bundle.jskey in the page
/usersevery row is public
/api/adminno login
The path
Five steps. Each one waits its turn.
You paste a URL. Antibody looks for the open doors, writes a fix, stops the attack, and texts you to approve.
01 · Paste
You give Antibody a URL.
That address is the start. A domain you have not verified gets a read-only look. Active checks run only after you prove the site is yours.
02 · Scan
It looks at the app the way a visitor does.
Antibody reads the page and the JavaScript that shipped with it. A key left in that bundle shows up. So does a database that answers anyone, and an admin route that works with no login.
03 · Fix
The patch sits until you say yes.
Antibody writes a change from what the scan found. The checks run against that change. Nothing merges on its own. You approve it on the site, or by text.
04 · Shield
Ordinary visits go through. A dump does not.
Each request is scored before the route runs. A normal page load is allowed. A request that tries to take the whole table is blocked. If the scorer cannot be reached, the request is still allowed.
05 · Text
One message. You reply YES.
When a fix is ready, or an attack was blocked, Antibody texts you. The reply that approves a fix is YES, with the fix id. If a text is not enough, it can call.
Ready to try it?
Unverified domains get a passive, read-only check.