TAKO://GUARDIAN :: THREAT CATALOG
what we catch
each tank shows a common threat pattern: what it is, what it can cost you, how tako checks for it, and the supported fix path. plain english, because you shouldn't need a security degree to protect your app.
broken access control
“the apex”change one number in a web address and read someone else's account. this is the most common hole in AI-built apps: every user can see every other user's data, and the owner never knows.
HOW TAKO FIXES IT :: the connected audit checks authorization logic and live database policies. on Guarded, you can arm a bounded two-test-account check with explicit consent.
leaked keys & passwords
“the blabber”your API keys, sitting in public code for anyone to copy. automated crawlers can find exposed credential patterns quickly and spend your credits or reach your data.
HOW TAKO FIXES IT :: tako checks public bundles and connected source for exposed credentials, shows the evidence safely, and can draft a scoped removal patch.
your AI agent turned against you (prompt injection)
“the lure”your app has an AI wired to email, code, and money. an attacker sends it a poisoned message that convinces it to hand over your data or spend your budget. it's the newest kind of attack, and nobody else defends against it for teams without a security engineer.
HOW TAKO FIXES IT :: tako reviews connected agent code and permissions for prompt-injection and excessive-tool risk. Guarded can run a bounded probe against an endpoint you explicitly name.
hostile input (SQL & command injection)
“the tunneler”a form field that lets a stranger run commands on your database or server. one crafted input and they're inside: reading tables, deleting rows, reaching your internal services.
HOW TAKO FIXES IT :: tako checks public behavior and connected code for unsafe input paths, then can draft a scoped validation or parameterization patch.
code injected into your pages (XSS)
“the defacer”user content that runs as code in your visitors' browsers: stolen sessions, fake login boxes on your own pages, malware served under your name.
HOW TAKO FIXES IT :: tako checks rendered pages and connected code for unsafe output and missing browser defenses, then can draft a scoped patch.
accidental data exposure
“the oversharer”your app spills its insides when poked: raw error messages shown to users, passwords written to logs, file storage left public. a free map of your app for anyone curious.
HOW TAKO FIXES IT :: tako checks public responses, storage exposure, and connected code for accidental leakage, with evidence and a scoped fix path where supported.
password guessing & runaway AI bills
“the swarm”bots guessing your users' passwords all night, and an unmetered AI endpoint hammered into a $3,000 bill by morning. no alarm goes off until the invoice arrives.
HOW TAKO FIXES IT :: tako flags missing rate limits, lockouts, and AI cost controls, then can draft a scoped fix when the affected code is connected.
compromised packages (supply chain)
“the drifter”a hacked or lookalike code package your AI installed without asking. your app becomes unsafe overnight with zero changes on your side.
HOW TAKO FIXES IT :: the connected audit reviews dependency manifests and risky package choices. threat-feed matches can queue monitored apps for a new check.