Security tools that would rather interrupt you than miss something.

Guardian Prime builds security infrastructure for engineering organisations. Citadel, the first, stands between your developers and the public package registries, so nothing arrives without a decision somebody can point to.

Request access See how the gate works

Your dependency tree is a trust decision nobody made.

A single npm install can pull in hundreds of packages from maintainers you have never evaluated, running install scripts on developer machines and build agents. The dangerous moment is rarely the package somebody chose. It is the version published four hours ago, by an account that gained publish rights last week.

Citadel treats that moment as the one worth stopping for. Every version is judged before it can be installed, and the judgement is recorded.

Compromise arrives as an update

event-stream, ua-parser-js and node-ipc were all trusted packages, right up until a release that was not. Pinning a name does not pin intent.

Scanners report; they do not gate

Most tooling tells you what you already installed. By the time a finding reaches a dashboard, the install script has run and the credential is gone.

A CVE feed is not a judgement

A brand-new package has no CVEs, which is not the same as being safe. What matters is often maintainer behaviour, release timing, and what the diff newly permits.

Two products, one posture

Each is built on the same asymmetry: a false alarm costs a developer minutes, and a miss costs you the estate. Everything is tuned toward the first.

Citadel

Available

A gated package repository between your developers and the public registries. Nothing reaches a developer without a recorded decision: approve, reject, or escalate to a human.

Judges every version against vulnerability data, repository activity and community signal
Popularity-tiered cool-down holds fresh releases before anyone can install them
Approving an escalation requires a written justification, recorded against your name
One CLI your developers install once and then forget about

Request access

Fickler

In development

The second Guardian Prime product, built on the same principles as Citadel and applied to a different part of the software supply chain.

Details will be published closer to release.

Ask to be told first

Four steps, and a developer notices none of them

Citadel is a registry your package manager already knows how to talk to. Developers keep running npm install, and the gate happens in between.

Request arrives

A developer installs a package. Their client points at Citadel rather than the public registry.
Cache or vet

Already approved for this project? Served from the internal mirror. Otherwise it stops here.
Signals, then judgement

Vulnerability records, repository activity, release timing and maintainer changes are gathered, then reasoned over by a model you control.
A decision is recorded

Approve, reject, or escalate to a human. Every outcome is written to an append-only, hash-chained audit log.

What we will not trade away

These are the constraints the products are built inside, not features that get turned off for a deadline.

Asymmetric by design: Under 1% false positives, and zero tolerated false negatives. When the system is unsure it interrupts a human rather than guessing in your favour.
Every decision is evidence: The audit log is append-only and hash-chained. If an entry is altered, verification fails and the console says so loudly, including to us.
Your model, your account: Reasoning runs on Amazon Bedrock inside your own AWS account, or on a local model on your own hardware. Your dependency graph is not training data.
Degrade, never fail open: If a signal source goes dark, the decision is made without it and says so. What never happens is a package passing because a check quietly did not run.
Runs where you are: Hosted by us, or installed inside your own network with no outbound internet at all. The air-gapped build is not a special edition.
Boring for developers: No new commands to learn and no workflow to adopt. A gate that annoys people gets removed, so it is built not to.

Put a gate in front of your registries.

Citadel is onboarding its first organisations now. Tell us what your developers install and we will set you up.

Request access See how it works