Contact Open demo
Issues

Know what to fix first, and who owns it

nerl0 turns authority paths into issues, orders them by severity and impact on your questions, and recommends the smallest action that closes each one.

Open the demoRead the docs

Every finding, one recommended action

Open issues come first, ordered by severity and by their impact on the questions you track. Each one names the action that closes it.

All issues
OverviewOpen issuesClosed⌕⚙▥
Remove access ⓘ3 issues open
Reduce scope ⓘ2 issues open
Assign owner ⓘ0 issues open
Rotate secret ⓘ1 issues open
All issuesOpen issues first, ordered by severity and impact on your questions
#IssueSeverityStatusAuthority pathsAssigneeUpdated
1The AWS root access key can perform any action on any …Recommended action: Delete the root account access keyRemove accessCriticalIn progress1MCMaya Chentoday
2ops-automation-agent can write to production crown-je…Recommended action: Reduce scope of ops-admin on prod/paym…Reduce scopeHighNew1OHOmar Haddad09 Nov 07:00
3anthropics/claude-code-action in northstar-tech/platfor…Recommended action: Reduce scope of release-deployer on prod/…Reduce scopeHighNew1OHOmar Haddad09 Nov 07:00
Open work by recommended action
Issue · recommended action
Status
Severity
The AWS root access key can perform any action on any resource in the account
Recommended action: Delete the root account access key · Remove access
RemediateAssignCreate a ticket⛓⤓⋮

Detected: The AWS account has a root access key. The root user holds an access key; the root user is not bound by IAM policies and holds every action on every resource. Source: scan e07c354c-4aaa-4e30-b18f-8a1468449688 observed 2026-11-09T06:00:00Z, aws coverage complete.

SeverityCritical
Impact4 crown jewels ·not measurable
Authority paths14 authority paths
EvidenceProvenEvery step is an observed relationship: configured authority. Observed use is reported separately. 2 scans · reproduced
Platforms1 platform
Observed useNo use observedin 30 days of CloudTrail · verify before removing

One record per issue

What was detected, how it was proven, who owns it and what to verify before you remove anything.

Four kinds of action, nothing vague

Every issue carries one recommended action: remove access, reduce scope, assign an owner or rotate a secret.

Recommended actions
3Remove access · issues open
2Reduce scope · issues open
0Assign owner · issues open
1Rotate secret · issues open

From new to verified

Issues move from new, to in progress, to verified. You apply the change, the next scan proves it.

Smallest action firstYou apply the changeVerified by the next scanOwner on every issue
New3···  +
Updated 09 NovOH

ops-automation-agent can write to production crown-jewel prod/payments/stripe-key

HighReduce scopeAWS
Updated 09 NovOH

anthropics/claude-code-action in northstar-tech/platform can write to repositories

HighReduce scopeGitHub
Open–

Assign an owner to the unowned agent

MediumAssign owner
In progress1···  +
Updated todayMC

The AWS root access key can perform any action on any resource in the account

CriticalRemove accessAWS
Verified1···  +
ClosedMC

Rotated secret no longer reachable from other accounts

ClosedRotate secret

A finding without an owner is just a log line. Make it an issue and close it.

Issuesnerl0 · Know what to fix first

Non-human.
Non-negotiable.

See how nerl0 worksView docs →

Fix the path that matters first.

Open the demoTalk to us