# WarHoundAI

WarHound AI builds security tools for developers and teams. Mini Hound is live with Free and Plus plans for public website code review. BloodHound is the larger product in development.

BloodHound is the larger, more powerful security product WarHound AI is developing. Mini Hound is the smaller public version you can use now for read-only checks of public website code.

Mission: Make intelligent application security accessible to the developers and teams building the next generation of software.

Mini Hound is live with Free and Plus plans. Entitled API/MCP access is available; broader BloodHound assessments remain in development.

- [WarHound AI API and MCP](https://warhoundai.com/docs/api/): Connect WarHound account API keys to MCP, public-source fetching, reference search, isolated browser control and evidence-based security reviews.
- [About WarHoundAI](https://warhoundai.com/about/): Meet WarHoundAI, the Cybersecurity AI company led by Founder & CEO Rajauddin Karimulla in Nehtaur, India, and learn about our mission and BloodHound.
- [Contact WarHoundAI](https://warhoundai.com/contact/): Contact WarHoundAI for product, business, privacy, or security questions. Find our company-domain email and company information for Nehtaur, India.
- [Security, with clear boundaries.](https://warhoundai.com/security/): Read WarHoundAI’s current website safeguards, planned BloodHound security principles, authorized-testing approach, and responsible reporting guidance.
- [Privacy notice](https://warhoundai.com/privacy/): Understand WarHoundAI’s account and analytics data, service providers, retention practices, browser privacy signals, and account deletion requests.
- [Website terms](https://warhoundai.com/terms/): Read the terms for WarHoundAI’s public website and account features, including product previews, authorized use, public crawling, and contact information.
- [The team behind WarHound AI.](https://warhoundai.com/team/): Meet Rajauddin Karimulla, Founder & CEO of WarHound AI in Nehtaur, India. View his LinkedIn profile and learn who is building BloodHound.
- [Application security for the teams building software.](https://warhoundai.com/business-model/): Learn who WarHound AI serves, how BloodHound is intended to deliver value, and our planned SaaS subscription and usage-based API revenue model.
- [Choose your plan.](https://warhoundai.com/pricing/): Compare Mini Hound Free at $0.00/month and Plus access at $4.99 USD for one month. See credit grants, model options, reasoning and token prices.
- [Mini Hound is live.](https://warhoundai.com/product-status/): Mini Hound is launched with Free and Plus plans. See its limits, measured tests, and how it differs from the larger BloodHound product still in development.
- [Acceptable use policy.](https://warhoundai.com/acceptable-use/): Rules for authorized Mini Hound website reviews, ownership verification, prohibited content, safe collection and responsible reporting.
- [Meet Mini Hound.](https://warhoundai.com/mini-hound/): Review public website code with Mini Hound. Get source evidence, security explanations and suggested fixes. Free plan includes $0.50 in monthly credits.
- [50 seeded flaws. Measured results.](https://warhoundai.com/mini-hound/benchmarks/): Plus Soft identified 49 of 50 planted source issues; 0 false positives across 10 fixed controls. Read the cases, failed attempts, fixes and method.
- [BloodHound by WarHoundAI: our security agent](https://warhoundai.com/bloodhound/): Explore BloodHound by WarHoundAI: planned AI security testing capabilities, discovery-to-remediation workflow, integrations, examples, and current availability.
- [Application security for teams building with AI](https://warhoundai.com/guides/): Use practical AI application security guides and reusable review templates for access control, secrets, AI tools, MCP, and safe release decisions.
- [MCP security: review permissions, tokens, and tools](https://warhoundai.com/guides/mcp-security/): Review MCP security across tool permissions, token audience, consent, local processes, prompt injection, network boundaries, and safe integration testing.
- [Archive extraction: traversal, symlinks and resource exhaustion](https://warhoundai.com/blog/zip-extraction-quotas/): Learn to secure application archive extraction against path traversal, symlink attacks, and zip bombs using strict quotas and safe test matrices.
- [WebSocket authentication and message authorization](https://warhoundai.com/blog/websocket-session-authorization/): Implement robust WebSocket security by mastering origin validation, initial handshake authentication, session lifecycle management, and message authorization.
