Question 1

Do you need access to my production traffic?

Accepted Answer

No. RiskVoid performs pre-deployment source analysis and does not sit in the production inference path. The analysis uses repository structure and code evidence rather than production traffic.

Question 2

How is this different from a runtime firewall?

Accepted Answer

Runtime firewalls block requests as they arrive, after the vulnerability has already been written, reviewed, and deployed. RiskVoid analyzes the source to stop the vulnerability from shipping in the first place. Use both; they live in different parts of the SDLC.

Question 3

How is this different from a general SAST tool?

Accepted Answer

RiskVoid adds agent-aware modeling for prompts, tools, resources, and supported relationships. It identifies candidate security-relevant flows under explicit analysis coverage instead of treating the graph as a complete runtime trace.

Question 4

What's the feedback loop with my repo?

Accepted Answer

The GitHub App can analyze selected repositories and pull requests. Findings link back to source evidence and remediation guidance, and a later analysis can show whether the relevant code pattern remains.

Question 5

Which severity scale do you use?

Accepted Answer

Five levels (critical, high, medium, low, and informational), mapped to CVSS 3.1 and OWASP LLM Top 10. Overrides are configurable per repo.

Question 6

Do you need my runtime secrets?

Accepted Answer

No. Do not provide runtime secret values. RiskVoid analyzes source and configuration structure; secret references may be identified as evidence without requiring production credentials.

prompt injection

The permission checks were working. The data left anyway.