Most small businesses have never had their website or software looked at by anyone security-minded. Not because they don't care — because a security firm costs more than the website did. AGT Shield closes that gap: it inspects your live site, your source code, your database rules and every third-party library you depend on, then hands you one plain-English report saying what's wrong, how serious it is, and exactly how to fix it.
Each module runs independently and in parallel. If one can't complete, the others still finish and the report says plainly which check didn't run — because a scanner that failed is not the same thing as a clean result.
How your site looks to someone probing it from outside.
.env, .git, backups, admin panelsStatic analysis — the code is read, never executed.
For Firebase and Supabase apps, these rules are the only thing between your data and the internet.
The third-party code your software is built on, checked against public vulnerability databases.
Nothing is scanned until you've named the assets and signed off. The permission is recorded in the report itself.
Website, code, database rules and dependencies are examined at the same time. Everything is passive and read-only.
Findings are de-duplicated, graded by severity, and scored out of 100 — so repeat instances of one mistake count as one mistake.
Each finding gets a business-level explanation of what an attacker could actually do, alongside the technical detail your developer needs.
After fixes, run it again. The report tells you what's resolved and what's new since last time.
Every finding names the exact file and line number, or the exact URL. Every finding carries a fix — not "improve your security posture", but the specific change to make.
| Severity | What it means for you |
|---|---|
| Critical | Treat as an incident. Either exploitable right now, or credentials that should be assumed compromised. |
| High | A realistic path to compromise or data loss. Fix next. |
| Medium | Meaningful hardening. Schedule into the next development cycle. |
| Low | Hygiene. Worth doing, not worth an emergency deploy. |
| Informational | Observations and confirmations. No action needed. |
Findings are labelled by confidence. Anything detected by pattern matching rather than direct observation is marked tentative and counted at reduced weight, so you're never pushed into urgent work over something a developer hasn't confirmed.
AGT Shield looks; it does not attack. It never submits credentials, never attempts to bypass a login, and never writes to your systems. Finding an open door is not the same as walking through it.
A host that isn't in the signed authorisation raises an error and the scan stops. It isn't a checkbox or a policy — the tool physically cannot scan an unauthorised target.
If a password or API key is found, the report shows just enough to locate it — never the full value. The report is safe to email.
Any security product that implies it makes you safe is selling you something. Here is what AGT Shield genuinely does not cover.
A clean report is not proof that a system is secure. It means the checks that ran came back clean. It cannot mean more than that, and nobody's tool can.
Whether one customer can view another customer's order by changing a number in the URL. That takes a person who understands what your application is for.
Scanning stops at the front door. Authenticated areas need a different kind of engagement.
No exploitation, no social engineering, no phishing simulation. If you need those, you need a specialist firm, and I'll tell you so.
The first production run of AGT Shield was against this very website. It found that the entire source repository — including every historical version of every file — was publicly downloadable, because of a single subtle pattern in a hosting config file. A pattern I had written, and had looked at many times without seeing.
It was verified by hand, fixed, and confirmed closed by re-scanning. Then it went out to client projects.
That's the honest case for this tool: config mistakes are invisible precisely because the person who made them believes they're correct. A second set of eyes that never gets tired and never assumes is worth having.
If I built your website or system, I can run an assessment on it. If someone else built it, I can still scan it — I'll just need your written go-ahead first.
Request an assessment See the AGT Suite