the evidence briefFive specialized AI models examine your highest-stakes calls independently — you see where they agree (trust it) and where they split (dig there). One clear verdict, plus the disagreement a single opinion would hide.
Code security & quality audits are live today. Strategic-decision analysis is rolling out.
Free during early access — no card required. From $49.99 per audit after launch.
The decision brief
Scrub the timeline from analysis to evidence to risk — then watch the council land on one verdict, with the dissent kept on the record. This is what a Quorium decision looks like end to end.
Fig. 1 · Illustrative example
Council Replay
Replay the decision path from analysis to final verdict.
Illustrative
Upgrade proposed to close a known auth bypass path while keeping rollout reversible.
Council scoped blast radius across API gateway, middleware, and redirect handling.
Primary open question: normalization behavior in downstream proxy chains.
Scope: auth middleware + API gateway. Evidence appears in the next stop.
Workflow
Point Quorium at a GitHub repo or upload a zip. We scope the review to what you care about.
Specialized AI models analyze security, code quality, and architecture without collaborating — so their agreements mean something.
Get a single report ordered by agreement. What all five agreed on comes first. Disagreements are flagged — not hidden.
Example output
Findings are ordered by how many models agreed. The more models that flagged something independently, the higher it ranks.
Audit Report
5 reviewers · 3 findings · sorted by consensus
Ref. Q-0001
The /api/webhooks/rc endpoint processes credit-grant events without verifying the signature header. Any caller can POST a valid payload and receive credits.
Dissent 1 model flagged as low-severity — disagreement captured in audit trail.
Raw string concatenation used in getUserByEmail constructs a query susceptible to second-order injection when attacker-controlled input is stored and later retrieved.
A Stripe test key (sk_test_…) and a Twilio auth token appear in git history at commit a3f82c1. Values may have been rotated but history remains.
Dissent 3 models assessed these as rotated/expired values. Quorium surfaces the disagreement — verify before closing.
Behind every finding
Pass a lens over a card to reveal citations, risk tags & reasoning
Decision Brief
Executive summary with rationale
Verdict: block merge until auth scope validation is centralized.
Confidence: high; evidence converged across security and architecture reviewers.
Required action: replace inline role bypass checks with policy middleware.
Missing origin validation confirmed at src/api/audit/run.ts:42 with reproducible request replay.
Mapped to OWASP A01 (Broken Access Control). Severity: High. Exploitability: Medium-High.
Council selected block over warn because exploit path reaches privileged repo operations.
Audit Trail
Who said what and when
09:14:02 — Security reviewer flagged CSRF exposure on privileged route.
09:14:19 — Architecture reviewer requested explicit auth policy binding.
09:15:03 — Council exported brief, dissent note, and mitigation checklist.
Tool invocation captured: scan_routes depth=3, policy_eval profile=release-gate-v2.
Dissent persisted: one reviewer marked rollout risk under legacy proxy redirect chains.
Final decision favored safety because counterfactual impact exceeded release timing benefit.
Risk Register
Trackable owners and mitigations
High — CSRF on privileged endpoint; owner: platform security.
Medium — implicit auth boundaries across handlers; owner: API team.
Low — provenance annotation gaps in replay exports; owner: tooling.
CWE-352 mapping validated with request replay and token omission proof-of-concept.
Business impact: unauthorized state change against protected audit workflows.
Mitigation priority set by exploitability × blast radius, not severity label alone.
The problem
Every AI model has blind spots. A single model reviewing code will confidently miss things — or confidently flag things that aren't real problems. That's not a flaw you can patch; it's the nature of how these models work.
Quorium doesn't try to fix a single model. It runs five specialized ones — each reviewing your code independently — then measures agreement. When four of five models flag the same issue, that's a signal. When only one flags it, that's also a signal: worth looking at, but not your top priority.
The Quorium difference
Agreement = confidence
Findings ranked by how many models independently reached the same conclusion. High agreement means act now.
Disagreement = insight
When models disagree, we don't pick a winner — we surface the disagreement with the reasoning from each side. That tension is often where the real nuance lives.
No black boxes
Every finding links to the model that raised it and the evidence it cited. You can verify the chain, not just trust the verdict.
Ready to start
Code security & quality audits are live today. Point Quorium at any GitHub repo and get a confidence-ranked report in minutes — five models, one verdict, every disagreement surfaced.