- [Retesting security fixes with positive and negative controls](https://warhoundai.com/blog/vulnerability-retest-controls/): Learn how to validate security fixes using positive and negative controls in an authorization matrix, preventing regressions and ensuring robust access rules.
- [Tenant isolation with PostgreSQL row security](https://warhoundai.com/blog/tenant-isolation-postgres-rls/): Implement secure tenant isolation using PostgreSQL Row-Level Security. Learn concrete patterns, failure modes, and test matrices for multi-tenant applications.
- [Secure server-sent events and reconnect handling](https://warhoundai.com/blog/sse-authorization-disconnects/): Learn how to handle authorization and state during Server-Sent Events (SSE) reconnections, including Last-Event-ID management and implementation tradeoffs.
- [SQL injection: parameterization beyond the obvious query](https://warhoundai.com/blog/sql-injection-parameterization/): Move beyond basic prepared statements. Learn how to secure stored procedures, ORM queries, and dynamic identifiers against SQL injection vulnerabilities.
- [Session cookies: rotation, expiry and browser boundaries](https://warhoundai.com/blog/session-cookie-hardening/): Examine session cookie management and defense in depth for web applications. Understand secure cookie attributes, state limitations, and session lifecycle strategies.
- [Build release security gates around testable invariants](https://warhoundai.com/blog/security-review-release-gates/): Implement deterministic release security gates using testable invariants, aligning with OWASP ASVS v5.0.0 requirements for scalable application verification.
- [Account deletion, session revocation and retention boundaries](https://warhoundai.com/blog/secure-account-deletion/): Examine account deletion mechanisms, session revocation, and data retention limits. Understand implementation tradeoffs for secure session management.
- [Designing Safe Synthetic Accounts and Security-Test Fixtures](https://warhoundai.com/blog/safe-security-test-fixtures/): Learn how to build safe synthetic accounts and test fixtures for application security testing, balancing coverage with production safety and data isolation.
- [Measure reasoning-token costs without weakening hard budgets](https://warhoundai.com/blog/reasoning-token-cost-budgets/): Learn how to measure reasoning token usage and enforce strict hard budgets in LLM applications without compromising system stability or predictability.
- [Rate limiting across replicas and expensive API operations](https://warhoundai.com/blog/rate-limiting-distributed-apis/): Architectural strategies for rate limiting distributed API replicas, isolating expensive operations, and mitigating application-layer denial of service.
- [Test entitlement races with controlled concurrent requests](https://warhoundai.com/blog/race-condition-entitlements/): Learn how to systematically test entitlement race conditions and configure PostgreSQL transaction isolation levels to prevent concurrent access anomalies.
- [Tenant boundaries in queue workers and job payloads](https://warhoundai.com/blog/queue-worker-tenant-boundaries/): Enforce robust tenant boundaries in queue workers, safely propagate tenant context in asynchronous job payloads, and prevent cross-tenant data leakage.
- [Forwarded headers: trust the proxy, validate the boundary](https://warhoundai.com/blog/proxy-forwarded-header-trust/): An evergreen verification guide on boundary validation and response headers, addressing the lack of corroborated evidence for proxy forwarded headers.
- [Presigned Uploads Need a Server-Side Completion Check](https://warhoundai.com/blog/presigned-upload-validation/): Learn why presigned file uploads require a server-side completion check and how to securely implement post-upload validation based on OWASP guidelines.
- [Payment webhooks and the entitlement state machine](https://warhoundai.com/blog/payment-webhook-state-machine/): Architect robust entitlement state machines for payment webhooks, handling idempotency, out-of-order delivery, and cryptographic validation safely.
- [Path traversal defenses for file download handlers](https://warhoundai.com/blog/path-traversal-download-handlers/): Learn how application engineers can defend file download handlers against path traversal attacks using indirect references, strict validation, and test matrices.
- [Object Storage Authorization and Short-Lived Download Links](https://warhoundai.com/blog/object-storage-download-authorization/): Implement secure object storage authorization using short-lived download links. Explore test matrices, ABAC principles, and tradeoffs for application engineers.
