Security Architects, Inc on Security Architects

Authinator3

Mon, 01 Jan 0001 00:00:00 +0000

Authinator is a web login gateway for firewalls: authenticate over HTTPS, click once, and your current IP address is granted passage through the firewall. Everyone else sees a wall.

It solves the classic remote-access dilemma. Leaving management ports (SSH, VPN, admin panels) open to the internet invites the whole world to knock; port-knocking schemes are brittle and awkward to use from a phone or a borrowed machine. Authinator replaces both with something anyone can operate: a login page.

Claudette

Mon, 01 Jan 0001 00:00:00 +0000

Claudette is a sandbox for running AI coding agents — like Claude Code — safely on your own machine. AI agents read web pages, READMEs, issue threads, and email while wielding real tools: your shell, your git credentials, your network. Claudette puts a security boundary around all of that, so an agent doing useful work can’t be turned into a liability by the untrusted content it reads.

It isn’t a research prototype. It’s the sandbox Security Architects uses to run AI coding agents in production, every day — including the work behind this very website.

Cone of Silence

Mon, 01 Jan 0001 00:00:00 +0000

Cone of Silence is our agent-pod service: your own always-on AI agent — Claude, working for you around the clock — running inside a hardened sandbox on a dedicated pod, reachable from your phone over Telegram. Message it like a person; it reads, researches, codes, and runs real tools — while everything it touches stays inside a security boundary we built and operate.

Always-on agents are the most exciting — and most exposed — thing happening in computing right now. Internet-wide scans this year found tens of thousands of personal AI agents running openly exposed, unsandboxed, with full access to their owners’ machines and credentials. The ecosystem’s defaults are convenience-first. Ours are not.

Truepost

Mon, 01 Jan 0001 00:00:00 +0000

Truepost is an email client that finally feels like the messaging apps you actually enjoy using: conversations grouped by people, chat-style bubbles, one composer — no more digging through stacked threads to find the latest reply. It works with the email you already have: Gmail, Yahoo, and Outlook, connected via OAuth2 and IMAP.

Trust you can see

Truepost treats sender identity as a security surface, not a cosmetic one:

The address is the identity; the display name is just a claim. A spoofer sending From: "Your Bank" <evil@attacker.example> gets a badge and identity derived from the address — the claimed name can never impersonate its way into the avatar.
Reputation-tinted sender tiles put a visible trust signal on every conversation — something mainstream clients simply don’t show.
One-click block and report. Senders you don’t want hearing from are gone in a tap.

Privacy-first

Your mail stays yours: no server-side scanning, no selling data, no training models on your inbox. Optional end-to-end encryption between Truepost users is on the roadmap.

1lan

Mon, 01 Jan 0001 00:00:00 +0000

1lan (“One LAN”) makes machines stuck behind NAT and firewalls reachable again — home servers, lab boxes, appliances in the field — by having each one dial home with a persistent reverse SSH tunnel to a relay server you own. Once connected, every client is one SSH command away, and selected service ports (web UIs, media servers, APIs) are reachable through the relay’s hardened HTTPS front end.

It’s the self-hosted answer to commercial tunnel and overlay services: no third-party relay in your traffic path, no proprietary agent, no subscription. The moving parts are deliberately boring — plain OpenSSH, a shell script, and a systemd unit — because boring is auditable.

Ozone (Legacy)

Mon, 01 Jan 0001 00:00:00 +0000

Ozone is Security Architects’ heritage product: a Host Intrusion Prevention System (HIPS) for Windows 2000, XP, and Server 2003 that protected server and client machines from both known and unknown attacks — including the worm epidemics of its day (Blaster, Sasser, MyDoom, Witty).

The idea

Unlike reactive products such as anti-virus and intrusion detection systems, Ozone did not rely on constantly updated databases of “bad behaviour” signatures. Instead it enforced good behaviour: explicit policy describing what each computer, application, and user is allowed to do — and nothing else. A web server may listen on port 80 and serve pages; it may not execute arbitrary programs or open connections to arbitrary hosts.

Introducing Cone of Silence: hardened agent pods

Tue, 21 Jul 2026 09:00:00 -0700

Today we’re opening early access to Cone of Silence — agent pods secure enough for the original Chief and Agent.

A pod is your own always-on AI agent: Claude, working for you around the clock on a dedicated, hardened machine, reachable from your phone over Telegram. Message it like a person; it reads, researches, codes, and runs real tools — while everything it touches stays inside a security boundary we built and operate.

