Security & AppSec
Trace one real code-origin question to a signed answer in minutes. Run a recall drill before you need a real one.
Trust starts upstream
AI-written code gets a birth certificate. When a model goes bad, we prepare the recall.
Headwater records which AI tool and model wrote which lines of code as signed, hash-only receipts. It keeps checking whether those lines are still alive, ranks your exposure when a model is found defective, and hands your auditors evidence they can verify without us.
The gap
AI writes the code.
git blame still names a human.
The tool and the model disappear the moment a commit lands. When a model is later found defective, or an auditor asks how a change was produced, nobody can answer the question that matters: which of our code did it write, and is that code still running?
17 alice@ def restore_from_snapshot(snapshot_id):
18 alice@ bucket = settings.BACKUP_BUCKET
19 alice@ blob = bucket.get(snapshot_id)
20 alice@ verify_checksum(blob)
21 alice@ return apply(blob)How it works
Four things, in order.
-
Receipt
Each contribution from a supported coding agent gets a receipt as it is written: tool, model, file and line range, and a hash of the code. Signed with sigstore keyless signing under the developer's verified identity; a receipt that is not yet signed is kept and marked unsigned, never upgraded.
-
Ledger
Receipts go into a hash-chained ledger with Merkle checkpoint seals, anchored to a public transparency log and to Bitcoin. Change one byte below the last anchored seal and the chain says so.
-
Survival
Headwater keeps checking whether those lines are still alive after edits, moves and refactors. Not what was generated. What survived.
-
Recall
When a model is found defective, one query finds every repository holding that model's surviving lines, ranks the exposure by exploitability — entry-point paths, sensitive APIs, repository criticality, and whether each hunk could be re-verified — and opens a quarantine pull request for the owner. A human decides what merges.
Recall
An advisory lands. You answer in seconds, not sprints.
Pick the model. Headwater finds every repository it holds receipts for where that model's lines are still alive as of the last check, ranks the exposure by exploitability, then prepares the recall: a pull request that adds a checklist and a tripwire test, touches no product code, and names every file, line range and receipt.
- ~2 s to map exposure across five test repositories in a recorded drill
- 95 s to open two quarantine pull requests
- 0 lines of product code changed by Headwater. Ever.
exposure · claude-opus-5drill
max exploitability per repository · recorded drill, 14 receipts, 5 test repos
[DRILL] Headwater recall: claude-opus-5 (all versions) — run #3
- + recall/RECALL_RUN3.md ranked checklist
- + recall/tripwire_run3.py fails while flagged code remains
A human decides what merges. Headwater never merges anything.
Evidence
Your auditors do not need a Headwater account.
Export a scoped bundle: receipts, hashes, chain proofs, the census of what was and was not observed, and a verify guide. Anything Headwater could not verify is marked unobserved or unverifiable. Grey, never green.
- 1
Check the manifest
Recompute the SHA-256 of every file in the bundle.
- 2
Check the signatures
Verify each receipt's sigstore bundle with open tooling: public-realm entries against the public transparency log, private-realm receipts against the roots shipped in the bundle.
- 3
Recompute the chain
Rebuild the row hashes and Merkle roots and compare the anchors.
- 4
Run the signed verifier
Nothing inside the bundle is meant to be run. Fetch headwater-verify-receipts.py from the Headwater release channel, verify its cosign signature first, then run it against the bundle. It prints the recomputed bundle fingerprint to compare with the one the ledger issued.
Slopsquat Guard
Catch the package that does not exist, before it installs.
AI assistants invent package names. Attackers register them. Guard checks npm and PyPI package names against the registry: in Claude Code a hook runs before the install and can deny it outright; for other tools it flags suspicious names added to package.json, requirements and pyproject files after capture, and hw guard check answers on demand.
ALLOW
WARN
BLOCK
A passing check does not certify that a package is safe. It certifies that it exists and is not a lookalike.
Who it is for
Built for the people who have to answer.
Platform engineering
One native agent per developer machine, hooks for Claude Code, Cursor, Codex CLI and Windsurf, and a server you run yourself.
Internal audit & assurance
Evidence you can reproduce, rendered for SOC 2, ISO 27001, SSDF, SOX ITGC and the EU AI Act, with the gaps stated.
What a receipt claims, and what it does not.
Hash, never code
Code and prompts leave the developer's machine only as salted SHA-256 fingerprints; the data format rejects anything else. What travels in plain text is metadata: repository, file path, line range, tool and model, timestamp and the developer's git identity — what a recall needs to know which file to fix and whom to notify.
Claims, not proof of authorship
A receipt records what the tool reported. Tiers state how strong the attribution is, and the honest "unattributed" bucket stays visible.
Floor and ceiling
Verified-alive lines are the floor. Attested lines are the ceiling. The dashboard shows both and never counts unobserved lines as alive.
Propose, never merge
Recall pull requests add a checklist and a tripwire. They edit no product code, and only a human can merge them.
Run a scoped pilot on repositories you own.
Six weeks, up to 25 developers, your repos and your tools. It ends with an evidence review and a recall drill your sponsor can judge.
[email protected]We reply from the same address. No forms, no analytics.