# Fenko Security > Fenko Limited is a New Zealand company working where AI meets security. We build AI agents, test AI systems and conventional targets, and run extension and supply chain intelligence. Registered as FENKO LIMITED, based in Auckland. This file is a map of the site; every link below is a real page. ## Products - [Foxhound](https://fenko.nz/foxhound/): Foxhound automates approved assessment steps within your scope. A tester approves active testing, investigates the results, and signs off findings before delivery. - [RiskyPlugins](https://riskyplugins.com) - [PrivateStores](https://fenko.nz/privatestores/): Run a private, curated extension marketplace for your developers. Your organisation approves what gets installed, holds releases back, and blocks anything over a risk threshold. VS Code and OpenVSX compatible. - [Open Source](https://fenko.nz/open-source/): Fenko open-source projects: Fenko Vault, a local-first passkey and 2FA vault, dnsmonster, passive DNS capture and indexing, and foxymirror, a quarantining package proxy. ## Free tools Each of these runs in the browser and is free to use, with no account. - [Fox Generator](https://fenko.nz/foxgen) - [Passkey Town](https://fenko.nz/passkey-town/): An interactive walkthrough of WebAuthn: register a passkey, sign in with it, and watch a phishing attempt fail three different ways. Then create a real passkey in your own browser and watch the signature get verified. - [Age Encrypt](https://fenko.nz/age-encrypt/): Encrypt a message or a file to an age recipient or an OpenSSH public key, entirely in your browser. Nothing is uploaded. Output is a standard age file that the age CLI decrypts. - [Fenko Vault](https://fenko.nz/fenko-vault/): Fenko Vault is an open-source passkey and 2FA manager for Chrome, Firefox, and Android. Local-first, MIT licensed, with optional end-to-end encrypted sync over Nostr relays. ## Services - [AI Security](https://fenko.nz/ai-security/): Fenko AI security services: security audits, inference monitoring, prompt injection testing, access control, and MCP governance for AI systems. - [Penetration Testing](https://fenko.nz/pentesting/): What Fenko covers in a penetration testing engagement: web applications, mobile apps, APIs, network infrastructure, cloud environments, and AI systems. Delivered through Foxhound. ## Insights - [Does a multi-model pipeline make AI-generated code more secure?](https://fenko.nz/blog/multi-model-ai-code-security/): What generating the same spec with three different models actually buys you, across seven 2026 benchmarks. Three models catch each other's quirks. All three ship the same IDOR. - [Fenko Vault: what it is, how it works, and what's left before 1.0](https://fenko.nz/blog/fenko-vault-road-to-1-0/): Fenko Vault stores WebAuthn passkeys and TOTP codes on your own devices, with optional end-to-end encrypted sync over Nostr relays. Past 15,000 installs and featured on the Chrome Web Store, here is why we built it, how the interception and sync actually work, and what has to be true before we call it 1.0. - [One Colon to Rule Them All: HTTP Request Smuggling in Eclipse Grizzly](https://fenko.nz/blog/grizzly-http-request-smuggling/): Eclipse Grizzly's HTTP parser reads a header name up to the first colon and nothing else. That one shortcut lets an attacker hide a Content-Length inside a header name, re-frame the request, and borrow another user's session cookie on a shared connection. - [The rise of qualitative measurement](https://fenko.nz/blog/the-rise-of-qualitative-measurement/): Every security metric collapses work nobody had time to read into a single number. We built those numbers because reading everything was impossible. It isn't anymore, and that changes what good is allowed to look like. - [Tax the chips, before the models](https://fenko.nz/blog/tax-the-chips-before-the-models/): Keynes promised his grandchildren a fifteen-hour week. The wealth arrived; the leisure didn't. A proposal to tax AI at the hardware layer, per chip, and bank the surplus as time. - [Harness the Power of the Harness](https://fenko.nz/blog/harness-the-power-of-the-harness/): Google Big Sleep, Anthropic Glasswing, Microsoft MDASH, evilsocket's audit, Hadrian OpenHack, OpenAI Aardvark. Different teams, one recipe. The security-agent harness has become the product, and the model behind it almost doesn't matter. - [Hours, Not Days](https://fenko.nz/blog/hours-not-days-patching-urgency/): AI-assisted exploit development is collapsing patch timelines. The answer is not louder change management; it is architecture that can survive patching in hours. - [pip install malware: Why Python and JavaScript Package Ecosystems Are [almost] Unfixable](https://fenko.nz/blog/pip-install-malware/): pip, npm, and lifecycle scripts make package installation a code execution problem. AI coding agents add another prompt-injection surface on top. - [To Catch a Rising (AI) Star](https://fenko.nz/blog/to-catch-a-rising-ai-star/): A practical take on where AI agents are heading, why current architectures age quickly, and why teams should build for the model curve instead of today's constraints. ## Security - [Vulnerability Disclosure Policy](https://fenko.nz/security/): scope, response timelines, and safe harbour for good faith research. Reports go to security@fenko.nz. - [security.txt](https://fenko.nz/.well-known/security.txt): RFC 9116 contact details. - [Encryption key](https://fenko.nz/.well-known/fenko-security.pub): age and OpenSSH public key for encrypting a report. ## Company - [About Us](https://fenko.nz/about/): About Fenko Limited: who we are, what we stand for, and how we think about AI safety and data privacy. - [Careers](https://fenko.nz/careers/): Careers at Fenko Limited - Join our team working on AI agent development, AI security, and penetration testing. Based in Auckland, New Zealand. - [Contact](https://fenko.nz/contact/): Contact Fenko Limited for AI agent development, AI security, penetration testing, and security consulting. Based in Auckland, New Zealand. - [Governance](https://fenko.nz/governance/): Fenko Limited's governance framework - Our commitment to security, privacy, ethical AI practices, transparency, and operational standards. ## Legal - [Data Processing Addendum](https://fenko.nz/dpa/): Fenko Limited's Data Processing Addendum (DPA) - Standard terms for data processing, privacy compliance, and data security under the NZ Privacy Act 2020. - [Privacy Policy](https://fenko.nz/privacy-policy/): Fenko Limited's Privacy Policy - Learn how we collect, use, and protect your personal information. - [Security](https://fenko.nz/security/): Fenko Limited's vulnerability disclosure policy. How to report a security issue, what is in scope, response timelines, and safe harbour for good faith research. - [Terms of Service](https://fenko.nz/terms-conditions/): Fenko Limited's Terms of Service - Legal terms and conditions for using our products and services.