Tens of thousands of exposed AI agents — sandboxing must be the default

Sat, 18 Jul 2026 10:00:00 -0700

The always-on personal AI agent is the most exciting thing happening in computing right now — and the most exposed. Between late January and early February of this year, Bitsight’s internet-scale scanning observed more than 31,000 distinct exposed instances of the most popular personal-agent stack, listening on its default port across technology, healthcare, finance, government, and insurance networks. Independent scanning teams reported even larger numbers, including thousands of instances vulnerable to remote code execution.

Authinator3 is now open source

Tue, 14 Jul 2026 10:00:00 -0700

We’ve published the core of Authinator3 as open source under the ISC license: gitlab.com/jowolf/authinator3.

Authinator is a web login gateway for firewalls. Authenticate over HTTPS, click once, and your current IP address is granted passage through the firewall — everyone else sees a wall. It replaces both permanently-open management ports and brittle port-knocking schemes with something anyone can operate from a phone: a login page.

Authinator has guarded our own production gateways in one form or another since 2007. Authinator3 is the modernized cross-platform release: a single self-contained Go binary per platform, driving OpenBSD pf tables (confined by pledge/unveil, no sudo, no shell calls) or Linux nftables sets (under a locked-down systemd service). Default-deny, explicit allow, with an audit view of every address currently cleared through.

About

Mon, 01 Jan 0001 00:00:00 +0000

Security Architects was founded in San Diego, California in 1999.

The company offers advanced security solutions to organizations and individuals needing to secure their networks and systems — security products alongside professional services ranging from penetration testing and code auditing to tailor-made security courses.

Our original flagship product, Ozone, was a Host Intrusion Prevention System (HIPS) that protected server and client machines from both known and unknown attacks. Rather than chasing an endless stream of “bad behaviour” signatures, Ozone enforced good behaviour — a least-privilege, policy-driven approach that anticipated today’s zero-trust and application-allowlisting technologies by two decades. In 2004 the Ozone agent was released free of charge, kernel source code included.

Contact

Mon, 01 Jan 0001 00:00:00 +0000

For additional information, email us:

info@securityarchitects.com

Please include your contact information, what you’d like us to consider doing for you, your required timeframe, and the scope or budget for your needs.

You will be contacted within one business day.

Privacy Policy

Mon, 01 Jan 0001 00:00:00 +0000

Effective date: July 10, 2026

Security Architects, Inc (“we”) operates securityarchitects.com. We keep data collection to a minimum.

What we collect

Nothing directly. This is a static website. We do not require accounts, do not set cookies, and do not run analytics or advertising trackers.
Hosting logs. The site is served by GitLab Pages, whose infrastructure may record standard web server logs (IP address, user agent, pages requested) for operational and security purposes. See GitLab’s privacy policy for details.
Email. If you contact us at info@securityarchitects.com, we receive what you send. We use it solely to respond to your inquiry and do not share it with third parties.

Purchases

When product checkout is available, payment is handled entirely by a third-party merchant-of-record payment processor. We never see or store your card details. The processor’s own privacy policy governs the payment transaction; this page will be updated to name the processor when checkout launches.

Services

Mon, 01 Jan 0001 00:00:00 +0000

Security Architects has built security products and advised organizations since 1999. We bring that builder’s perspective to consulting: we secure systems the way people who ship them would.

AI Security

Teams are shipping LLMs, RAG systems, and autonomous agents faster than the security practices around them have matured. The attack surface is genuinely new — prompt injection, tool abuse, training-data poisoning, agent sandbox-escape — and most of it doesn’t yield to traditional controls. This is our focus, and we come to it as practitioners: we build our own hardened agent sandbox, Claudette, and run AI coding agents in production under it every day.

Vintage

Mon, 01 Jan 0001 00:00:00 +0000

This is the original Security Architects website — also known as secarch.com — as it ran in the 2000s, preserved byte-for-byte for historical interest: table layouts, image-rollover menus, and all.

Enter the vintage site →

Highlights of the era:

Ozone — our Host Intrusion Prevention System, with its technology overview and FAQ
The Ozone white paper (PDF)
The Ozone agent kernel source, released free in 2004
The services we offered then — most of which we still offer today

Note: the original Windows agent installer is no longer distributed from this site. The kernel source archive remains available above. The modern retelling of the Ozone story lives on our products page.