# Why we are building AgentProof

Small teams ship web apps every week with nobody whose job is security. We are building two agents to check and fix them.

Most teams that ship a web app have no security person. Someone set up the login a year ago. A permission got wider to fix one bug. A test account never got deleted. Nobody is checking, because nobody's job is checking.

A one-time audit helps for a week. Then the app changes again.

## Two agents, one loop

AgentProof pairs two agents.

The **Attack Agent** looks for a way in. When it finds one, it records exactly what it did, so your team can see it happen.

The **Defense Agent** takes that record, writes a fix in your repository and checks it. Then the Attack Agent tries again. A finding closes only when the retest fails.

That loop runs monthly, weekly or daily. You pick how fixes ship: a pull request, a merge after checks, or a change applied to the running app.

## Where it stands

AgentProof is in development. The demo on this site is a simulation: it captures a public page and plays the agents over it. It does not test anything.

The [docs](/docs/) explain the planned workflow, the preview and the plans. We will post here as the real product takes shape.