- [OAuth authorization code security: PKCE, state and redirect URIs](https://warhoundai.com/blog/oauth-pkce-state-validation/): Implement RFC 9700 OAuth 2.0 security practices. Master PKCE, strict redirect URI validation, and state parameters to prevent code injection and CSRF.
- [NoSQL injection and typed query construction](https://warhoundai.com/blog/nosql-injection-validation/): Explore the mechanics of NoSQL operator injection, safe typed query construction, test matrices, and implementation tradeoffs for application engineers.
- [MFA recovery is an authentication flow](https://warhoundai.com/blog/mfa-recovery-design/): Treating MFA recovery as a secondary authentication flow is crucial. Explore design tradeoffs, test matrices, and secure implementation patterns for engineers.
- [MCP tools: separate discovery from permission to act](https://warhoundai.com/blog/mcp-tool-permissions/): Learn how to secure Model Context Protocol implementations by strictly separating tool discovery from execution permission, mitigating SSRF and confused deputies.
- [MCP authorization: validate token audience and avoid passthrough](https://warhoundai.com/blog/mcp-token-audience/): Implement Model Context Protocol authorization securely by validating token audiences and preventing token passthrough to mitigate confused deputy vulnerabilities.
- [Implementing Robust JWT Validation and Zero-Downtime Key Rotation](https://warhoundai.com/blog/jwt-validation-key-rotation/): Implementing zero-downtime JWT signing-key rotation requires strict validation controls and robust JSON Web Key Set caching to prevent authorization failures.
- [Idempotency keys for asynchronous jobs and retries](https://warhoundai.com/blog/idempotent-job-submission/): Learn how to implement idempotency keys for asynchronous jobs, safely retry failed requests, and prevent duplicate state changes in distributed systems.
- [HTTP caching for authenticated and private responses](https://warhoundai.com/blog/http-cache-private-responses/): Learn how exactly HTTP caching operates with authenticated requests, private responses, tradeoffs, and failure modes according to RFC 9111.
- [Host Header Validation and Account Recovery URLs](https://warhoundai.com/blog/host-header-reset-links/): Examine the risks of dynamically generating password reset links using the HTTP Host header and learn safe validation patterns for account recovery mechanisms.
- [GraphQL Subscriptions Require Ongoing Authorization](https://warhoundai.com/blog/graphql-subscription-authorization/): Learn why GraphQL subscriptions require ongoing authorization, including concrete test matrices, trade-offs, and implementation strategies for application engineers.
- [Preserve a useful evidence chain for security findings](https://warhoundai.com/blog/finding-evidence-chain/): Learn how application engineers can build and preserve useful evidence chains for security findings to ensure actionable remediation without relying on generic scan output.
- [Email verification codes: expiry, retries and replay](https://warhoundai.com/blog/email-otp-replay-prevention/): Examine implementation tradeoffs for email verification codes, covering expiry windows, retry exhaustion limits, and replay prevention test matrices.
- [Preventing DOM XSS at Rendering Boundaries: A Technical Guide](https://warhoundai.com/blog/dom-xss-safe-rendering/): A technical guide for engineers on preventing DOM-based XSS by utilizing safe rendering boundaries, context-aware encoding, and secure DOM population methods.
- [Dependency lockfiles and safe security updates](https://warhoundai.com/blog/dependency-lockfiles-updates/): Learn how to enforce deterministic builds using dependency lockfiles, evaluate third-party software updates, and implement safe test matrices for CI/CD pipelines.
- [Database migrations: preserve permissions and verify rollback](https://warhoundai.com/blog/database-migration-security/): Secure database migrations require strict privilege preservation and verifiable rollbacks. Learn how to safely manage PostgreSQL access controls and deployments.
- [Least-privilege database roles for web applications](https://warhoundai.com/blog/database-least-privilege/): Implement least-privilege PostgreSQL database roles for web applications to minimize impact. Discover tradeoffs, failure modes, and a synthetic test matrix.
