T+00:00 · One release, one real city

Proof,
not alerts.

ControlMesh scans your code, proves which flaws are really exploitable, shows which real people and data they put at risk, and signs a record for every release.

Join the pilot
MEDIBOOK OFFICESTAGING · TEST COPYCONTROLMESH · READ-ONLYDATA CENTER · AWSPATIENTS' HOMESCITY HOSPITALCity HospitalNimal · can open any recordKamala · patientMediBook officeStaging copyTest lab · 1 failingControlMeshEvidence vaultRecords vaultFront gate1Server hallBilling siloKeycard door!Scans silo · public
Live DPDilini P.Security lead
Findings on PR #4824746 ranked · 1 proven
Patients at riskAllany patient could open any record
ReleaseBlockedv2.4.0 · needs a decision
RELEASE · MEDIBOOK APPv2.4.0PR #482 · Add patient records endpoint
Blocked
Findings47Proven1Reachable3

1 of 47 findings is proven: any patient can open any other patient's records and scans. Fix it before this ships.

Your call
Release trackingControlMesh connects, read-onlyWaiting for your call
Drag to moveClick any building or personPick a place at the topReplay with the trackerInteractive demo · names, records and numbers are made up
What this means in real lifePick a moment, or click anything on the map.
1What Nimal sees on his phone
MediBook
medibook.lk/patients/A-1187/records
Hi Nimal
Your records
Dental check-up02 Oct
Blood test18 Sep
Eye exam30 Jul

Nimal is logged in to MediBook and sees only his own records.

2The path Kamala's scan takes

Kamala's scans come from City Hospital and land in the patient-scans silo.

3Who can open Kamala's record?
  • Kamalaher own recordAllowed
  • Her doctorCity HospitalAllowed
  • Nimalanother patientUnknown
  • Any logged-in patientanyone with a MediBook accountUnknown
Without ControlMesh

This shows up as 1 of 47 alerts, rated MEDIUM. It would probably ship.

Tests use a staging copy and test patients. Nimal and Kamala are made up.

Built on open-source engines you can audit
Opengrep·Gitleaks·OSV-Scanner·Trivy·Schemathesis·Prowler checks·GitHub App·AWS SDK·
T+00:30 · 47 alerts

Small teams ship fast. Security reviews can't keep up.

AI assistants write more code than ever, and every scanner adds to the pile. With no security engineer on the team, nobody can tell which finding is real, so the dangerous one ships with the rest.

  1. 01Severity isn't risk. A "medium" in the list can be the one that leaks every patient record.
  2. 02Login checked, ownership not. Broken object-level authorization is #1 on the OWASP API Security Top 10, and code scanners rarely prove it.
  3. 03Code and cloud live apart. The flaw is in GitHub. The data it exposes is in AWS. No single tool shows both.

Flip the switch to see the same release both ways.

booking-api · release v2.4.0
47 findings · sorted by severity4 tools
CRITICALPossible SQL injectiondb/query.py:88
HIGHOutdated package with known CVEpackage.json
HIGHS3 bucket allows public readpatient-scans
MEDIUMRoute may be missing an ownership checkpatients.py:41
MEDIUMPossible secret in sample config.env.example
LOWBase image has known CVEsDockerfile
+ 41 more. Which one gets you breached?
Illustrative example: a healthcare booking app.
T+02:00 · The mesh runs

Six steps from pull request to proof.

Every release goes through the same loop. Scanners find candidates, ControlMesh tests them, and you get one decision with the evidence attached.

Connect in three pieces

Install the GitHub App, add a read-only AWS role, and register a staging copy of the app with two test users. Nothing to install on servers, no write access anywhere.

GitHub App installed
reads code and pull requests
AWS account linked
role/ControlMeshReadOnly · least privilege
Staging copy registered
2 test users · tests never touch production
T+04:00 · One bug, start to finish

Prefer to sit back? Watch the 30-second film.

How ControlMesh works · 30 s
T+05:00 · Everyone gets their view

Built for the team you actually have.

For cloud-native teams of roughly 10 to 150 engineers with little or no dedicated security staff.

Fix it where you already work.

Proven issues arrive as a pull-request comment with the failing request and a suggested fix. No new dashboard to check.

WHERE · GitHub pull requests
controlmeshbot · on PR #482
Patient A can read Patient B's records via GET /patients/{id}/records. Add an ownership check at patients.py:41.
Re-test runs automatically on your next push.
T+06:00 · Why not just a scanner

Scanners say what might be wrong. ControlMesh proves what is.

What you needCode scannerCloud posture toolControlMesh
Finds risky code, secrets and packagesYes—Yes
Finds AWS misconfigurations—YesYes
Proves an API flaw is exploitable——Yes
Links a code flaw to the data and people it exposes—SomeYes
One ship / block verdict per release——Yes
Signed evidence for every release——Yes

Tool categories, not named products. Some commercial platforms combine several of these.

T+07:00 · Read-only by design

A security tool shouldn't be your next risk.

Read-only in AWSA least-privilege role. ControlMesh can look; it can't change anything.
Tests only where you pointRuntime tests hit the staging copy you register, with test users you create. Never real patients.
Open-source enginesThe scanners underneath are public projects. You can see exactly what runs.
Every action recordedEach scan, test and decision lands in the release's evidence record.
T+09:00 · Release signed

Every release gets a receipt.

When a hospital partner, an investor or an auditor asks "how do you know patient data is safe?", send them the record instead of a spreadsheet.

EVIDENCE RECORDSHIP
Release
v2.4.1 · booking-api
Checks run
Code · Secrets · Dependencies · AWS · API authorization
Proven issues
0 open · 1 fixed and re-tested
Accepted risks
0
Signature
sha256:9f2c…e81a (example)

Questions

It runs proven open-source scanners for you, then adds what they cannot: a runtime test that proves whether an API flaw is exploitable, and the data and people that flaw exposes.

T+10:00 · Ship it

Ship your next release with proof.

We're looking for a small number of teams to pilot ControlMesh on a real GitHub repository and AWS account.