AppSec
Fix reachable findings with signed evidence.
Bring SARIF, CVE, dependency, IAM/RLS, or policy findings. Boetica returns bounded PRs, scanner deltas, rollback notes, and signed evidence packets.
Proof-native autonomous engineering
Ship software autonomously. Prove every change.
Boetica creates full-stack apps, continues real codebases, and remediates security findings — autonomously, inside isolated sandboxes, through governed pull requests on live GitHub and CI. Every change ships with a KMS/Sigstore-signed evidence packet your reviewers and auditors can verify: changed files, tests, checks, control-family mappings, and an attested trust boundary. And every result is backed by a signed benchmark scorecard — measured head-to-head against Devin, Pixee, Mobb, Veracode, and Copilot Autofix.
- Create · bench:create · accepted-app rate wonSigned · Jun 2026Signed scorecard: KMS/Sigstore signed and re-verifiable, dated Jun 2026.
- Continue · bench:continue · rollback + intervention wonSigned · Jun 2026Signed scorecard: KMS/Sigstore signed and re-verifiable, dated Jun 2026.
- Remediate · bench:remediate · auditable closure wonSigned · Jun 2026Signed scorecard: KMS/Sigstore signed and re-verifiable, dated Jun 2026.
- Trust boundary · bench:trust-boundary · 0 critical escapesSigned · Jun 2026Trust-boundary attestation: KMS/Sigstore signed and re-verifiable, dated Jun 2026.
RepresentativeRepresentative end-state scorecard data. Values illustrate the signed-benchmark surface and are replaced by the live, re-verifiable feed before procurement review.
task
Add rate limiting before password verification
apps/web/src/app/api/login/route.tspatch ready
- await password.verify(body.password)+ await limiter.consume(requestIp)+ await password.verify(body.password)+ await audit.append(evidencePacket)
auth-rate-limit.test.ts3 checks greenhuman merge required
- finding
sarif:auth-throttle-77e3 - diff
sha b7e4c19 - prev packet
5e1c8a44 - evidence packet
91f4e2a0
evidence packet
hash 91f4e2a0 / SOC 2 CC6.6 / NIST AC-6 / 2026-06-21T19:42ZArtifact chain: a reachable auth-throttling finding becomes a bounded 4 files patch pull request; 12 tests and 3 checks pass; the change ships as a KMS/Sigstore-signed evidence packet, hash 91f4e2a0 chained to prior hash 5e1c8a44, mapped to SOC 2 CC6.6 / NIST AC-6, with human merge required.
Open the proof before you ask for access
Choose your proof path.
A proven product should not only ask you to request access. Inspect the benchmark wins, a signed fix, the security review, and the procurement evidence first — then request access once scope is clear.
- View benchmark winsOpen the signed scorecards for create, continue, remediate, and trust boundary.
- Inspect a signed fixFollow one finding from preflight to a KMS/Sigstore-signed evidence packet.
- Open security reviewRead the signed sandbox trust-boundary attestation and red-team result.
- See procurement evidenceWalk a scoped evidence room: SOC2, pentest, trust boundary, and scorecards.
- Request accessPick a proof path and start with an artifact your team can inspect.
Built for your team
Start from the proof your team trusts first.
Platform engineering
Ship governed PRs without agent sprawl.
Run Create and Continue work through branch protection, review queues, budget caps, CI, and evidence — not an unsupervised agent.
Compliance engineering
Turn engineering work into auditor-ready proof.
Evidence Rooms package signed PR evidence, scorecards, control mappings, SOC2 artifacts, and procurement exports for auditors and CISOs.
Three paths, one trust boundary
One engine for new apps, existing apps, and security fixes.
Create
Turn a product brief into a full-stack app with backend and frontend architecture built in.
Boetica writes the spec, designs the backend, shapes the frontend system, scaffolds the repo, drives tests, and opens the governed PR sequence.
- Blank repo
- Backend spec
- Frontend design
- Preview deploy
Continue
Turn a prompt, spec, or scheduled initiative into a PR your team can review.
Boetica maps the existing repo, makes the change in isolation, drives tests, and explains what it touched before asking for merge.
- Feature work
- Bug repair
- Refactors
- Scheduled upkeep
Remediate
Turn a credible finding into a small fix with proof attached.
CVE, dependency, IAM/RLS, and policy findings become bounded patches, green checks, and evidence packets when controls are involved.
- SARIF intake
- Reachability check
- Patch PR
- Audit packet
See the fix
Do not trust a platform claim. Inspect the artifact.
See the task, diff, checks, policy decision, and signed evidence packet in one view — so you decide whether the work deserves to merge, before it ever does.
Open the evidence explorerSigned remediation PR
boetica/auth-rate-limit-pr
@@ apps/web/src/app/api/login/route.ts- await password.verify(body.password)+ await limiter.consume(requestIp)+ await password.verify(body.password)+ await audit.append(evidencePacket)
evidence packetKMS + Sigstore (cosign)
- packet hash
- 91f4e2a0
- prev hash
- 5e1c8a44
- trust boundary
- sandbox attested · egress denied
- merge policy
- platform-eng / human merge
SOC 2 CC6.6signedNIST AC-6signed
See the real product
This is what ships. Not a mockup.
