Op2ra → the code surface
Code · rima — a crack, a chink, the gap a thing escapes through

Rima

Rima is not a security audit and the page says so before the price does. It finds secrets that should not be committed, and failure paths that swallow their own errors. It does not probe running systems, does not test exploitability, and produces nothing usable against a third party.

Does the software’s operational behaviour support what it claims — or does it report success while swallowing the errors that say otherwise?

defensive only

The situation

Two checks, chosen because they are high-precision and commonly missed.

The second check exists because of a bug in our own repository. A calibration script wrapped its corpus loaders in a broad try/except that printed one line and continued. A schema mismatch silently dropped an entire corpus from the evidence base for a whole working session. The script said so, in a wall of output, and nobody read it. A swallowed exception is not a style problem — it is a measurement problem. The system reports success while doing less than it claims, and every number downstream inherits that without a footnote.

$ nullius code ./src code audit ============================================================== files scanned 125 (28 Python, 110,798 lines) probable committed secrets 0 silent failure paths 5 files matching 'test' 2 -------------------------------------------------------------- FINDINGS -------------------------------------------------------------- [WARNING ] SWALLOWED_EXCEPTIONS: 5 handlers catch broadly and neither re-raise nor log. Most concentrated in calibration/calibrate.py (2)

What it checks

Four questions, asked in the same order every time.

  • Committed secrets — eight high-precision patterns — AWS keys, GitHub and Slack tokens, private key blocks, Stripe live keys — with placeholder filtering and an entropy floor on the loosest rule. A scanner with a high false-positive rate gets muted within a week, and a muted scanner is worse than none because it is believed to be running
  • Silent failure paths — an AST pass over every handler that catches broadly and neither re-raises nor logs. Reported with the file they concentrate in
  • Regression surface — whether anything here can be regression-checked at all. If there are no tests, no finding in the report can be pinned

Run against our own repository

125
files scanned
5
silent failure paths
0
committed secrets
1
bug it found in itself

The last number is the honest one. The first version of this module detected five swallowed handlers, counted them in a measure, and then built its report without passing the findings through. It printed “no findings” over five it had already found — the exact failure this suite exists to catch, in the module written to catch it. The fix was one line. The response was a rule in the shared contract: a report with an empty findings list now refuses to construct, because “nothing found” is a conclusion and has to be stated, not inferred from silence.

What this audit cannot see

The section a competent buyer reads first.

Every report this product emits ends with its own version of this list, generated from the run rather than written by hand. A report cannot be constructed without one — the validator refuses.

  • secrets already in git history. This reads the working tree only — a key deleted in the last commit is still in the history and still valid
  • whether a found secret is live. No credential is tested against any service; that would be probing systems, which this deliberately does not do. Assume live and rotate
  • everything a security review would actually cover — no dependency CVEs, no authorisation logic, no injection analysis, no infrastructure. This is two checks, and it is not a substitute
  • whether a swallowed exception matters. Some are correct. The audit flags the pattern and a human decides; ranking them by severity would be inventing a confidence it has not calibrated
  • how far the calibration goes. Measured against <strong>38 labelled fixtures</strong>: 11/11 credential formats detected with no false alarms on 14 high-entropy non-secrets — git SHAs, UUIDs, lockfile hashes, docker digests, minified bundles — and 7/7 silent handlers with no false alarms on 6 that route the error. That is a <strong>constructed fixture set, not a sample of real repositories</strong>, and 100% over 38 cases means no known failure mode rather than none. It is the weakest of the four calibrations here and the documents surface, at 59 labelled suites over 7 real corpora, is the one to compare it against

Engagements

Fixed scope, fixed price, and a report you can argue with.

Free

Browser audit

The documents surface, running in your browser — the real engine, installed into the page. Nothing is uploaded, because there is no server to upload it to. Or send one artifact and we will look at it: you get the finding either way, including if the finding is that nothing is wrong.

Fixed

One surface, two to three weeks

One product run against your artifacts, with a written report: measures, findings by severity, the resolution floor, and the limits. The price is fixed before the work starts and quoted from the size of your company, not from how the conversation goes.

Quote

Multiple surfaces

Where it gets interesting — the findings on one surface routinely explain the numbers on another.

The rest of the suite

Five surfaces, one decision procedure. Each deploys separately, so one product's failure cannot take another down.

ProductSurfaceIn one line
NulliusdocumentsYour retrieval score is measuring your wording.
AuctusgrowthMost campaign wins are smaller than the experiment could see.
FiscusmoneyFinding the savings is the easy half. Proving one happened is the other.
ArbolassistantThe layer that answers from your documents, and shows you which ones.

Send one artifact.

One test set, one experiment, one statement export, one repository. The first look costs nothing and the finding is yours either way.

rishabh@op2ra.com