OkamiScan

Evidence-first website security assessment

OkamiScan is a defensive security posture platform for authorised, non-intrusive website reviews. It performs bounded passive checks, converts observable response evidence into deterministic findings, and produces professional remediation reports with optional GPT-5.6 enhancement.

Why it exists

Engineering teams often have to choose between simple header checkers with little context, intrusive scanners that are unsuitable for routine deployment reviews, and AI-generated reports that may invent unsupported vulnerabilities. OkamiScan addresses that gap by making deterministic, testable evidence the source of truth.

How it works

1. A user enters an HTTP or HTTPS target and explicitly confirms authorisation.
2. SSRF-aware validation rejects localhost, metadata endpoints, private or reserved addresses, unsafe redirects, unsupported protocols, and non-standard ports.
3. Independent passive detectors inspect bounded public HTTP and TLS responses.
4. Deterministic rules create findings, severity, confidence, evidence, remediation, technologies, and the risk score.
5. A complete deterministic report is persisted before any AI provider is called.
6. If OpenAI or Ollama is selected, the provider receives only bounded deterministic context and writes advisory explanation fields.
7. Schema and grounding validation reject unknown findings, contradictions, malformed output, or unsupported claims.
8. Every completed assessment belongs to an asset, enabling history, posture trends, new and resolved findings, and report comparison.

Responsible AI by architecture

AI is not the scanner. It cannot create findings, alter severity, change technical evidence, recalculate the score, or fabricate technologies and versions. The report records the selected provider, selected model, actual generator, and fallback reason. If AI is unavailable, times out, is rate-limited, or fails validation, the assessment still completes with the deterministic report.

This makes the integration auditable: GPT-5.6 improves executive explanations, engineering guidance, validation steps, rollback considerations, and remediation sequencing while remaining subordinate to typed evidence.

What the product includes

• Enterprise security posture dashboard
• Managed asset inventory
• Live passive assessment progress
• Detailed technical findings and evidence
• Historical comparisons and trend analysis
• Technology inventory
• Consultant-grade executive and engineering reports
• Print-friendly PDF export
• Deterministic, Ollama, and OpenAI report modes
• Judge-only hosted demo protected by signed sessions and durable rate limits

Passive assessment boundary

OkamiScan never performs exploitation, credential attacks, brute force, fuzzing, malware execution, persistence, or denial-of-service behavior. It only inspects publicly accessible HTTP and TLS resources within strict time, response-size, redirect, and concurrency budgets.

How Codex and GPT-5.6 were used

Codex was used throughout the entire development lifecycle of OkamiScan, from the initial architecture to the final production-ready implementation. Rather than generating isolated code snippets, it served as an engineering partner for designing features, implementing the passive assessment engine, refactoring the codebase, debugging complex runtime issues, improving type safety, validating security-sensitive logic, writing regression tests, and refining documentation.

Development followed an iterative workflow where Codex accelerated implementation while every architectural and security decision was reviewed, tested, and validated before being accepted. This significantly reduced development time while maintaining deterministic and auditable behaviour.

GPT-5.6 is integrated directly into the application through the OpenAI Responses API. After the deterministic assessment is completed, GPT-5.6 transforms the verified findings into consultant-grade executive summaries, engineering guidance, remediation sequencing, rollback considerations, and validation recommendations. The model never creates findings or modifies evidence, severity, technologies, or risk scores; it only explains already-verified deterministic results.

The production workflow was validated using an authorised assessment of https://okamisec.dev, where the completed report was generated using OpenAI GPT-5.6 (gpt-5.6-sol). The resulting report preserved every deterministic finding while adding grounded, evidence-based explanations suitable for both technical and non-technical audiences.

Testing

Judges can use the protected hosted environment at https://okamiscan.vercel.app. Shared credentials are provided separately in the submission's private testing field. The private repository contains setup instructions, sample/demo data, migrations, tests, and a zero-configuration local deterministic workflow.

Built With

• codex
• gpt-5.6
• next.js
• ollama
• openai-responses-api
• postgresql
• supabase
• tailwind-css
• typescript
• vercel
• vitest