Demo · Verified agentic engineering
VORSYN, a data access control engine built with verified agentic engineering
An engine that checks who can read or modify which data, written by an AI agent and checked at every version.
The problem
Applications built with AI and no-code often expose data through a poorly written access rule, even when protection is enabled. Public example: CVE-2025-48757 (CVSS score 9.3, published May 30, 2025), for which a researcher found 303 insufficiently protected access points across 170 Lovable projects.
Sources: Intruder CVE Monitor ↗ · Superblocks ↗
What VORSYN does
It reads the app's code to understand what each table should allow, compares that with the real rules, measures access without reading any data, then provides the proof and the fix.
Version after version
| Version | Measured impact |
|---|---|
| v1.6 | Severity aligned with the real measurement, 51 automated tests passed. |
| v1.4 and v1.5 | Design overhaul, findings grouped together, VORSYN passes its own test (signups closed). |
| v1.3 | Reading the app's code, finding “unnecessary surface,” 120 files read, 9 calls detected. |
| v1.2 | Isolation test between two accounts, leak measured (one account reaches 2 of 2 rows belonging to another). |
| v1.1 | One-click validation per table, from about 70 clicks down to 2. |
| v1 | Audit of v0, 4 serious flaws and 5 blind spots fixed, 6 traps detected with their exact cause. |
| v0 | First oracle, 3 tables, 2 flaws detected. |
What this demonstrates
An AI agent wrote the code; each version was audited, measured and corrected before the next one.
An application to check?
Your role. Your business problem. Your current workflow.
Working remotely across France, Belgium, Switzerland, Luxembourg, Quebec, North Africa and West Africa, in French, English and Arabic.
me@karimmesloub.com