White-box pentest
Read the code,
then break in.
Give us your repo. The engine maps every route, check, and data path, then attacks your live app knowing exactly where the deep bugs hide. Coverage a black-box attack can't reach, on the same plan, at no extra charge.
Read-only access by default. Pull requests only if you turn them on.
What it reveals
The bugs only the code reveals.
The deep bugs a black-box test and scanners walk past.
- 01An access check missing on one of forty routes.
- 02Business logic you can abuse across several steps.
- 03Data that leaks between customers, deep in the code.
- 04Secrets and trust boundaries an outsider can't see.
The attack
It reads the repo, then traces the flaw.
It reads your whole repo, then traces each deep bug to the exact line and data path, and proves it against the running app.
A Compliance Everywhere white-box pentest reading a sample repository. It maps the whole codebase (2,000 files across TypeScript, Python, Go, and SQL; 18,402 functions, 312 entry points), surfacing every attack vector and result.
What you get
Proof, and the fix, down to the line.
Every bug is a real attack we ran. And because we read the code, we point to the exact spot. It lands in your tracker with three things.
- 01The exact request that triggered it.
- 02A screen recording of the exploit.
- 03The file and line to change, with the diff.
One real example: a single route missing its login check, deep in your auth handler. We show you which line.
See a sample report›
Frequently asked
Questions.
01What do you need from me?
A repo and a URL. We read the code, then attack the running app.
02Do you store my code?
We read it during the run, with read-only access by default, and we never change it unless you turn that on. Full details are in our privacy policy.
03How is this different from black-box?
Black-box attacks from the outside with just a URL. White-box reads your code first, so it finds the deep bugs an outsider would never reach. Same engine, same plan, no extra charge.
04How do I know a finding is real?
Each one comes with the exact request that triggers it. Run it yourself. If it does not reproduce, it is not a finding.
05What does it cost?
Included in the $299 a month subscription for startups under 10 people. Teams of 10 or more book a call for rollout pricing. The rest is on the pricing page.
Connect the repo.
The deep bugs surface tonight.
Read-only by default. The first run maps your code and attacks the live app the same day.