Continuous software protection & optimizationContinuous protectionHow it works

Prevent what breaks.Improve what runs.

Know which upstream changes reach your code, with evidence you can check.Know which upstream changes reach your code.

Public scanNo access needed

Press ↵ to scan

Public: scripts, headers, DNS your site serveswhat your site servesPrivate: read-only repository, with permissionread-only, with permission

The product

Two jobs. One evidence trail.

Protection tells you which upstream changes reach your code. Optimization shows what is worth improving. Both arrive with the sources behind them.Protection flags the changes that reach your code. Optimization shows what is worth improving.

app.auterim.com/app/protectionEXAMPLE

Northwind/ProtectionSearch⌘KSR

ProtectionContinuous checks on the dependencies your products use.Protected · 1 needs you

MONITORED12services across 2 productsCODE CHECKS38last 14 daysFOUND IN CODE2Supabase, OpenAIDRAFT PRS1tested, ready to open

Code checksLAST 14 DAYS

Checked, nothing in your codeFound in your code

NEEDS YOUR DECISIONLegacy API keys retired2 call sites · due 1 Feb 2027Relevant to youFound in your codeLive in ProductionTested fixDraft PROpen Draft PRReview change

Protection coverage11 / 12 dependenciesweb-appnorthwind/web · GitHub · VercelCoveredapinorthwind/api · GitHubAccess revoked on GitHubReconnect

Watches the official sources of

StripeTwilioSupabaseVercelOpenAIResendSentryCloudflareGitHubAuth0AblyAdyenAivenAlgoliaAmazon BedrockAmazon Web Services

From what you run to what you can prove.

01Understand/02Detect/03Optimize/04Verify

01Understand

Start with an honest map of what you depend on.An honest map of what you depend on.

Auterim builds an inventory of every package, provider and endpoint your software relies on, and which of your services uses each one. Public signals come from your site; private ones only from repositories you connect.Every package, provider and endpoint you rely on, and where it is used. Private signals only from repositories you connect.

northwind/checkout · main6 direct · 41 transitive · example

├stripe-node14.2.0api.stripe.com3 svc

├twilio4.23.0api.twilio.com1 svc

├@sentry/node7.112.0ingest.sentry.io4 svc

├@aws-sdk/client-s33.556.0s3.amazonaws.com2 svc

├date-fns2.30 · 3.6bundled · two copies2 svc

└pg8.11.3orders-db.internal1 svc

lockfile + imports read6 providers mapped

02Detect

Most upstream change is noise. Hear the few that reach you.Most change is noise. Hear what reaches you.

Providers and maintainers ship changes constantly. Auterim matches each one against your inventory and raises only those that touch code you run, with the source attached.Auterim matches each upstream change to your inventory and raises only what touches code you run.

Upstream events · one weekIllustrative

1ImpactStripe requires v1 webhook signaturesapi.stripe.com · Tue 14:02

2ChangedTwilio raises US SMS rate limitapi.twilio.com · Thu 11:48

3ChangedSentry SDK 8 released@sentry/node · Sat 09:30

Bundlenorthwind/webTwo copies of date-fns ship to every visitor

react-dom132 KB

next96 KB

date-fns@2.3038 KB

date-fns@3.641 KB

@supabase58 KB

zod14 KB

−38 KBestimatedTested fix · planned

QueryGET /ordersN+1 pattern on a hot endpoint31 → 2queries per request

GET /orders · p95 latencyMeasured outcome · plannedBefore · 840 msfix deployedAfter · 190 ms

03Optimize

Find the improvements worth making.

The same inventory reveals duplicated packages, version drift and costly patterns. Every finding states its expected effect and how it was measured, so you can rank by evidence rather than by hunch.Duplicated packages, version drift and costly patterns, each with its expected effect and how it was measured.

Bundle size/Query patterns/Caching/Version drift

04Verify

Act safely. Then confirm it worked.

Fixes arrive as reviewable pull requests and nothing ships without your approval. After deploy, Auterim re-checks against the original evidence, so “done” means verified, not merged.Fixes arrive as pull requests you approve, then get re-checked after deploy.