- [CSRF protection for modern JSON APIs](https://warhoundai.com/blog/csrf-protection-json-apis/): Implement robust CSRF defenses for JSON APIs using signed double-submit cookies and Fetch Metadata headers. Includes a concrete test matrix and failure modes.
- [Concurrent credit wallets: reserve, settle and reconcile](https://warhoundai.com/blog/credit-wallet-reservations/): Design concurrent credit wallets using PostgreSQL explicit locking. Learn the reserve, settle, and reconcile pattern with safe test matrices and failure modes.
- [Rotate credential-encryption keys without losing saved connections](https://warhoundai.com/blog/credential-encryption-key-rotation/): Implement safe credential encryption key rotation strategies, including envelope encryption and multi-key tracking, without dropping active user connections.
- [CORS configuration without misplaced trust](https://warhoundai.com/blog/cors-origin-policy/): Implement Cross-Origin Resource Sharing securely by avoiding blind origin reflection, understanding pre-flight limits, and enforcing strict allow-lists.
- [Roll out a Content Security Policy without hiding breakage](https://warhoundai.com/blog/content-security-policy-rollout/): Learn how to deploy a Content Security Policy without risking unexpected site breakage using Report-Only mode, hashes, and a controlled testing matrix.
- [Container runtime hardening for application workers](https://warhoundai.com/blog/container-runtime-hardening/): Technical guide to securing container runtimes, covering privilege reduction, filesystem immutability, firewall bypasses, and safe test matrices.
- [Keep user data out of command execution](https://warhoundai.com/blog/command-execution-boundaries/): Learn how to defend against OS command and argument injection by enforcing strict execution boundaries, using process APIs, and validating inputs.
- [Replace stored cloud keys with workload identity](https://warhoundai.com/blog/cloud-workload-identity/): Replace vulnerable static cloud keys with Workload Identity Federation. Learn how to map attributes and test cross-cloud access for AWS and Azure.
- [Secure cancellation and resumable job checkpoints](https://warhoundai.com/blog/cancellation-checkpoints-security/): Learn how to securely manage cancellation requests and resumable checkpoints for long-running jobs to prevent authorization bypass and state corruption.
- [Keep shared caches from crossing tenant boundaries](https://warhoundai.com/blog/cache-tenant-isolation/): Secure shared caches in multi-tenant applications using explicit namespaces, pre-cache authorization checks, and comprehensive testing matrices.
- [Business-logic testing with explicit state transitions](https://warhoundai.com/blog/business-logic-test-matrices/): Learn how application engineers can systematically test business logic using explicit state transitions, safe test matrices, and bounded verification workflows.
- [Audit logs that help investigations without collecting secrets](https://warhoundai.com/blog/audit-logs-secret-redaction/): Learn how to structure application audit logs that capture critical security events while strictly redacting credentials, access tokens, and sensitive PII.
- [Design API key issuance, rotation and revocation](https://warhoundai.com/blog/api-key-rotation-revocation/): Learn to design robust API key issuance, automated rotation, and revocation processes for modern applications using clear architectural patterns.
- [Treat AI tool results as untrusted evidence](https://warhoundai.com/blog/ai-tool-output-injection/): AI models are susceptible to prompt injection. Learn how to securely handle AI tool output, validate data, and apply defense-in-depth strategies.
- [Network isolation for browser and AI-agent workers](https://warhoundai.com/blog/ai-agent-egress-isolation/): Implement robust egress isolation for AI agents and browser workers to prevent SSRF vulnerabilities using strict IP pinning and parser differential handling.
- [Webhook Security: Signatures, Replay Checks, and Idempotency](https://warhoundai.com/blog/webhook-signature-replay-protection/): Learn how to secure webhook endpoints using HMAC signatures, implement replay protection, and build robust idempotent event handlers for reliable integrations.
- [SSRF prevention for URL imports: validate every connection](https://warhoundai.com/blog/ssrf-url-import-security/): Prevent Server-Side Request Forgery in URL imports by resolving parser discrepancies, defeating DNS rebinding, and strictly validating every connection endpoint.
- [Secure file uploads beyond extension checks](https://warhoundai.com/blog/secure-file-upload-pipeline/): Explore comprehensive file upload security, covering signature validation, storage isolation, content reconstruction, and implementation failure modes.
