pierrebetouin

Thank you. I’m definitely biased, but this solution does work :)

.Net is planned for early next year.

Good catch! We will fix that

Thanks! Being as transparent and open as we can is a big slice of who we are. Tbh, both dev and security folks are tired of having to talk to 3 sales people to understand if a product is a good fit or not (btw, average NPS of security industry is below 25). We have a free and open signup and our documentation is open.

Thank you! The team will love these comments :) Y Combinator was one of the most defining periods for Sqreen. We joined at a pretty unusual stage, with about 20 people in our team, and something like 50 paying customers). So we were one of the most advanced teams of our batch when we joined. YC was an amazing opportunity for us to learn and progress like crazy. The value that YC brings is incredible, no matter what your stage is.

Thanks! Your support means a lot to us

Indeed, we'll fix this asap - thanks for catching!

That's a fair point (which is raised regularly) so we architectured Sqreen in a way that we have a very low security footprint. We stream security metadata (as APM solutions stream performance metadata) so we don't need to redirect traffic. Business information/data are usually not required to investigate a security issue, so we strip scalars from SQL queries whenever we detect SQL injection for instance, and we collect as little as we can.

Re attack vectors: agreed that more code leads to more attack surface, but that's the same rationale with frameworks, other agents (APM, error/log monitoring, etc.) and often less transparent, when running on pre-packaged containers, or even on an appliance (code running on Firewalls / web app firewalls solution can usually not be audited). Our agents are not (yet) open source but are audited regularly by our users.

Sorry to hear about the bug you've hit when you tried Sqreen. Would love to know more directly (PM?) so we can debug it and provide a better experience there. The agents are using a v8 virtual machine to avoid problems of that type (we can’t mess up with the original app logic), so it acts as a sandbox there.

Thank you! Sqreen can be deployed on any cloud or on-premise platform. The agent just needs to communicate to our infrastructure (to send security metadata to your dashboard). .Net should be available early next year.

Thanks! Marketing and sales in the security space was traditionally always fear-driven - “Buy our product. If not, you’re going to get breached”. An ROI would be built using an “average breach cost”.

Today Sqreen is inbound-driven and the marketing/sales process is focused on the positive of how to make security better and more transparent, rather than attempting to stoke fear or play up the negative side.

We never had to build any dubious ROI calculation. Tech audience usually understands the need for security and we present a technical solution that is transparent and easy to use and deploy.

Happy to share our learnings if this can help other teams.

We've experimented a lot - especially during our batch at YCombinator last year. We quickly noticed that most of our former processes were broken and we had to change almost everything, in just a few months.