LOCK INSPECT
Reconstruct behavior
Map components, actors, privileges, assets, dependencies, state transitions, upgrade paths and trust boundaries.
implementation → executable modelTWIX LOCK · FLAGSHIP SECURITY PLATFORM
Break it here.
Before they do.
TWIX Lock creates a private executable twin of your software. It reconstructs what the system actually does, models authority and state, runs adversarial simulations in isolated infrastructure, watches every change and delivers verified findings through a confidential reporting rail.
Dual-Proof AuthorizationDisposable SandboxesDeterministic ReproductionFindings Never Public
LOCK ENGINE
DUAL-PROOFrepo + wallet authority
SANDBOX TWINisolated executable clone
LOCK SIMadversarial state search
LOCK RAILencrypted private findings
AUTHORIZATIONDUAL-PROOF
EXECUTIONEPHEMERAL SANDBOX
ANALYSISMODEL + CONSEQUENCE
DISCLOSUREPRIVATE BY DESIGN
SETTLEMENTTWIX-NATIVE
THE LOCK LOOP
Understand the system.
Then try to prove it wrong.
Lock is not a one-time scanner. Each authorized target becomes a continuously reconstructable software twin whose behavior can be compared, challenged and re-tested as the source changes.
01AUTHORIZERepository challenge plus TWIX wallet transaction.
02CLONEPin the exact commit into an isolated disposable worker.
03LOCKInfer actors, permissions, state, flows and trust boundaries.
04MODELConstruct machine-readable invariants and failure conditions.
05BREAKSearch adversarial paths inside the sandbox—not production.
06VERIFYReset and deterministically reproduce every serious hypothesis.
07WATCHRebuild the model when commits, dependencies or deployments change.
DUAL-PROOF AUTHORIZATION
No proof of authority.
No adversarial simulation.
A pasted GitHub URL is not consent. Lock requires repository control and cryptographic wallet authority to agree before higher-risk analysis capabilities unlock.
PROOF 01
Repository control
Lock generates a unique challenge document for /.well-known/twix-lock.json. The project must commit it to the target repository.
- Repository URL and branch are pinned.
- Requested capabilities are explicit.
- Authorized wallet address is named.
- Challenge expires and can be rotated.
×
PROOF 02
TWIX transaction authority
The wallet named by the repository file signs a TWIX transaction committing the authorization hash and scope.
- Sender comes from the signed transaction.
- File signer and tx sender must match.
- Authorization can be revoked on-chain.
- Scope upgrades require fresh consent.
WHAT THIS ESTABLISHES
Repository → authority file → wallet → TWIX transaction.
An account capable of changing the repository names a security authority, and that exact authority cryptographically consents to the requested Lock capabilities. The platform can then prove what was authorized, by whom, for which repository state and for how long.
PRIVATE EXECUTABLE TWIN
Clone the target.
Never trust the target.
Submitted software is treated as potentially hostile. The control plane does not execute repository code. Build and simulation happen in disposable workers with explicit network and resource boundaries.
LOCK SIM
Challenge invariants
Search for sequences that violate modeled assumptions under controlled state, dependency, ordering and failure conditions.
hypothesis → reproduce → reset → reproduceLOCK WATCH
Watch behavioral drift
Detect commits, dependency shifts and deployment changes, then analyze what changed in the behavioral model—not just the diff.
source delta → model delta → risk deltaLOCK SHIELD
Pre-authorized defense
Projects define deterministic response policies. AI can raise a hypothesis; only verified conditions plus authorized policy can trigger action.
discover ≠ decide ≠ executeCONFIDENTIAL FINDINGS
Prove the finding.
Never expose the vulnerability.
Lock reporting inherits the Securail philosophy: public proof does not require public payload. Vulnerability intelligence remains private throughout discovery, remediation and verification.
LOCK RAIL · CONFIDENTIAL CUSTODY
Encrypted finding packages.
Verified findings are assembled into recipient-bound encrypted packages containing the model failure, deterministic evidence, impact analysis, remediation guidance and the exact environment needed for re-test. Access can be granted or re-keyed without publishing the report.
PUBLIC COMMITMENT
report_hash · timestamp · protocol_versionPRIVATE PAYLOAD
finding · evidence · trace · remediation · accessREMEDIATION LINK
original_commitment → patched_commit → verificationNON-NEGOTIABLE
BUGS
NEVER
PUBLIC.
NEVER
PUBLIC.
No exploit calldata. No public PoCs. No searchable vulnerability descriptions. No automatic disclosure timer. Lock is designed to help the authorized project fix the problem—not advertise it.
Private Bounty Workflow →PRIVATE BUG BOUNTIES
Claim. Reproduce. Prove.
Fix. Re-test. Pay.
Lock can become the verification engine between researchers and projects. A submission does not become a valid finding because someone says it is—the platform reproduces the claimed behavior against the authorized target state.
RESEARCHER
Sealed submission
Submit affected commit, claim, severity and an encrypted evidence bundle. Optional TWIX stake can signal confidence without making staking mandatory for legitimate reports.
LOCK
Independent reproduction
Rebuild the authorized commit in the project sandbox, execute a non-public validation plan and classify only what can be reproduced.
PROJECT
Remediate and release
Patch the target. Lock reruns the same deterministic failure condition. Verified remediation can release the TWIX bounty and close the private report.
TWIX ECONOMIC ENGINE
Security work consumes
actual TWIX utility.
Authorization is cheap. Analysis is not. Lock gives TWIX recurring demand through compute, simulation, monitoring, private bounty escrow, report custody and remediation verification.
DEMO COMPUTE METER
Pay for depth, not marketing tiers.
A customer can control analysis depth, simulation budget, worker parallelism, watch cadence and retention. The frontend calculates the TWIX estimate before any job is submitted.
LIGHT INSPECTIONFULL ADVERSARIAL COVERAGE
Repository authorizationone-time / renewalgas + registry fee
Lock Inspectanalysis computeTWIX metered
Lock Simworker-minutes + state runsTWIX metered
Lock Watchcontinuous coverageTWIX recurring
Lock Bountyescrow + verificationTWIX settlement
Lock Verifypatch regressionTWIX metered
THE IMPORTANT BOUNDARY
AI discovers.
Determinism decides.
Lock is intentionally designed so probabilistic reasoning cannot directly pause a protocol, move funds or label an unverified hypothesis as a confirmed vulnerability.
01
Discover
AI-assisted analysis proposes relationships, invariants and suspicious behavioral paths.
02
Reconstruct
The Lock model encodes actors, state, permissions, dependencies and expected consequences.
03
Reproduce
Serious hypotheses must survive controlled repeatable simulation against the target state.
04
Authorize
Only deterministic policy pre-approved by the project can trigger a defensive production response.
FULL FRONTEND DEMO
Give TWIX Lock an authorized repository.
Give attackers the sandbox instead.
Walk through the complete product flow with safe demo data, or use a public GitHub repository to exercise the real authorization-file verification path. Live TWIX EVM authorization can be enabled explicitly from the onboarding demo.