OkamiScan

The description states that OkamiScan is a defensive security posture platform for authorised, non-intrusive website reviews. It performs:

• Bounded passive checks
• Deterministic findings based on observable HTTP and TLS responses
• Professional remediation reports with optional GPT-5.6 enhancement

It does not perform exploitation or intrusive behavior — only inspecting publicly accessible HTTP/TLS resources within strict limits.

The product includes:

• Enterprise security posture dashboard
• Managed asset inventory
• Live passive assessment progress
• Detailed technical findings and evidence
• Historical comparisons and trend analysis
• Technology inventory
• Consultant-grade executive and engineering reports
• Print-friendly PDF export
• Deterministic, Ollama, and OpenAI report modes

It also features a judge-only hosted demo protected by signed sessions and durable rate limits.

Claim: The platform integrates GPT-5.6 only for advisory explanation fields after deterministic assessment is complete.

Evidence: The description explicitly states that AI cannot create findings, alter severity, change technical evidence, recalculate the score, or fabricate technologies and versions.

The author positions OkamiScan as a solution addressing a gap in current tools:

• Simple header checkers with little context
• Intrusive scanners unsuitable for routine deployment reviews
• AI-generated reports that may invent unsupported vulnerabilities

It is described as an evidence-first tool where deterministic findings are the source of truth.

Claim: The product makes deterministic, testable evidence the source of truth.

Evidence: Stated in the write-up under "Why it exists".

Claim: AI is not the scanner; it enhances explanations only.

Evidence: Explicitly described as a “responsible AI by architecture” principle.

The description does not name specific customers or personas. However, it implies:

• Engineering teams who need to review website security
• Organisations requiring non-intrusive assessments
• Users seeking consultant-grade reports with executive and engineering guidance

Claim: The target audience is engineering teams needing secure, non-intrusive reviews.

Evidence: Implied from the problem statement and use case.

No information about pricing or business model is provided in the description. It does not state whether OkamiScan is a SaaS offering, a freemium tool, or a one-time product.

Claim: No pricing or monetization details are available.

Evidence: Not evidenced.

The author reports:

• Built with: codex, gpt-5.6, next.js, ollama, openai-responses-api, postgresql, supabase, tailwind-css, typescript, vercel, vitest
• Development workflow involved Codex throughout the lifecycle — from architecture to implementation and testing
• GPT-5.6 is integrated via OpenAI Responses API for advisory explanations only
• The system validates schema and grounding to reject unknown findings or contradictions

Claim: Codex was used as an engineering partner across all stages of development.

Evidence: Stated in the write-up.

Claim: GPT-5.6 is integrated after deterministic assessment, not during scanning.

Evidence: Explicitly described under “How Codex and GPT-5.6 were used”.

There is no evidence of revenue, customers, or adoption beyond the author’s own testing environment.

Claim: No traction data provided.

Evidence: Not evidenced.

The description does not mention competitors or market positioning relative to existing tools. It only describes a gap it aims to fill.

Claim: No competitive landscape or comparison with other tools is given.

Evidence: Not evidenced.

• Unverified claims: All information is self-reported and unverified.
• No evidence of traction or customers — only author’s own testing.
• AI integration is limited to advisory role, which may not be sufficient for some users seeking full automation.
• Single-person team — raises questions about scalability, maintenance, and long-term viability.

Inference: The lack of any customer data or revenue suggests early-stage development with no commercial traction.

Evidence: Absence of such data in the description.

1. What is the actual scope of your testing? Have you assessed real-world websites beyond your own?
2. How do you plan to scale beyond a single developer’s workflow?
3. Are there any plans for monetization or commercial partnerships?
4. Can you provide examples of how deterministic findings are generated and validated?
5. How does the system handle edge cases where passive checks fail or return ambiguous results?