Verascope

The description states that Verascope is a tool that audits codebases for runtime behavior using four AI agents. It supports three input methods:

• A demo app
• A repository built and run in a sandbox
• A live URL (with authorization attestation)

It runs these inputs through:

1. Agent 1 – Code health & team risk
2. Agent 2 – Security, licensing & AI-vendor exposure
3. Agent 3 – Runtime behavior & disclosure (the main capability)
4. Agent 4 – Report synthesis

Agent 3 is described as the core feature: it reads a privacy policy, extracts claims about data sharing and third parties, then runs the product in a real browser environment and compares what happens at runtime with what was disclosed.

The tool is built using:

• Next.js (App Router)
• TypeScript
• Tailwind CSS
• shadcn/ui
• Google Gen AI SDK (Gemini)
• Vercel Sandbox
• Supabase + PostgreSQL
• Vite

It uses Codex and GPT-5.6 for development, with all major components built autonomously via goal-tracking mode.

Inference The product is described as a runtime behavior auditor that aims to close gaps between static code analysis and real-world data flows — particularly in compliance and privacy contexts.

The description positions Verascope as a tool for tech companies to catch undisclosed data flows and dark patterns before external investigators do. It builds on a specific incident involving affiliate attribution fraud, where the app overwrote referral credentials during checkout.

It evolved from an earlier version (v2) that misidentified the threat — focusing on consent banners rather than attribution override — to v3, which corrects this and sharpens its runtime detection engine.

Inference The tool is positioned as a compliance and risk mitigation solution for privacy-conscious organizations. It emphasizes transparency and internal discovery over external audits.

The description does not name specific customers or personas, but implies the target audience includes:

• Tech companies with compliance teams
• Product teams responsible for data handling and disclosure
• Legal and regulatory affairs departments

It targets those who may be subject to scrutiny from regulators or plaintiffs over undisclosed data flows.

Inference The ICP likely centers around mid-to-large tech firms with complex products, strong privacy policies, and exposure to legal or reputational risk from non-disclosed data practices.

There is no mention of pricing, business model, monetization strategy, or revenue streams in the description. The project is presented as a hackathon submission.

Not evidenced

The system uses:

• Next.js 14 (App Router)
• TypeScript
• Tailwind CSS
• shadcn/ui
• Google Gen AI SDK (Gemini)
• Vercel Sandbox for execution
• Supabase + PostgreSQL for data storage
• Vercel for deployment

Key technical decisions include:

• Use of Codex and GPT-5.6 for development
• SSRF guard with 34 assertions against DNS rebinding, private IPs, etc.
• Runtime behavior analysis using a plain Chromium browser (same across all modes)
• Citation-based reporting: every finding must have an exact file/line or command/output reference

Inference The tool is built for automation and reproducibility. It emphasizes traceability and reliability in its AI-driven findings.

There is no evidence of revenue, customers, usage metrics, or adoption beyond the author’s own demonstration and testing.

Not evidenced

No competitors are named or described. The description does not reference existing tools for runtime behavior auditing, privacy compliance, or data flow tracking.

Not evidenced

1. Unproven functionality: The tool is presented as a hackathon submission with no independent verification.
2. Browser posture limitations: All modes use the same Chromium instance, despite an original plan to differentiate them for user_url mode.
3. Incomplete feature set: Some tests were deferred due to missing API keys or time constraints.
4. Self-reported only: No external validation of claims, performance, or accuracy.
5. No pricing or monetization strategy: The tool is not described as a commercial offering.

Inference The project appears to be an experimental prototype with limited production readiness and unclear scalability or market viability.

1. What specific data or metrics support the claim that Agent 3 correctly identifies attribution-override fraud?
2. How does Verascope handle false positives in privacy policy extraction, especially when claims are vague?
3. Can you demonstrate a full scan against a real, non-demo repository with actual runtime behavior?
4. Is there any plan to expand beyond the current sandboxed execution environment?
5. What is the expected accuracy rate of the runtime diff engine across different types of applications?
6. How does Verascope ensure that findings are not misinterpreted by users without technical expertise?