Module 1 · Policy Lie Detector
Your policy says 90 days. Production says 1,147.
Snitch reads your security policy, catches every promise production breaks, ships the fix, then sabotages a canary to prove it holds.
2.3Access keys shall be rotated at least every 90 days. 1,147 days old
3.1Customer data at rest shall be encrypted using AES-256. 493 / 493
3.2Data in transit over public networks shall use TLS 1.2 or higher. TLS 1.0 still on
4.1Audit logging shall be enabled in every cloud region. 17 / 17 regions
5.3Restores from backup shall be tested at least once per quarter. due in 8 days
7.1This policy shall be reviewed and approved at least once a year. 613 days ago
How it works
Catch it. Fix it. Prove it.
Read
Claude finds every “shall” in the PDF.
Compile
Each promise becomes a query.
Catch
Production gets cross-examined. Lies get stamped.
Fix
Snitch opens the fix. You merge it.
Prove
Snitch breaks a decoy canary on purpose and times the catch.
Demo
Every red line is a lie.
Click one for the proof, the query and the fix. Acme is made up.
Run 1,284 · 4 Nov 2026 · AWS, Okta, GitHub, Rippling
Try it
Put your policy on the stand.
Paste text or drop a PDF. Claude cross-examines every promise against a sample environment.
Runs on your Claude account. This page doesn't save your text.
The sample environment
Module 2 · Chaos engineering
Break it before an attacker does.
Snitch sabotages a canary, a decoy resource tagged for chaos, then times how long your controls take to catch it and fix it.
snitch-canary-bucket
privateTime since injection00:00