PR #482Use v1 webhook signaturesDraft

app/api/webhooks/stripe/route.ts +3 −1

12export async function POST(req: Request) {

13 const body = await req.text();

14 const sig = req.headers.get('stripe-signature');

15− const event = verifyLegacy(body, sig, SECRET);

15+ const event = stripe.webhooks.constructEvent(

16+ body, sig, process.env.STRIPE_WEBHOOK_SECRET

17+ );

18 return handle(event);

ProposedPR #482

Pull request opened with the diff and its evidence.

✓PR #482 opened · diff and evidence attached

Approvedrequired

A code owner reviews and approves.

StagedCI · 14 checks

Deployed to staging; your checks run.

Verifiedeu-west-1 · us-east-1

Original probe passes again in every region.

Nothing is marked verified until the original probe passes again after deploy.

Principles

Auterim proposes. You decide.

Four things Auterim is built never to do, so it can sit next to your code without taking it over.Four things Auterim never does to your code.

git merge

Never merges.Fixes arrive as Draft PRs. Someone on your team reviews and merges.

deploy --prod

Never deploys.Your pipeline ships, on your schedule. Auterim watches what reaches Production.

--force-verified

Never overclaims.Every step shows its evidence, or says plainly that evidence is missing.

notify --all

Never pages you for noise.Only changes that reach your inventory and code become alerts.

Integrations

Fits the tools you already ship with.

Connect a repository for code-level impact, a deployment platform for Production context, and send alerts where your team already works. Or start from the terminal.Your repository, your deploy platform and the places your team gets alerts.

GitHubImpact in code · Draft PRsVercelProduction deploymentsSlackAlerts in a channelLinearTasks from changesSentryProduction errorsCLInpx auterim connect

~/northwind/checkoutexample

$npx auterim connect✓Mapped northwind/checkout · 47 packages, 6 providers✓Derived dependency metadata uploaded$npx auterim status·Monitoring 9 dependencies · 1 change needs review!Stripe · v1 webhook signatures required · 3 call sites$

Pricing

Start with what matters. Grow into proof.

Every plan watches official sources and filters the noise. Pro adds verified impact in your code and tested fixes.Every plan filters the noise. Pro adds verified impact and tested fixes.

Core

$29/ monthKnow what matters.

1 protected product
Up to 20 monitored dependencies
Material-change filtering
Customer-specific impact
Deadlines & guidance
Protection reporting

Start protecting

ProMost popular

$79/ monthVerify it. Fix it.

Everything in Core
Up to 3 protected products
Up to 75 monitored dependencies
Up to 5 GitHub repositories
Verified impact in your code
Tested fixes, one-click Draft PR
30 fixes a month

Start 5-day Pro trialYour 5-day Pro trial starts when protection goes live.

Business

$199/ monthAutomate protection at scale.

Everything in Pro
Up to 10 protected products
Up to 250 monitored dependencies
Up to 25 GitHub repositories
Automatic Draft PRs per repo
500 fixes a month
Up to 50 team members

Start Business protection

Auterim never merges or deploys·You approve every Draft PR·Cancel any time

FAQ

Questions, answered.

Anything else? Write to the team from inside the app. A person answers.

No. Auterim starts from your website and the dependencies you confirm. Connecting a repository lets it verify impact in your actual code and prepare tested fixes on Pro and Business.

Not directly. Fixes arrive as Draft PRs for your team to review. Merging and deploying always stay with you.

Each upstream change from an official source is matched against your inventory (packages, providers and endpoints) and, where a repository is connected, the code that calls them.

Auterim says so. Every finding shows how strong its evidence is, and nothing is marked tested or verified without the run that proves it.

Your 5-day Pro trial starts when protection goes live, not when you sign up, so setup time does not count against it.

Yes. Invite members and set their roles in Settings. Business supports up to 50 team members.

Know what changed.Before it breaks.

Start with a public scan of your site. Connect a repository when you want proof in your code.Start with a public scan. Connect a repository for proof.

No access needed·You merge·5-day Pro trial

Public scan · no access neededDraft PRs only · you merge5-day Pro trial when protection goes live