/ In private build
SSH with someone sensible standing at the door.
Gait keeps everything you already like about SSH. Your client, your scripts and your editor carry on as they are. What it adds is the part SSH never had: a second pair of eyes on the risky commands, access you can share without sharing a password, and secrets that stay out of your history.
We would rather you tried to break it than took our word for it.
Try hack us!
Soon this button will hand you a small server of your own for up to twelve hours. There is a token on it. Gait has one instruction, which is to keep you away from it.
Attacks blocked
Held for a person
Got past us
Every attempt will land on this counter, including the ones that work. It starts at zero on the day the range opens.
/ Practice terminal
While we build the range, here is the rule set. Be as rude to it as you like.
These are the rules Gait decides with, running in your browser against a pretend server. Tap an attack or type your own. A held command goes to our automated reviewer if you have accepted cookies. It lets through what is innocent, refuses what is plainly not, and hands you anything in between to decide as the administrator.
0
You tried
0
Went through
0
Held
0
Refused
Want the real thing? This boots Debian Linux in your browser, with bash, apt, curl and the GNU tools, and a real token on it.
Practice means our rules against a pretend box, or against a real Linux machine if you boot one, which runs entirely in your browser tab and is gone when you close it. The rules run in your browser. One thing leaves it: if you have accepted cookies, a held command and the commands before it in your session go to our reviewer, a small open model, which approves or denies it. We keep a count of your reviews for the day against a cookie, and we do not keep the commands. If a line goes through that you think should have been stopped, that is exactly what we want to hear about. Tell us what got through.
/ How it decides
A gait is the way someone walks. Gait watches how a session walks, not only where it steps.
Each command gets a risk score from plain rules, and a session keeps the highest score it has reached. So the same command can be fine on its own and suspicious after what came before it. Tap a step to take it out of the session and watch the steps after it change.
Allowed
Runs straight away. Editors, pagers and anything else interactive included.
Held
Waits for an administrator. If nobody answers in time it does not run.
Refused
Never runs. The reason is printed so nobody is left guessing.
The rules decide. A model can be asked for a second opinion on a borderline command, and its opinion can only make the answer stricter.
/ Secret Shield · Proposed, not built
Paste a key in the wrong place and Gait catches it before your terminal does.
This is the behaviour we are building, sketched in your browser. Paste something into the line below, or let us paste a pretend key for you. Nothing you paste leaves this page.
How much it can promise depends on where you are typing.
Gait secure entry
Masked before it is ever drawn, delivered to the program without touching your history.
Not covered What the program does with it afterwards.
Your own shell, with the Gait hooks switched on
Supported pastes are caught before they echo, and Gait keeps the key out of its own records.
Not covered Built-ins, sudo prompts, and anything already in your scrollback.
Anything else: plain SSH, Vim, a REPL
Gait redacts its own logs and tells you a key was probably shown.
Not covered It cannot take back what your terminal already drew.
/ Who it is for
One person with a couple of servers, and a company with a fleet of them.
It is the same Gait for both. What changes is who answers when a command is held. Each line is marked with whether it works in the build today or is still a proposal.
On your own
Servers that are easier to live with.
You look after a few machines and nobody checks your work at two in the morning. Gait is the second pair of eyes.
Use the SSH client you already have. There is nothing to install on your laptop.
In the build
A terminal that is pleasant to be in: history, tab completion, editors and pagers all behave.
In the build
It reads a script before running it, so bash deploy.sh is judged on what deploy.sh does.
In the build
scp, rsync, Git, VS Code Remote and Ansible keep working, because Gait sits around OpenSSH and does not replace it.
Proposed
Set up in minutes. Gait only watches until your own connection tests pass, and uninstalling puts your SSH settings back.
Proposed
A slim bar at the top of your terminal that says which server you are on, so production never looks like staging.
Proposed
As a company
Security that acts before the damage, not after it.
You have more servers than people who know them. Gait gives you one door, one record, and a person in the loop when it counts.
A live console of every session, with the command timeline and a running risk score.
In the build
A held command waits for an administrator, who can approve it once, allow it for the session, deny it, or end the session.
In the build
Share access, not passwords. A contractor gets staging for 45 minutes and the grant ends by itself.
Proposed
A Vault for the team: who can reach each secret, where it is used, and a rotation that checks health before the old value is revoked.
Proposed
Quincy, our assistant, proposes and never acts alone. You see the exact plan, the risk and the way back, and approving it approves that plan only.
Proposed
Policies signed with a key that you hold, so that nobody can quietly loosen them. That includes us.
Proposed
/ What comes when
The order we mean to build it in.
This is a plan and not a promise of dates. We will move a line up to the lists above when it works, and not before.
01
The gateway and the session bar
Enrol a server, hand out short-lived certificates in place of keys left lying around, see live sessions as a timeline, and get the status bar at the top of an ordinary SSH session.
02
Vault and Secret Shield
Shared secrets with owners, expiry and rotation, a browser button that offers to save a new API token, and the paste protection sketched above.
03
Sign in with Quorum
A few clicks to be granted access, no new prompt on the connections after that, and Quincy asking for approval one exact plan at a time.
04
The gait command
An optional keyboard-first view of your servers, with diagnostics and runbooks. It stays off unless you want it, and your shell stays your shell.
05
Deployments you can read
Stages, live health and the raw log one key away, with a time remaining given as a range and withdrawn when we cannot stand behind it. Your docker commands are left alone.
06
The whole fleet
Health investigations that separate what was observed from what is likely, servers provisioned with cost limits, and a plain-English view for the people who answer to a board.
/ Where it stops
We would rather tell you where Gait stops than have you find out.
Gait says it prevents only what the gateway decides before a command runs. Everything else is observation, and we label it that way.
It only guards its own door.
If a server still accepts SSH directly, that path goes around Gait. The gateway is a boundary only when it is the only way in.
It cannot see inside a program it has let run.
It reads the command line and the script it launches. Once an allowed program is running, what happens inside it is out of view, so the rules decide at the door whether that program runs at all.
A hostile root or kernel beats it.
Someone who already owns the machine underneath can switch off anything running on it. That is true of every tool of this kind, and we would rather say so.
It does not see every command, and it shows you the gaps.
A shell built-in or a line of code inside an interpreter is not a program being launched, so it can pass unseen. Each session is to show how much of it Gait could actually see.
A mask on the screen is not a secret kept.
Secret Shield protects a key it catches before your terminal draws it. Covering one up afterwards is a courtesy. It may already be in your scrollback, so we will say so and suggest you rotate it.
Watching is not stopping.
The host agent reports logins, sudo and processes after they happen. That is useful for the timeline. We never call it blocking.
/ Pricing
One price, and no arithmetic about seats.
$50 per month
- Every server you point at it
- Every teammate
- Every session, with no meter running
Not on sale yet. This is the price we intend to open with, and we will say so here if it changes before then.
For a larger fleet
If you need your own signing keys, a particular region, or a say in what we build first, we would like to hear from you now rather than at launch.
/ Go on
It is your turn.
The practice terminal is open now and the range is coming. If you get something past either of them, you will have done us a favour.