A security scanner that checks storefronts the way shoppers see them
Azguards Technolabs (internal product)
AZSecure scans and monitors e-commerce sites for malicious scripts, web shells and tampered files. It combines a visitor-side browser probe, read-only server checks and a tightly limited AI investigator whose reports an engineer approves.
3 days from first commit to a live production MVP
- Industry
- Cybersecurity, e-commerce and web platforms
- Platforms
- Magento, WordPress and WooCommerce, Laravel, Node.js
- Layers
- External scan, server checks, AI investigation
- Status
- Live in production
Owners usually hear about a compromise last.
Site owners tend to learn about a breach from customers, search engines or payment processors, not from their own tooling. A tool built to catch it had to be safe to run on a live server.
Compromises that hide
Malicious code can appear only at checkout, only on mobile or only for certain visitors, so static file scanning misses it.
Credentials on a live server
Scanning production means handling secrets and sensitive data, so the tool itself had to be demonstrably low-risk.
Hostile content
Scanned pages can try to manipulate a language model, so its output on security data had to be tightly bounded.
Many platforms
Magento, WordPress, WooCommerce, Laravel and Node.js sites, some running in Docker, each need their own checks and fix guidance.
Three layers that check each other
Each layer answers a different question, and each decision limits what the platform can touch.
Decision 01
A compromise can be invisible to file scanning and to an ordinary page load.
Probe the storefront in a headless browser. It renders the home, product, cart and checkout pages as a visitor would, then requests them again with different user agents to expose cloaking. Scripts are judged against allowlists and threat intelligence.
Architecture Narrative
A submitted URL is validated by the API, queued, scanned by an isolated probe that renders the pages, and stored as a JSON result.
Architecture Narrative
The scheduler runs read-only SSH checks through a guarded toolbox. Results are normalised into findings with fingerprints and alerts are de-duplicated.
Decision 02
Scanning a production server must not change it or leak anything from it.
Run scheduled checks over SSH as fixed command templates, with no AI involved. Arguments are validated before insertion and the final command shape is checked again. Database access is read-only, and baseline state is kept on the platform rather than on the customer server.
Decision 03
A language model helps an investigation but must never have the last word on security.
Architecture Narrative
An agent follows an audit plan using read-only tools, produces findings and a root cause, then AI triage and an engineer review precede the customer report.
Let rules detect and the model explain. The agent works through a per-platform audit plan with a fixed read-only toolset, under cost, step and time budgets. It can add context or raise severity but never lower a rule-based result, and every output is schema-validated. An engineer approves the report before the customer sees it.
Decision 04
Scanned content and the scanner itself are both attack surfaces.
Treat scanned content as untrusted data and instruct the model never to follow instructions inside it. The probe blocks private, loopback and metadata ranges and re-checks after redirects. Reports are inert documents with escaped output and a strict content security policy, and PDFs render with JavaScript off and all network requests blocked.
Architecture Narrative
A target URL is resolved and blocked if it points at a private or metadata range. Otherwise it is fetched and re-checked after every redirect.
One platform for site owners, customers and engineers.
The same scan contract and finding model serve every audience, so a result means the same thing wherever it appears.
A free scan that shows what visitors see
A visitor submits a URL, protected by Cloudflare Turnstile. Anyone sees a summary, and the full detail unlocks once the visitor verifies domain ownership.
- Scanstorefront as a visitor sees it
- Verifydomain ownership
- Checkscripts, paths, TLS, headers, blocklists
Monitoring that tracks every finding
Customers connect SSH with a platform-generated per-site key or their own. The platform detects the stack, Docker and database containers, then monitors on a schedule.
- Lifecycleopen, fixed, regressed
- Alertsde-duplicated email
- ReportsHTML and PDF
A review queue and an admin that sets the rules
Engineers approve AI-assisted reports before release. Admins configure plans, credits and the AI provider and model used for each task.
- Reviewengineer approval queue
- Plansconfigured, not hard-coded
- ModelsAnthropic Claude or OpenRouter
What the platform makes possible.
In production within three days
The MVP went from first commit to production in 56 commits between 8 and 10 November 2026, then grew with platform depth and monitoring.
Three checks that cover each other’s gaps
The visitor-side probe, the deterministic server checks and the AI investigation each catch what the others can miss.
AI that can raise a finding but never lower it
Rules set the baseline, and model output is schema-validated and capped by cost, step and time budgets.
Findings that survive across scans
Stable check IDs and fingerprints follow each issue, and a failed or partial check never marks one as fixed.
Secrets redacted before they are stored
Evidence is size-capped, and activity data is kept only at coarse network and country level.
Releases with a way back
Manual GitHub Actions releases back up the database first and can roll back by deploying an earlier commit.
Familiar infrastructure, careful boundaries.
Mainstream tools do the heavy lifting. The care went into what each one is allowed to touch.
Backend
API, shared contracts and finding ingest.
Data and queues
Scan results, findings and background work.
Scanning and AI
Rendering, remote inspection and investigation.
Frontend
Customer app, staff screens and prerendered SEO pages.
Security
Authentication, secrets and bot protection.
Threat intelligence
Feeds synced on a schedule and read by the scanners.
Commerce and analytics
Subscriptions, credits and measurement.
Delivery
Containerised multi-site deployment.