AI/RAG security

Start from the verified domain

VICE begins with the verified domain and discovers same-origin routes that behave like AI application APIs. Discovery is bounded by protocol, DNS, IP, redirects, origin, request, and response-size controls.

The module builds its probe plan from observed public behavior. You do not need to know every API path before the audit starts.

Cover four security boundaries

• API: anonymous access, invalid authentication behavior, CORS, and rate-limit enforcement.
• LLM: prompt injection, system instruction exposure, and sensitive output signals.
• RAG: retrieval isolation, cross-tenant exposure, poisoned context, and deleted-document behavior.
• Tools: unsafe URL fetching, access to internal destinations, and actions executed without sufficient authorization.

Launch the focused audit

Open AI/RAG in a verified domain workspace and start the scan. The run appears in the central audit list with the same queued, running, completed, and failed states as other managed audits.

Detected issues are added to the domain Findings view. Use the audit filter to isolate one run or compare results after a fix.

Read evidence before severity

An actionable result describes observed behavior, confidence, evidence markers, and a concrete recommendation. An HTTP status or route name alone does not establish a vulnerability.

A discovery or crawl failure is an operational coverage limitation. It should not be reported as a critical vulnerability.

Prioritize trust-boundary failures

• Block anonymous or cross-user access to private AI operations and retrieved data.
• Separate system instructions and trusted context from untrusted user content.
• Authorize every connected tool action on the server with the current user and resource scope.
• Reject private, loopback, link-local, and metadata destinations before any tool fetch.
• Apply rate limits by identity and operation, then verify their behavior under bounded repetition.

Fix and retest the same surface

Correct the authorization, retrieval, prompt, or tool boundary that produced the evidence. Rerun AI/RAG from the same domain workspace and compare equivalent coverage before marking the issue solved.

If discovery changes after a deployment, review the newly observed routes and coverage before comparing score changes.