InsurStaq

InsurStaq is a private AI security engineer tool running on Mac, focused on performing all security analysis locally. Its core positioning is to let developers view their own code like an attacker: first scan the code repository locally, then connect security findings into attack paths, helping investigate vulnerabilities and prepare remediation plans ready for review.

[Main Capabilities] InsurStaq's full audit covers multiple aspects:

1. Full repository audit: maps the frameworks, routes, databases, authentication, and permissions across the entire repository.
2. Static analysis: detects injection, unsafe exec, weak cryptography, XSS, path traversal, etc.; analysis depth depends on the specific language.
3. Security graph and attack paths: within supported scope, traces authorization, attribution, and data flow from input to dangerous sinks.
4. Dependencies, CVEs, and SBOM: prioritized by transitivity and reachability, providing upgrade paths, component inventories, and license risk.
5. Secrets and Git history: discovers secrets and tokens, including content committed years ago.
6. Infrastructure as code: covers Docker, Terraform, Kubernetes, and cloud configuration.
7. InsurStaq Local: on-device AI explains findings, investigates context, and drafts fixes.
8. Reviewed fixes: any change requires your approval before code is modified, then the changed files are rescanned on the Mac.
9. Reporting and compliance readiness: provides management- and technical-oriented PDF, HTML, or Markdown reports, mapped to compliance readiness.
10. Guard: security diff checks for working tree changes, regardless of which editor or coding agent made the changes.
11. Plugins and model selection: optional plugins for coding agents; optional AI providers or local model servers.
12. Offline and air-gapped environments: perform full audits with InsurStaq Local while disconnected; activation and model download require one-time network access.

[Workflow] The process is divided into four steps: 01 Audit the repository: InsurStaq maps languages, frameworks, routes, authentication, and dependencies, then runs its own code, secrets, dependency, and infrastructure scanners. Analysis depth depends on language and framework. 02 Trace what really matters: findings are connected into a security graph, allowing attacker-controlled input to be traced to code that creates real risk; confirmed findings and possible findings are marked separately. 03 Fix and rescan: InsurStaq drafts a focused remediation plan for your review; code does not change until you approve it, then the changedThe file will be rescanned on Mac. 04 Prove what actually ran: reports show what was checked, what was found, and what still needs manual verification, mapped to SOC 2, OWASP ASVS, PCI DSS, and ISO 27001 readiness.

[Local AI and Privacy] InsurStaq Local ships with every plan and works offline. After installation and a one-time model download, the model runs on the Mac. Apple silicon is required, and 16 GB of memory is recommended for AI features. You can also choose to connect an external model, but it is not required for local security review. Scanning, the security graph, and the search index all run on the Mac; when using local AI, model inference also runs locally. The privacy ledger keeps the file list for each scan and every network call. InsurStaq does not upload source code to its servers; if you explicitly connect your own AI provider, the task and relevant repository context are sent directly from the Mac to that provider.

[Guard and Coding Agents] Guard checks whether changes in the working tree introduce new security regressions, whether you edit manually or use an editor or agent such as Claude Code, Cursor, Codex, or Copilot. It reads the working tree itself, including staged and unstaged edits, new files, manifests, and lock files; Xcode, VS Code, JetBrains, and manual editing require no plugin. Guard is read-only and never edits, commits, or runs code. If a required engine fails, a scan stops, or a baseline is missing, Guard reports that it cannot verify rather than showing as clean. Plugins for coding agents are published on GitHub: KarmSakha/insurstaq-plugins, and each plugin starts a local InsurStaq server and returns only security metadata.

[Attack Paths and Q&A] InsurStaq maps the attack surface from code, then chains weaknesses along the security graph into paths an attacker could take, from the first public request all the way to the data worth stealing. Attack paths are traced from the code itself, not by attacking your live or deployed application. You can also ask pointed questions about the codebase, and the answers come from searching the security graph rather than guessing, pointing to the routes, files, and line numbers that prove it.

[Where It Fits] It suits an individual developer who wants the full InsurStaq workflow, as well as engineering and security teams. The official materials mention use according to team policies, shared suppressions, centralized licensing, and more, and provide organization-level options such as MDM policies, SSO, offline licensing, provider policies, and private AI endpoints. For specific pricing and plan details, refer to the official page.

[Limitations and Boundaries] Apple silicon is required, and 16 GB of memory is recommended for AI features. Activation and model download require a one-time internet connection, after which it can run offline or air-gapped. Analysis depth varies by language and framework, and a clean result does not prove that the repository has no vulnerabilities. Model inference remains separate from the scanner and graph discovery; nothing is marked as confirmed without deterministic proof, and the model will not certify that code is secure. Potential examples (such as SSRF and SQL injection) are illustrative examples, not real guarantees. Plugin names are compatibility examples only and do not represent any affiliation or endorsement. Other matters such as company registration and refund policy are subject to the official page.censing, provider policies, and private AI endpoints. For specific pricing and plan details, refer to the official page.

[Limitations and Boundaries] Apple silicon is required, and 16 GB of memory is recommended for AI features. Activation and model download require a one-time internet connection, after which it can run offline or air-gapped. Analysis depth varies by language and framework, and a clean result does not prove that the repository has no vulnerabilities. Model inference remains separate from the scanner and graph discovery; nothing is marked as confirmed without deterministic proof, and the model will not certify that code is secure. Potential examples (such as SSRF and SQL injection) are illustrative examples, not real guarantees. Plugin names are compatibility examples only and do not represent any affiliation or endorsement. Other matters such as company registration and refund policy are subject to the official page.