Every screen below is the shipped Boetica workspace, rendered from source against seeded data. Start with the frame that shows the whole thesis in one view.
The whole thesis, one screen
An autonomous build becomes a governed pull request, its CI passes, and a signed evidence bundle is attached — then it waits at awaiting human merge, with cost and token usage on the same view. Autonomy you can let run, because it stops at your gate and shows its proof.
Open a fix and its proof
Command center
Compose a build or remediation with the run controls, budget, and preflight in one view.
Evidence ledger
Signed evidence bundles per task — verifier passes, blast radius, and migration safety.
Governance
Policy is enforced and bound to branch protection — the simulator shows what would block.
Repo readiness
Per-repo readiness, CI, and eval scores with branch protection and approval mode.
Autobuild loop
Prompt, spec, issue, and scheduled loops feed work through the same governed path.
Controls and recipes
Run modes, objective gates, and workflow recipes behind approval-gated controls.
Artifacts
Pull requests, CI checks, evidence bundles, supply chain, and audit chain in one library.
Connected repos
Every connected repository with its readiness, open work, findings, and run samples.
Dashboards
Saved, filtered, and grouped views with scope coverage and owner-ready presets.
Verifier-selected remediation
We sample several fixes. Your gate picks the winner.
When Boetica remediates a finding, it does not ship the first thing a model emits. It generates several candidate fixes — each in its own isolated workspace — runs your verification gate on every one, and ships the candidate that proves it passes. The selector is never a model’s opinion and never a majority vote on text. It is the gate that either passes or fails.
best-of-N · verifier-selected
N candidates. One proof. The gate decides.
- worktree/cand-01Gate failed
Rate-limit inside the handler, after auth
route-smoke: still 200 past threshold
- worktree/cand-02Gate failed
Global middleware limiter on all routes
contract-gate: changed contract for callers
- worktree/cand-03Gate passed
Per-IP limiter before password verification
unit-auth + scanner-rerun: clean, 0 net-new
Proven by the gate — shipped
- Candidates generated
- 3 in isolated worktrees
- Selector
- CI + verification gate (ground truth)
- Selection rule
- Ship the candidate the gate proves — never a model vote
- Shipped
- worktree/cand-03
The quality floor
Nothing ships below the bar.
Boetica runs cheap where it can and escalates where it must. If a fix fails the gate, the engine escalates to a frontier model and retries — automatically. And the remediation loop is self-correcting: when an edit does not apply, the engine is told exactly why and repairs it, instead of looping on broken output. The result is autonomous remediation that holds up — a floor under quality, not a ceiling on cost.
- Tier 1Escalated
Cheap / self-hosted model
gate: FAIL
First attempt fails the verification gate. It is never shipped.
- Tier 2Cleared the bar
Frontier model
gate: PASS
The engine escalates automatically, retries, and clears the gate.
Signed benchmarks
A signed scorecard. Not a slide.
Every win you see links to the signed, re-verifiable scorecard that backs it — measured head-to-head, with the dataset hash and signature attached.
bench:remediate
Boetica wins accepted auditable closure.
- Evidence completenessCompletevs Partial
- Trust-boundary result0 critical escapesvs Not attested
The verifier-labeled corpus
It learns from what it can prove.
Every remediation Boetica runs is labeled by the gate that judged it — resolved or not, at what tier, merged or reverted. That is a growing corpus of verified outcomes. Competitors can copy prompts and routing tricks. They cannot copy a corpus of software fixes a real verifier already proved correct. That corpus is the moat, and it compounds every run.
See the signed benchmark surfaceRunOutcomeExample · verifier-labeled
gate-labeled| Task | Tier | Gate verdict | Fate |
|---|---|---|---|
| auth-throttle-77e3 | cheap → frontier | Gate passed | merged |
| sql-injection-2b41 | cheap | Gate passed | merged |
| idor-9c0e | cheap | Gate failed | reverted |
| dep-cve-5f7a | frontier | Gate passed | merged |
Where it fits
Not a fixed platform. Not just a code bot.
Boetica creates new applications and continues real codebases, but the output is still production software: specs, implementation, preview, CI, governed PRs, and proof attached.
Generic app generators
Can it create a working app from an idea?
Boetica creates full-stack apps with backend architecture, frontend system design, tests, CI, preview deploys, and governed PR history.
General coding agents
Can it keep improving a real codebase?
Boetica keeps repo-bound work tied to policy, branch protection, CI, rollback context, and evidence before broader autonomy.
Scanners and GRC tools
Can it prove the finding was resolved?
Boetica turns credible findings into remediation PRs with reachability, control mapping, and audit-ready evidence.
Horizontal artifact platforms
Can it make many kinds of digital output?
Boetica focuses artifact creation on production software and the proof around it: apps, PRs, previews, evidence rooms, workbooks, APIs, and procurement packets.
Runs on a proven engine
Boetica already runs on the engine it ships.
The architecture on this page is not a roadmap deck. Boetica runs on a proven autonomous engine that is already live — repository events, credentials, and metering all in production.
