Secrit is a workspace for authorized security research. You talk through the next step with an AI research assistant, follow the work as inspectable tasks, and keep each finding next to the assets and recorded traffic that prove it. We built it from the way we run assessments at Raijuna.
The problem: evidence lives in five places
A real assessment rarely fails because the researcher missed the bug. It fails at the end, when the report is being written and the evidence is spread across a proxy history, a terminal, a notes file, a chat with an assistant and a folder of screenshots.
By then the context is gone. Which request proved the issue? Which host was in scope? Was that response from before or after the fix? The posts on this blog, from password reset poisoning to CORS chains across subdomains, all depend on that evidence trail being intact.
Secrit keeps the trail in one place from the first question onwards.
How Secrit works
Start with a conversation
You work with one research assistant. The conversation keeps its history, you attach context, and you decide what happens next. When a step needs your decision, Secrit asks for approval rather than guessing.
Follow the work as tasks
The assessment becomes a list of tasks you can inspect. You see progress, open details, pause a task and continue it later without losing the thread. The same evidence is available across sessions.
Keep each finding connected
Findings live beside the evidence that supports them. From a finding you can move to the affected assets and the recorded requests and responses, with severity and status in context.
Five views, one assessment
Every view in Secrit reads from the same assessment, so context follows you:
| View | What it shows |
|---|---|
| Overview | Tasks, findings and activity in one place |
| Approvals | What a step will do before it runs, and your decision |
| Assets | Scope and discovered inventory close to the work |
| Traffic | Recorded requests and responses, without leaving the workspace |
| Activity | Task updates with search and severity filters |
Authorization is not optional
Security tooling with AI agents raises a fair question: what stops it from doing something harmful?
Secrit answers it in the workflow:
- Authorized scope only. Secrit is for systems you own or have explicit permission to assess.
- Visible approvals. Required approvals stay on screen. You see what a step will do, then approve or decline it.
- No false comfort. Unknown actions are never presented as harmless.
- Inspectable work. Findings, assets, traffic and activity stay together, so a reviewer can check every claim.
These rules come from our own disclosure practice. If a finding cannot be traced back to evidence, it is not ready to report.
English and Korean
The interface, the agent's built-in guidance and report exports are available in English and Korean. Each task keeps its language across restarts, and exports use the language you request.
Pricing: pay for the tokens you use
The planned hosted model is a prepaid USD balance, not a fixed token bundle.
| Usage | Rate per 1M tokens | Relative cost |
|---|---|---|
| Cached input | $0.20 | 1× |
| Uncached input | $6.00 | 30× |
| Output | $20.00 | 100× |
A $100 deposit is a money balance. How long it lasts depends on your mix of usage. Because cached context is 30 times cheaper than fresh context, long assessments that reuse the same scope cost far less per step than they would if you paid a flat rate.
The current preview does not accept deposits. Hosted accounts open once customer isolation and billing are verified.
Technical foundation
A Go backend runs the research assistant, task queue and evidence storage. A Next.js frontend serves the workspace. Hosted billing runs through Stripe.
Try it
See the Secrit product page or visit the live preview. If you need an assessment rather than a tool, talk to us.
