rest.
Reports
Findings ranked Critical, High, Medium or Low. Names and flags, never rows.
Watch
A scheduled safe inspection, every 6 hours by default.
API
Customer API v1. Ed25519-signed, 60 requests per minute per key.
Request early accessRead the API reference

Start here

Pick the page you need.

Six references, all public. Each one says what Secure Raven does today, and what it does not.

How an inspection works

Three stages, always in this order.

A full database inspection runs Connect, then Static posture, then Detector. A stage that cannot finish skips the stages after it, and the inspection is reported as incomplete, never as a pass.

The three inspection stages, in order
StageRavensWhat it checksIf it cannot finish
Stage 1: Connect
  • HIPAA Hawk
That the probe answers, before anything is judged.Static posture and Detector are skipped. The inspection is reported incomplete.
Stage 2: Static posture
  • RLS Auditor
  • Storage
  • Auth
  • Secrets
  • Postgres Posture
How the database is set up: row-level security and its policies, public buckets, MFA coverage, secret-looking column names, and the Postgres version and settings.Detector is skipped. The inspection is reported incomplete.
Stage 3: Detector
  • Detector
The events the probe sent: Detector promotes the high and critical ones to findings, each with its severity. Findings store names and flags, never your rows.Reported incomplete, never as a pass.
  • Watch runs a scheduled safe inspection of one source, every 6 hours by default. It is not a firewall, and it is not 24/7 monitoring.
  • The Web Ravens check public websites from the outside, the way a visitor would. They run on their own, outside these three stages.

Private early access. Today only the three Web Ravens run in production: Web Headers, Web Surface and Login Flow. The other ten, and with them this three-stage inspection, do not run for customers yet.

What it checks

13 Ravens on three teams.

Each Raven is one fixed check. Its power is exactly what that check does, and nothing more.

  • Database Ravens (7)

    RLS Auditor, Storage, Auth, Secrets and Postgres Posture inspect how your Supabase or Postgres database is set up. Then Detector promotes the high and critical events to findings, each with its severity.

    • Detector
    • RLS Auditor
    • Storage
    • Auth
    • Secrets
    • Postgres Posture
    • HIPAA Hawk
    Meet them: the Database Ravens

  • Web Ravens (3)

    Web Headers, Web Surface and Login Flow check the security headers on your URL, exposed files and keys left in JavaScript bundles, and your login page and its cookies.

    • Web Headers
    • Web Surface
    • Login Flow
    Meet them: the Web Ravens

  • Network and Watch Ravens (3)

    Network Telemetry and Wi-Fi Telemetry read telemetry from a probe you run. Shield Verify records Shield verification in scan history.

    • Network Telemetry
    • Wi-Fi Telemetry
    • Shield Verify
    Meet them: the Network and Watch Ravens

What it keeps

Names and flags. Never your rows.

What Secure Raven holds, what it never holds, and how long anything stays. Read the privacy policy

Custody

push-probe mode

Held by Secure Raven

  • Table names, policy names and flags.
  • For each API key, a SHA-256 hash of its token and its Ed25519 public key.
  • For the push probe, a hash of its token and its Ed25519 public key.

Never stored

  • The rows in your database.
  • Your database password, in push-probe mode.
  • Any private signing key.

Never sent

  • Findings, events and credentials, to any AI vendor.
Retentionthe same on every plan
  • Events90 days after they occur
  • Inspection runs1 year after they finish
  • Resolved findings2 years after they are resolved or the risk is accepted
  • Audit logKept. Append-only, and we do not delete it

Findings

Every finding says how bad, and what to do.

A finding carries a severity, a status and a remediation step. It names the object, such as a table, a bucket or a URL, and never holds row data.

Severity and status

Severity, most urgent first

  • Critical
  • High
  • Medium
  • Low

Status

  • Open
  • Triaged
  • In progress
  • Resolved
  • Accepted risk

Where findings show up

  • In the dashboard, under Findings and Scan history.
  • Through the API: GET /api/v1/findings.
  • By email for incidents, if you turn alerts on.

A finding from Web Headers

Sample

HighMissing Strict-Transport-Security header

Category
headers.hsts_missing
Object
https://www.example.com
Status
Open
Remediation
Add: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Help

Still have a question?

Secure Raven is private and invite-only during early access. Already invited? Sign in and open Getting Started in the dashboard for step-by-step setup.

Request early accessSign in
Anything else
Contact us