// ╔═══════════════════════════════════════════════════════════╗ // ║ KENSAI WEB · Defense + Offense + Bounty + Hunts ║ // ╚═══════════════════════════════════════════════════════════╝ // ── DEFENSE: Findings, Scans, CVE, SBOM ────────────── const DefenseSection = () => (

Every finding,
earned through five gates.

Other tools dump noise into a queue and call it a workflow. Kensai runs every signal through five gates — Discover, Reproduce, Exploit, Impact, Submit — before a human ever sees it. What lands in your queue is exploitable, evidenced, and ready to fix.
{[ ['G1 · DISCOVER', 'Surface scan picks it up.', 'active'], ['G2 · REPRODUCE', 'Second pass confirms it.', 'active'], ['G3 · EXPLOIT', 'Working evidence is captured.', 'active'], ['G4 · IMPACT', 'Blast radius is reasoned through.', 'active'], ['G5 · SUBMIT', 'Report or ticket is ready.', 'active'], ].map(([k, t, n]) => (
{k} {t} {n}
))}
{/* Findings table mock */}
FINDINGS live queue · evidence-first ↑↓ A advance
{[ ['F-1824','crit','SQL injection · /api/users/login','api.qlabs.io','G3','0.14','public program'], ['F-1823','high','IDOR on /orgs/:id/billing', 'api.qlabs.io','G5','0.08','—'], ['F-1822','high','Path traversal /files/:name', 'qlabs/web', 'G3','0.22','public program'], ['F-1821','med', 'Weak JWT signature on /auth', 'auth.qlabs', 'G4','0.11','—'], ['F-1820','med', 'YAML deserialization · sdk-py', 'qlabs/sdk-py','G2','0.31','—'], ['F-1819','crit','RCE via deserialization · /jobs', 'api.qlabs.io','G3','0.09','public program'], ['F-1818','high','Open redirect · /oauth/callback', 'auth.qlabs', 'G2','0.18','—'], ['F-1817','low', 'Verbose error leaks stack trace', 'status.qlabs','G1','0.42','—'], ['F-1815','high','Race condition · /payments/capture','pay.qlabs', 'G4','0.14','public program'], ['F-1814','crit','SSRF to metadata · /webhooks', 'api.qlabs.io','G5','0.06','public program'], ].map(r => ( ))}
IDSEVTITLEASSETGATESLOPBOUNTY
{r[0]} {r[1].toUpperCase()} {r[2]} {r[3]} {r[4]} {r[5]} {r[6]}
{/* Defense capabilities row */}
{[ ['DUAL-ENGINE SCANS', 'Blitz finds. Deep verifies. Two passes, one verdict — false-positive rate near zero.'], ['CVE INTEL', 'Live correlation against your SBOM. The day a CVE drops, you know if you bleed.'], ['SBOM · AUTOFIX', 'Patches generated, tested, opened as PRs. Your dependency tree, automatically pruned.'], ['CORRELATION', 'Anomalies stitched into cases. One timeline per attacker, not per signal.'], ].map(([k, d], i) => (
{k}
{d}
))}
); // ── OFFENSE: Auto Hunts (live demo strip) ──────────── const OffenseSection = () => (
{/* live hunt strip */}
● HUNT-02 · IN PROGRESS

Hunt workflows.
Running with guardrails.

Kensai runs continuous autonomous campaigns against your surface with governed offensive workflows. Scope-bounded, reviewable, and designed to keep signal moving instead of creating more noise.
HUNT-02 Auth manifest sweep · demo tenant DEEP-03 · DEEP-04 RUNNING
{[ ['14:21:06', 'agent', 'DEEP-03 enumerate · auth surface in /api/auth/*'], ['14:21:18', 'note', 'JWT signing key derives from APP_SECRET — checking entropy'], ['14:21:42', 'find', 'F-1821 candidate · weak JWT signature on /auth/refresh'], ['14:22:01', 'verify','DEEP-04 reproduce · token forgery succeeds in verification'], ['14:22:04', 'gate', 'G3 EXPLOIT · evidence chain captured'], ['14:22:08', 'next', 'computing impact radius · evidence continues'], ].map((r, i) => (
{r[0]} {r[1].toUpperCase()} {r[2]}
))}
14:22:09 ►_
active VIEW LIVE →
{/* governance card */}
Governance · Always armed
Autonomous, never unaccountable.
Every hunt is bounded by a written policy: scope, budget, blast radius, evidence retention, kill-switch latency. We log every agent action and ship the audit trail to your SIEM.
{[ ['MAX CONCURRENT HUNTS', 'set by policy', 'ok'], ['DAILY BUDGET CAP', 'bounded', 'ok'], ['OUT-OF-SCOPE BLOCK', 'ENFORCED', 'ok'], ['HUMAN APPROVAL · G5', 'REQUIRED', 'ok'], ['KILL SWITCH', 'ARMED', 'ok'], ['EVIDENCE RETENTION', 'policy-set', 'ok'], ['DUAL-ENGINE', 'ENFORCED', 'ok'], ['POLICY BREACH', 'none claimed publicly', 'ok'], ].map(([k, v]) => (
{k} {v}
))}
); // ── BOUNTY FORGE ──────────────────────────────────── const BountySection = () => (

Findings become
submissions.

The Bounty Forge is the bridge between a finding and a clean submission workflow. Evidence can be chained, reviewed, and advanced without pretending there is public bounty performance we cannot verify yet.
{/* programs table */}
PROGRAM WORKFLOW illustrative routing surface public platforms · reviewed manually
{[ ['Program A', 'Public platform', 'API + web scope', 'see platform', 'active', '—', '—', 'review'], ['Program B', 'Public platform', 'product surface', 'see platform', 'active', '—', '—', 'review'], ['Program C', 'Public platform', 'selected scope', 'see platform', 'active', '—', '—', 'review'], ['Program D', 'Public platform', 'selected scope', 'see platform', 'active', '—', '—', 'review'], ['Program E', 'Public platform', 'selected scope', 'see platform', 'active', '—', '—', 'review'], ['Program F', 'Public platform', 'selected scope', 'see platform', 'active', '—', '—', 'review'], ['Program G', 'Public platform', 'selected scope', 'see platform', 'active', '—', '—', 'review'], ].map(r => ( ))}
PROGRAMPLATFORMSCOPEMAXSUBMITTEDPAID·90DACCEPTSLOP
{r[0]} {r[1]} {r[2]} {r[3]} {r[4]} {r[5]} {r[6]} {r[7]}
{[ ['347,593', 'CVES INDEXED'], ['1.85M', 'LINES OF CODE'], ['7', 'OSS TOOLS INTEGRATED'], ['10', 'COMPANIES USING KENSAI'], ].map(([n, l], i) => (
{l}
{n}
))}
); Object.assign(window, { DefenseSection, OffenseSection, BountySection });