- [Password reset security: the complete token lifecycle](https://warhoundai.com/blog/password-reset-token-lifecycle/): Master the password reset token lifecycle. Review token generation, timing attacks, atomic consumption, and safe testing matrices for application engineers.
- [GraphQL security: authorize resolvers and bound query work](https://warhoundai.com/blog/graphql-security-resource-budgets/): Examine GraphQL field authorization, query complexity budgets, batching limits, and safe validation strategies for developer-facing APIs.
- [PHP’s October 2026 RCE fixes: what application teams should verify](https://warhoundai.com/blog/php2shell-october-2026-patching-guide/): Verify your PHP environments against the October 2026 remote-code-execution vulnerabilities using our runtime rollout and test matrix guide.
- [Valid API Logins Are Not Enough: An Evergreen BOLA Verification Guide](https://warhoundai.com/blog/meari-api-authorization-fixes-october-2026/): When reports of specific API authorization flaws lack verifiable sources, security teams need this evergreen guide to test and prevent BOLA vulnerabilities.
- [How we plan to pursue BloodHound’s reliability, accuracy and speed targets](https://warhoundai.com/blog/bloodhound-reliability-accuracy-speed-targets/): Our engineering approach to BloodHound’s 99.9% uptime, 24/7 monitoring, 99.9% finding accuracy, and 5x speed targets—and the required evidence to prove it.
- [What Is WarHoundAI? Our Company, Mission & Focus](https://warhoundai.com/blog/what-is-warhoundai/): Discover WarHoundAI, our mission to secure AI-generated software, Mini Hound capabilities, safe test matrices, and our approach to autonomous security.
- [Vibe Coding Security Checklist for AI-Built Apps](https://warhoundai.com/blog/security-checklist-ai-built-apps/): Review secrets, authentication, authorization, and boundaries before deploying AI-built web apps. Includes a safe test matrix and implementation tradeoffs.
- [Protect API Keys in AI-Built Apps: Storage & Rotation](https://warhoundai.com/blog/protect-api-keys-ai-built-apps/): Keep private API keys out of frontend bundles, prompts, and logs. Learn practical storage, access, detection, and rotation steps for AI-built applications.
- [Prompt Injection in AI Apps: Tool and Data Boundaries](https://warhoundai.com/blog/prompt-injection-ai-app-security/): Learn how prompt injection exploits AI applications through user input and retrieved content, and how tool permissions and trusted controls limit its impact.
- [Introducing BloodHound: WarHoundAI’s Security Agent](https://warhoundai.com/blog/introducing-bloodhound/): Explore BloodHound, WarHoundAI’s planned autonomous security agent. Understand its intended workflows, current Mini Hound capabilities, and integration methods.
- [Define a Safe Scope for Authorized Website Security Testing](https://warhoundai.com/blog/authorized-security-testing-scope/): Prepare an authorized website assessment with explicit targets, a safe test matrix, request limits, and careful URL parsing to prevent SSRF vulnerabilities.
- [API Authorization Testing: A Practical Guide for SaaS Teams](https://warhoundai.com/blog/api-authorization-testing-saas/): Learn how to review object-level and tenant-level API authorization with controlled test accounts, explicit permission rules, and safe regression checks.
- [Agentic Security Testing vs Scanning: What Changes?](https://warhoundai.com/blog/agentic-security-testing-vs-scanning/): Understand agentic application security testing, its differences from automated scanning, and why evidence, scope, and human review matter.
- [Write Actionable Security Findings and Verify the Fix](https://warhoundai.com/blog/actionable-security-findings-remediation/): Turn a security observation into a useful finding with evidence, impact, remediation, ownership, and retesting that checks the fix and allowed behavior.
- [Ideas for building securely.](https://warhoundai.com/blog/): Read WarHoundAI security advisory analysis, BloodHound engineering updates, and practical application security guidance for modern development teams.
- [Website policy.](https://warhoundai.com/website-policy/): WarHound AI website policy: product scope, performance targets, benchmark methods, comparisons, privacy, account access and billing.