Live webhook ingress
Repository events land through a live GitHub App ingress, not a demo shim.
GitHub App credential gate
Runs authenticate through a brokered, per-install credential gate.
Per-tenant metering
Usage is metered and capped per tenant — the same billing spine the product runs on.
The wedge, named
Why teams choose a verifier over a model’s opinion.
A model-arbitrated remediator writes the fix and lets a model decide it is good. Boetica arbitrates with ground truth — your tests, your CI, your gates — and keeps the proof.
Full platform
Everything around the app and the PR is part of the product.
Boetica is a workspace, governance layer, evidence system, automation API, and procurement surface around autonomous engineering work. New applications, existing codebases, and remediation work all move through the same proof path.
App creation
New full-stack products from product brief to governed preview.
Boetica creates backend architecture, frontend system design, repo scaffolds, tests, preview deploys, and staged PRs from scratch.
- Product spec
- Backend and frontend
- Preview deploy
Workspace
Composer, task thread, artifacts, dashboards, Atlas, and diagnostics in one operating surface.
Teams can start a governed run, see the preflight, follow attempts and CI, review evidence, and resolve blockers without leaving the workspace.
- Dispatch preflight
- Task thread
- Live diagnostics
Control workbooks
Views over the records that prove work is safe.
Workbooks organize PRs, tasks, findings, controls, evidence, artifacts, connectors, budgets, and readiness actions into source-linked operator views.
- Source-linked rows
- Risk rollups
- Redacted exports
Governance
Policy, review, budget, model, and autonomy controls before work starts.
Boetica enforces branch protection, review queues, policy DSL, budget caps, model-routing rules, quality gates, and PR-storm controls.
- Policy DSL
- Review SLA
- Autonomy demotion
Evidence rooms
Verifier-backed proof packages for customers, auditors, and procurement.
Evidence Rooms and Procurement Folios share PR evidence, audit records, security-review exports, readiness reports, and trust artifacts with scoped access.
- Expiring access
- Artifact vault
- Audit trail
Run API
External automation goes through the same governance path.
Recipes, API-created runs, thread messages, signed webhooks, idempotency keys, and MCP all stay policy-bound and evidence-backed.
- Signed recipes
- Idempotent runs
- MCP controls
Procurement
Security review generated from live controls.
Boetica packages sandbox, audit, evidence, supply chain, identity, data governance, provider terms, billing caps, reliability, and blockers for enterprise review.
- Security review
- SSO and BYOK
- Reliability proof
Safe by construction
The boundary is set before any code changes.
Isolated work
Each task gets its own hosted sandbox, narrow credentials, and locked-down egress before it can touch a branch.
Reviewable PR
Reviewers see the diff, tests, CI result, and rollback note in the same place they already work.
Evidence by default
Every change carries provenance. Security and compliance fixes add control-family mapping when a control is touched.
Human merge first
Boetica can earn more autonomy repo by repo, with human review and branch protection enforced by policy.
How it works
Start from a brief or repo, let Boetica work, review the proof.
GitHub App
Atlas repo map
Cloud sandbox
CI-backed PR
Evidence ledger
You inspect the artifact
Every claim links to the PR, diff, CI check, or signed packet that backs it. You inspect the proof, not a promise.
Autonomy has visible limits
Human merge by default, progressive per-repo autonomy, budget caps, and branch protection — the limits are set before Boetica touches your code.
Provenance first
Every change ships evidenced. Security and compliance fixes are mapped to the controls they touch.
Compliance-native
Evidence is formatted for your reviewers and auditors from the first commit.
The boring proof is the point.
- Control-family mappings on every security change
- Human merge by default
- Single-tenant, isolated sandbox
- SBOM and provenance on every build
- Every change is a reviewable pull request
- Your code never trains a model
Frequently asked
What is Boetica?
Boetica is proof-native autonomous engineering. It creates full-stack apps, continues real codebases, and remediates credible security findings — autonomously, inside isolated sandboxes, through governed pull requests on live GitHub and CI. Every change ships with a signed evidence packet you can inspect.
Where does the autonomous work actually run?
Inside an isolated, single-task hosted sandbox with brokered credentials and deny-by-default egress — never on a developer laptop or a shared runner. The sandbox boundary is described on the trust-boundary page, and the marketing site has no access to customer repositories or production secrets.
Can Boetica merge code without review?
Not by default. Human merge is the default path, and branch protection, policy gates, and budget caps are enforced before a run starts. A repository earns more autonomy only by policy, and autonomy is demoted automatically when quality signals drop.
What proof travels with each change?
A change summary, the diff, tests, CI status, the policy decision, a rollback note, and SOC 2 / NIST control-family mapping when a security or compliance control is touched — bound under a tamper-evident hash and KMS/Sigstore signed, so the packet is re-verifiable after merge. Walk one end-to-end on the See a fix page.
How do I evaluate Boetica?
Start with the proof, not a request form. Open the signed benchmark scorecards, inspect a signed fix, and read the trust-boundary and procurement evidence. When the scope is clear, request platform access and pick the proof path your team wants to validate first.