KingSec
ShippedLocal-first, AI-augmented attack surface & vulnerability management for SMBs and MSPs.
- Python
- FastAPI
- SQLAlchemy
- Nuclei
- React
- TypeScript
- shadcn/ui
SMBs and IT admins need real vulnerability management without sending their attack surface data to a third-party cloud. Most of the market solves this by centralizing scan data in someone else's SaaS — a hard sell to a security-conscious buyer being asked to trust another cloud with their weakest points. KingSec is built local-first instead: it runs where the data already lives, and nothing about the design assumes a phone-home connection.
Architecture decisions
E4Product or architecture decision — a judgment call, not a fact to verify. Zero-telemetry, bring-your-own-AI-key. KingSec doesn't collect usage telemetry, and AI-assisted analysis runs against a key the operator supplies rather than a shared, vendor-managed one. The trade-off: no aggregate usage data to guide the roadmap the way a typical SaaS would, and the operator carries their own AI usage cost. In exchange, KingSec never becomes a second place an attacker could compromise a shared credential, and there's no telemetry pipeline to secure or disclose.
E4Product or architecture decision — a judgment call, not a fact to verify. Nmap excluded from v1. Nuclei is the scanning engine in v1.0.1; Nmap was left out over licensing risk, not a technical limitation. It's a scoping decision, not a capability gap that got missed.
E1Executed or directly observed. Python/FastAPI/SQLAlchemy backend, React/TypeScript frontend. Chosen for a small, auditable surface area — a security product's own codebase is itself something a buyer might reasonably want to review.
What's verified
E1Executed or directly observed. 3,234+ tests passing, mypy clean, 3/3 architecture contracts enforced.
E1Executed or directly observed. Full security audit lifecycle completed pre-release, including a critical privilege-escalation fix.
Scope and limitations
KingSec v1.0.1 is built for single-organization, local-first deployments — it is not a multi-tenant SaaS platform, and that's a deliberate v1 boundary, not an oversight. Nmap-based scanning isn't included in v1, for the licensing reason noted above. This case study reports what has been verified as of v1.0.1; it will be updated as audit scope and test coverage grow, not backdated.