GALEN POLICY
Purpose-built for web applications, Galen Policy maps how code, permissions, and data access connect. Run deterministic checks alongside your coding agent to find vulnerabilities and departures from approved access rules, with evidence your team can inspect.
ONE ENGINE / TWO CHECKS
Code can work as requested and still expose data, skip an authorization check, or make an unsafe operation reachable.
Galen traces inputs, data flows, security controls, and sensitive operations. Find supported weaknesses such as injection, broken access control, and data exposure—not only known CVEs.
Review and approve the access rules recovered from your application. Later checks surface new permissions, removed guards, and wider data exposure against that approved baseline.
Inspect the affected path, relevant controls, retained code facts, and any evidence gaps. Give your developer or coding agent a concrete issue to investigate and correct.
THE DEVELOPMENT LOOP
Keep using your coding tool. Run Policy after it changes the code, give it the finding and evidence, review the fix, and check again before merging.
HOW GALEN POLICY WORKS
You or an agent with terminal access runs Galen Policy against the project.
Review the access rules Galen recovered from your code and approve the intended baseline. Keep the saved baseline with the project for later checks.
Review security findings and later departures from that baseline, tied to relevant paths and controls.
Use the evidence to guide a fix. Re-run Policy and explicitly approve intentional changes to the rules.
COMPATIBILITY & YOUR PROJECT
Use Policy with a new web application or an existing codebase. Its analysis is independent of the AI model that wrote the code, and its retained application context remains available when conversations or coding assistants change.
You or your agent invokes the standalone CLI with repository and terminal access. Use the findings to guide your coding agent’s next change.
The Galen engine has established Python and Ruby coverage, including Django, Flask, FastAPI, and Rails. JavaScript/TypeScript, React, Laravel, and Spring coverage is expanding; supported checks vary by framework.
Galen retains a map of code paths, permissions, and data access alongside your approved policy baseline. Keep the approved rules with your repository; later checks compare current behavior against that reference across coding sessions.
When you pass findings or source excerpts to a coding agent, that tool’s data-handling settings apply. Review the evidence you share as part of your development workflow.
Read Telhawk’s privacy policyPOLICY DRIFT, MADE CONCRETE
Only administrators should be able to export customer records. Follow what happens when a code change removes that permission check—and what needs to be restored.
Your rules remain the reference. A later scan checks the changed behavior against the baseline your team approved. It does not replace your decision with a newly inferred rule.
BUILD WITH THE COMMUNITY
Ask questions, report bugs, suggest improvements, and share your experience using Galen alongside your preferred coding tool.
A free GitHub account is needed to participate. No GitHub account is required to register for or download Galen.
GitHub discussions and issues are public. Do not post credentials, proprietary source code, customer information, sensitive configurations, or confidential vulnerability details. Report vulnerabilities affecting Galen through private security reporting.
COMMON QUESTIONS
