Guardian Prime
We build security infrastructure for engineering organisations — starting at the point where code you did not write enters software you are responsible for.
The problem
A single npm install can pull in hundreds of packages from maintainers you have never
evaluated, running install scripts on developer machines and build agents. The dangerous moment is
rarely the package you chose — it is the version published four hours ago, by an account that gained
publish rights last week.
event-stream, ua-parser-js and node-ipc were all trusted
packages that stayed trusted right up until a release that was not. Pinning a name does not pin
intent.
Most tooling tells you what you already installed. By the time a finding reaches a dashboard, the install script has run and the credential is gone.
A brand-new package has no CVEs — that is not the same as being safe. The signal that matters is often maintainer behaviour, release timing and what the diff newly permits.
Products
Each is built on the same asymmetry: a false alarm costs a developer a few minutes, and a miss costs you the estate. We tune everything toward the first.
A gated package repository that sits between your developers and the public registries. Nothing reaches a developer without a recorded decision — approve, reject, or escalate to a human.
The second Guardian Prime product. Built on the same principles as Citadel — gate rather than report, fail toward interruption, record every decision — applied to a different part of the software supply chain.
Details will be published closer to release.
How Citadel works
Citadel is a registry your package manager already knows how to talk to. Developers keep running
npm install; the gate happens in between.
A developer installs a package. Their client is pointed at Citadel rather than the public registry.
Already approved for this project? Served from the internal mirror. Otherwise it stops here and gets vetted.
Vulnerability records, repository activity, release timing and maintainer changes are gathered, then reasoned over by a model you control.
Approve, reject, or escalate to a human. Every outcome is written to an append-only, hash-chained audit log.
Principles
We accept under 1% false positives and tolerate zero false negatives. When the system is unsure, it interrupts a human rather than guessing in your favour.
The audit log is append-only and hash-chained. If an entry is altered, verification fails and the console says so loudly — including to us.
Run against Amazon Bedrock in your own AWS account, or a local model on your own hardware. Your dependency graph is not training data, and it does not leave.
If a signal source goes dark, the decision is made without it and says so. What never happens is a package passing because a check quietly did not run.
Hosted by us, or installed inside your own network with no outbound internet at all. The air-gapped build is not a special edition.
No new commands to learn and no workflow to adopt. If the gate is annoying, it gets removed — so it is built not to be.
Early access
Citadel is onboarding its first organisations now. Start on the free tier, or talk to us about a dedicated deployment.