Skip to main content
Architecture

How GuardianX sits in your environment

Agentless. API-first. Blast-radius safe. No code changes, no sidecars, no runtime overhead.

AgentlessAPI-firstBlast-radius safeNo code changesNo sidecarsZero runtime overhead
// Section 01

Deployment Model, Agentless by Design

No Agents, No Sidecars

GuardianX operates entirely through API calls and HTTP probing. No software installed on your servers, no daemon processes, no kernel modules. Zero runtime overhead on production systems. Works with any cloud (AWS, GCP, Azure) or on-premise infrastructure.

  • Zero install footprint
  • No kernel modules
  • Works across clouds & on-prem

API-First Integration

Connect via REST API. Import codebases via Git URL or paste source. Add live targets via URL. Webhooks push results to Slack, Teams, or any HTTP endpoint. Full programmatic control, every UI action has an API equivalent.

  • REST + Webhooks
  • Git URL or paste source
  • Slack / Teams / HTTP endpoints

Read-Only by Default

SAST reads your source code (never modifies it, patches are generated for review, not auto-applied). DAST probes live endpoints with non-destructive payloads. No write operations without explicit human approval. Every action is audit-logged.

  • Source code never modified
  • Non-destructive payloads
  • Every action audit-logged
// Section 02

The 7-Stage Pipeline

1

Onboard

Add client, codebases (Git), targets (live URLs), define scope.

2

Scan

AI SAST reads source, DAST crawls live endpoints, SCA checks dependencies.

3

Test

PoC exploit generation, adversarial red-team arena, protocol fuzzing.

4

Patch

AI generates fixes + test code, sandbox-verifies before review.

5

Verify

Human approves, re-test confirms exploit is blocked.

6

Defend

Canary tokens, honeypots, virtual WAF patches, runtime monitoring.

7

Comply

Hash-chained attestation ledger, DPDPA/GDPR/ISO mapping, PDF reports.

Offense Defense / Verify Comply
// Section 03

Blast Radius Safety Controls

Authorization Gate

Every target must be explicitly authorized before any testing begins. The “Authorize” button is a deliberate, logged action. Unauthorized targets cannot be scanned, tested, or patched, enforced at the API layer.

Scope Enforcement

Define what’s in/out of bounds per engagement (e.g., “app.acme.com only, exclude /admin and payment gateway”). GuardianX honors scope boundaries, crawlers stay within declared paths, DAST payloads hit only scoped endpoints.

Sandbox Isolation

All patch testing happens in an isolated sandbox, never against production. AI-generated test code runs against a copy, not live data. A patch only reaches your codebase after human approval AND sandbox pass.

Human-in-the-Loop

No patch is ever auto-deployed to production (unless you explicitly enable auto-approve for low-severity). Every critical/high finding requires human review. The AI recommends; humans decide. Full rollback for any approved patch.

// Section 04

Data Flow & Security

Client / Browser
HTTPS + JWT cookie
Edge Middleware
JWT verify · rate limit
sentinel-engine
Bun + Python3
Supabase Postgres
Region-pinned

All hops TLS 1.2+ · credentials never traverse the client boundary

Credential Vault

All stored credentials (Git tokens, API keys) encrypted with AES-256-GCM. Each credential has a unique IV and auth tag. Keys never logged, never returned in API responses. Access audit-logged.

AES-256-GCM · unique IV per record · zero key exposure

Hash-Chained Attestation

Every approved patch creates a SHA-256 ledger entry (prevHash + patchId + codeHash + timestamp). Tamper-evident, any modification breaks every subsequent hash. Proves remediation timeline to auditors.

SHA-256 · hash = H(prevHash + patchId + codeHash + ts)

JWT + 2FA Auth

Edge middleware verifies JWT on every API request. TOTP 2FA (RFC 6238) via Google Authenticator. Admin approval workflow, new signups can’t access anything until approved. Rate limiting (auth: 10/15min, API: 300/min).

HS256 JWT · RFC 6238 TOTP · sliding-window rate limits

Data Localization

Runs on Supabase (you choose region). No data leaves your configured region. DPDPA §16 compliant for Indian users. Region pinning enforced at the database layer, cross-region replication is opt-in only.

Region-pinned PostgreSQL · DPDPA §16 compliant
// Section 05

Technology Stack

Frontend
  • ›Next.js 16
  • ›TypeScript
  • ›Tailwind CSS 4
  • ›shadcn/ui
  • ›Framer Motion
Backend
  • ›Next.js API Routes
  • ›Edge runtime (auth middleware)
Database
  • ›PostgreSQL (Supabase)
  • ›Accessed via REST API
AI
  • ›Z.AI LLM
  • ›Vulnerability analysis
  • ›Patch generation
  • ›Exploit synthesis
  • ›Chat
Compute
  • ›Railway sentinel-engine
  • ›Bun runtime
  • ›Python3 (SAST/DAST/PDF/scraper)
Real-time
  • ›Socket.io
  • ›Live event streaming
Auth
  • ›JWT (jsonwebtoken)
  • ›bcrypt (12 rounds)
  • ›TOTP 2FA (otplib)
Desktop
  • ›Electron
  • ›Cross-platform .exe / .dmg / .AppImage

See the architecture in action

Walk through a live engagement with our team. We'll show you the 7-stage pipeline end-to-end against a target of your choice, with every safety control visible.

© 2026 GuardianX · Agentless VAPT & Autonomous Security Operations

DPDPA 2023 · GDPR · HIPAA · PCI-DSS · ISO 27001 · SOC 2 ready