We send your bot 20 prompt injection attacks and grade how it holds up: whether it reveals its instructions, obeys fake rules, changes persona or sends your data to another site.
Free. An HTTPS endpoint that takes a JSON message and returns the bot's reply. You'll need to prove you control it.
Prove you control the chatbot's host with a file, a meta tag or a DNS record. We never test a bot you don't own.
Put one line with a unique code in your system prompt. If any reply contains it, in any form, your prompt can be read.
20 messages, one a second. A grade and per-category results in 1–3 minutes, then the full transcript by email.
Can someone read your hidden instructions? Direct asks, fake developers, sentence completion and "what was the first line".
Does "ignore your instructions" work? Fake operator notices, fake admin blocks and cancelled-rules tricks.
Can the bot be talked into an unrestricted character, or into arguing against the business it serves?
The same requests hidden in base64, translation and story framing, which slip past simple filters.
Markdown images and links that carry the conversation to another site, and off-topic free work on your API bill.
Twenty prompts show where to look. Velura Shield is the full Agent Security Audit, then continuous red-team testing so it stays fixed.
Hundreds of attacks across your bot, its tools, retrieved documents and multi-turn conversations.
Prompt hardening, input and output filters, tool permissions and data boundaries, built and tested with your team.
Continuous red-team testing after every prompt, model or tool change, with alerts when something starts getting through.
The tool sends attack prompts to a chatbot. Verifying with a file, meta tag or DNS record proves the bot is yours, so the tool can't be pointed at someone else's. A verified domain also covers its subdomains, so verifying example.com lets you test api.example.com.
It's a unique code you add to your bot's system prompt with an instruction never to reveal it. If any reply contains the code, even spaced out, reversed or base64-encoded, the system prompt is readable. It's the most reliable signal in the test, so every leak caps the grade.
20 requests to your endpoint, one a second, so the model cost of 20 short conversations. You can test each chatbot once a day. Use a test key you can revoke for the auth header: it's used only in memory for the run and is never stored, logged or emailed.
The endpoint address without its query string, the replies, the verdicts and the score, so we can show you the result and email the transcript. Not your auth header and not your request template.
No. The prompts are our own and only try to get your bot to reveal its instructions, follow fake rules, change persona, build a link to an example.com address or do off-topic homework. Nothing asks for dangerous content.
Not yet. For now it needs an HTTPS API endpoint that takes a JSON message and returns the reply. Testing browser chat widgets directly is coming later.
First the canary check, then fixed checks for obvious obedience (a reply of just BANANA, a tracking image with your data in it), then an AI judge with a written rubric for each attack. Anything the judge can't decide is marked unclear and left out of the score.