Security skills for your coding agent, so it checks its work as it builds.
Pay once, updates included.
Your environment
Works in any repo your agent can read.
Build apps
Ship with security built in.
Context for your agent
Skills it reads before it writes.
my-app % npx surface add▍ ⠋ Licence key ••••-••••-••••-4821 ⠋ Fetching latest skills. ⠋ Writing files to .agents/skills - .agents/skills/surface-audit/SKILL.md - .agents/skills/surface-audit/references/controls.md - .agents/skills/surface-audit/references/report-format.md - .agents/skills/surface-threats/SKILL.md - .agents/skills/surface-threats/references/threat-models.md - .agents/skills/surface-vulns/SKILL.md - .agents/skills/surface-vulns/references/cvss-scoring.md - .agents/skills/surface-compliance/SKILL.md - .agents/skills/surface-compliance/references/frameworks.md - SECURITY.md Surface is ready. Ask your agent to read SECURITY.md and start building. my-app % ▍
Controls
The security controls to check, and a format for your self-review report.
Vulnerabilities
Finding weak spots in your code and scoring how serious they are with CVSS, the industry's standard scale.
Threats
Threat models for the kind of app you are building.
Compliance
Mapping your app to common compliance frameworks.
Solo founders shipping fintech apps, e-shops, games, dev tools and SaaS with a coding agent.
Skills for checking controls, threats, vulnerabilities and compliance, plus a SECURITY.md your agent reads first.
$89, once. Updates are included for the life of the product.
Yes. If Surface isn't for you, you can return it within 14 days of buying and we'll refund you in full. No questions asked.
Run npx surface add with your licence key, or download the ZIP.
The skills land in .agents/skills. Ask your agent to read SECURITY.md and start building.
Claude Code, Cursor, Codex, Berd, Grok Bot, or any agent that reads skills from .agents/skills.