We open-sourced the most dangerous part of our security startup…

Founder here, so yeah, biased.

We're building an AI SOC analyst that triages noisy alert queues. Ingest CrowdStrike/SentinelOne alerts, heuristics kill the obvious junk, LLM takes a second look at the weird ones, then a human approves anything dangerous before it runs. No robot isolating your prod box on a hunch.

The part I want eyes on is the last step. The thing that actually executes approved actions like isolating a host or killing a process. Get that wrong and you're not stopping an attacker, you're taking yourself down at 3am. So we pulled it into a small Rust service and made it MIT open source. The whole idea is don't trust me, just read the code that's allowed to touch your machines.

Quick rundown: it's fail closed by default (DRY_RUN is on, logs and does nothing until you flip it), HMAC on every action request, rate limited, and every action hits an append only audit log.

It's alpha. Looking for a few blue teams to kick the tires and tell me where the threat model is naive. That's genuinely the feedback I want.

Repo's here: https://github.com/vyrox-security/vyrox-proxy

If it looks sane a star helps an alpha repo get found, but honestly the feedback's worth more.

Impact

If improperly implemented or configured, this proxy could disrupt production workloads by executing incorrect or maliciously crafted commands such as isolating critical hosts or killing essential processes. However, the fail-closed default mode and multiple security controls (HMAC authentication, rate limiting, audit logging) reduce the risk of accidental or unauthorized actions. No known exploits or active attacks have been reported. The open-source nature allows for independent security review, potentially increasing trust and reducing risk over time.

Defensive guidance

This component is currently in alpha and designed to be fail-closed by default (dry run mode enabled). Users should keep DRY_RUN enabled until thorough testing and security review are completed. The vendor encourages security teams to audit the code, test the proxy in controlled environments, and provide feedback on the threat model. Proper management of the shared HMAC secret and monitoring of audit logs are essential. Since this is an open-source project without an official patch or advisory, users should track the repository for updates and improvements.

Summary

Vyrox-proxy is a small Rust service that acts as the execution boundary for automated response actions in Vyrox's AI SOC analyst platform. It receives signed action requests authenticated via HMAC-SHA256, applies rate limiting, and logs all actions in an append-only audit log. The proxy is fail-closed by default, running in dry-run mode until explicitly enabled to perform live EDR API calls. The open-source release aims to provide transparency and allow CISOs to audit the exact code that can affect endpoint security controls. The project is alpha-stage, with a focus on memory safety and predictable runtime behavior. The vendor requests security community input to improve the threat model and implementation.

We open-sourced the most dangerous part of our security startup on purpose.

Discussion

Links cited in the discussion

Impact

Defensive guidance

Summary

References

Community reviews

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 25 May 2026, 10:54 UTC

Technical details

References

Community reviews

Related threats