Inspiration
A suspicious response is not a report. I built ControlX because bug-hunting tools can spot a signal, but they do not always help prove the claim.
What it does
ControlX turns an authorized security hunch into a bounded control experiment. It compares two self-controlled sessions (B→B, A→A, B→A), stops on exposure, redacts secrets, and saves an integrity-hashed receipt.
It is for local labs, systems I own, and explicitly authorized targets—not broad scanning.
How I built it
I built the interface in React/Vite, the persistence and proof API in FastAPI/SQLite, and the replay engine in Python and Node. I used Codex with GPT-5.6 Sol to help build the structural cURL parser, scope gates, control logic, fixtures, and tests.
AI review is optional and only critiques redacted evidence; deterministic replay controls the verdict.
Challenges
The challenge was making it useful without making it reckless. I restricted the engine to exact authorized hosts, GET-only requests, blocked redirects, request limits, no stored cookies, tokens, or response bodies, and human review before any live submission.
What I learned
AI is most useful in security research when it challenges evidence—not when it manufactures it.
Log in or sign up for Devpost to join the conversation.