About
A company built around a single question: can you prove it?
Veristria is the security company behind KeyDrift, VibeGuard and FeeGuard — three products that verify what an application actually deployed, not what its source code intended. Exposed API keys, Supabase row-level security drift, Stripe Connect fee leaks. Different surfaces, one standard: proof over promises.
Our mission
To make the truth about a running system cheap enough to check that nobody has to take it on faith.
More software was written last year than in any year in history, and less of it was read. The same shift is happening everywhere at once. The text, the images, the voices and the code now arrive faster than anyone can confirm they are what they claim to be, and the tools that made them are far better at producing confidence than at earning it.
Verification used to be the slow half of a slow process, so nobody noticed it was the half holding everything up. It is now the only half that was not automated. The distance between what a system claims and what it actually does is where the damage lives — the drained API account, the table anyone could read, the money that left and never came back.
Veristria exists to close that distance in the three places it costs the most: the credentials you expose, the data you leave reachable, and the money you move. Not with assurances. Not with a score out of a hundred. With evidence a person can open and check in under a minute.
The internet is getting harder to trust. It should be getting easier to verify.
The premise
Review stopped scaling with output
For most of software’s history, the rate at which code was written and the rate at which it was read were roughly the same, because the same people did both. That is no longer true. A small team using AI tooling now produces more working code in a week than it can meaningfully review in a month, and the code works — which is precisely what makes the gap hard to see.
The failures that follow are not exotic. A key that was meant for the server ends up in the browser bundle. A database policy that was correct in April stops matching a schema that changed in June. A refund on a marketplace leaves the seller paid and the platform short. In every case the system reports success, and the problem is only visible if something goes and looks at the deployed result.
That is the layer Veristria builds: verification that runs against what actually shipped, continuously, and reports findings specific enough to fix.
How we build
Four commitments, identical across all three products
Evidence over inference
A finding names something checkable — a served file, a query that returns a row, a Stripe object id. We do not report risk scores with nothing underneath them.
Least access that works
Two of the three products find real problems before receiving any credential at all. The third asks for a restricted key scoped to the reads it needs.
Secrets are not inventory
Where a product handles credential material, it stores a masked prefix and a fingerprint. A tool that hoards the secrets it finds has become the exposure.
Free until it is useful
The first genuine answer costs nothing on every product. Payment starts when you turn on continuous monitoring, not when you ask the first question.
The ecosystem
Three products, deliberately separate
- keydrift.dev
KeyDrift
Finds the API keys and secrets that AI coding tools leave behind in client-side JavaScript bundles.
- usevibeguard.com
VibeGuard
Continuous RLS testing, schema-drift detection and security monitoring for Supabase backends.
- feeguard.dev
FeeGuard
Real-time detection and recovery of silent fee leaks in Stripe Connect platforms.
Founder
Lars O. Horpestad
Lars O. Horpestad
Founder, Veristria
Lars O. Horpestad is a Nordic AI figure and the author of the first published Norwegian guide to large language models. That work involved a long, close look at how teams were actually adopting these tools — and at the distance between what the tools produced and what anyone had verified.
Veristria came out of that gap. The three products are each a narrow, checkable answer to one version of the same problem, built on the view that the useful thing to automate next is not more generation but more verification.
He is based in Norway and writes about verification, AI-assisted engineering and the practical security of fast-moving teams on the Veristria blog.
Contact
One address for the whole company
Product questions, partnerships, security reports and media enquiries all reach us at info@getveristria.com. Journalists will find boilerplate, assets and founder details on the press page.