# AuditCanvas

- **Event:** [Meta Global AI Developer Hackathon](https://cerebralvalley.ai/e/meta-ai-developer-hackathon)
- **When:** Oct 26, 12:00 PM – Nov 4, 9:00 PM (EST)
- **Where:** Online
- **Team:** [Arafat rahman Arzu](https://cerebralvalley.ai/u/arxu)
- **GitHub:** https://github.com/lulitaxu/auditcanvas
- **Demo video:** https://www.youtube.com/watch?v=RIXRpLfCDAE
- **Gallery:** https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery
- **Page:** https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/2399

AuditCanvas turns real security evidence into verified, understandable remediation: a deterministic scanner gathers the evidence, and an AI auditor reasons over it — explaining impact, building evidence-checked attack chains, and arguing against its own findings before anything is presented as settled. Live demo: https://auditcanvas.vercel.app

Most scanners stop at a list of issues, with no proof, no sense of what an attacker would actually do with it, and no way to tell a real exposure from a false positive. AuditCanvas runs nine deterministic check groups modelled on the OWASP Web Security Testing Guide — security headers, TLS, cookies, CORS, exposed paths, exposure and secrets, client stack and CVE matching, email posture, and redirects and mixed content. Every check ends in Pass, Finding, Inconclusive, or Not assessed, and Inconclusive is never counted as a pass. Every result is backed by stored, redacted evidence with stable IDs.

Results render as an evidence graph — Assets → Observations → Findings → Fixes — so any finding can be traced to the exact headers, DNS answer, or certificate fields supporting it. Scoring is deterministic and printed in the report: Risk, Coverage, and Confidence. After a fix, a rescan produces a diff, and a finding is only called Resolved when fresh evidence re-ran its check to a verdict. Safety is specified, not hand-waved: an SSRF-safe fetch layer, per-scan budgets and caps, and DNS TXT ownership verification. Judge mode offers a one-click scan of a seeded, deliberately vulnerable demo target, plus preloaded sample reports. Reports export as a versioned evidence bundle and a fix-pack ZIP.

## More from Meta Global AI Developer Hackathon

- [Muse RAISE](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/2396)
- [RightOnTOp](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/2397)
- [Relay](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/2398)
- [self](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/2400)
- [BIO ZOO](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/2401)
- [Environment Memory](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/2402)

---

Markdown version of https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/2399. Site index for agents: https://cerebralvalley.ai/llms.txt · full text: https://cerebralvalley.ai/llms-full.txt