Mike Biggerstaff

Problem

Growers juggle a separate app per hardware brand — sensors and controllers that were never built to talk to each other.

Approach

A hardware-agnostic AI command center: connect whatever sensors and controllers you already own, any brand, any mix, and GrowBridge reads the whole grow and drives it toward better yield, less waste, and more consistency — with the grower in control of every action.

Capabilities

• Hardware-agnostic core — unifies sensors and controllers from any brand into one AI command center. Live integrations: PulseGrow, Bluelab Guardian, OpenSprinkler (AC Infinity in development); planned: Tuya, Home Assistant, Shelly, Aranet, SensorPush, AROYA, AutoGrow.
• A genuinely intelligent, real multi-agent AI system — not a chatbot wrapper. Turns raw sensor data into sophisticated, predictive guidance, rigorously engineered rather than bolted on.
• Human-in-the-loop actuation — the AI proposes, the grower approves before anything executes. The same capability-under-control philosophy that runs through everything built here.
• Sensor fusion + time-series intelligence — real-time moisture/nutrient/climate/irrigation fusion, a Grow Journal with automatic daily rollups, and "Ask Rance," a plain-language assistant for grow status.

Problem

Most scanners do one thing, and almost none of them cover the AI-security / agent-supply-chain attack surface a self-improving agent or an LLM-in-the-loop pipeline actually faces.

Approach

Fuses four engines — SAST, hardcoded-secrets detection, dependency/SCA, and an AI-security engine for prompt injection, invisible-Unicode smuggling, data exfiltration, and dangerous auto-run hooks — into one prioritized, deduplicated, false-positive-filtered report.

Capabilities

• Static only — reads files, never executes, imports, installs, or evaluates the code it scans.
• The `secrets` and `aisec` engines are pure standard-library Python: zero third-party dependencies, fully auditable, run anywhere.
• Detects OWASP Top 10 for LLM Applications patterns most classic scanners don't model: prompt injection, Unicode Tag / Trojan Source smuggling, exfiltration pipes, dangerous Claude Code / git / npm lifecycle hooks.
• Ships with an honest-limits doctrine: every clean result means nothing matched these rules, not that the code is safe.