Home / Platform
The platform
Everything around the scan.
The engine breaks into your application and proves it. The platform is what lets a whole team run that across every app you own, every day, without anyone losing track of who owns which fix.
What we look for
Ten kinds of bug
Web applications and the APIs behind them. We do not scan networks or infrastructure, and we are not trying to out-count anyone.
Injection
Input that your database or your server ends up running as a command instead of treating as text.
Cross-site scripting
Script an attacker can plant in your pages so it runs in your customers' browsers, in their session.
Authentication
Login, session and password-reset flows that can be bypassed, replayed or held open longer than they should be.
Authorization
One role reaching another role's data or actions. This is the one we built the company around. See how it works →
Server-side request forgery
Getting your own server to fetch something on an attacker's behalf, usually something internal that was never meant to be public.
Weak cryptography
Data protected by something that stopped being protection some years ago, and secrets handled in ways that undo the protection.
Configuration
Debug endpoints, default credentials and permissive settings that were fine in development and got shipped.
Business logic
The rules of your own product used against you: stacked discounts, negative quantities, quota resets, payment races. Why this one is different →
Dependencies
Libraries you depend on that have known vulnerabilities, reported against the version you are actually shipping.
Secrets
Keys, tokens and passwords committed to the repository or handed out by the running application.
Setting up
What it takes to start a scan
Register the app once
Its address, its repository, the branch, the environment and the team that owns it. Every scan, schedule, finding and report after that hangs off that one record.
Save the settings
Which of the ten bug types to run, whether to actually exploit what we find, what is off limits, and a short description of what the product is for. Save it once and every future scan reuses it.
A login for each role
Stored encrypted, or pulled from your own Azure Key Vault at the moment a scan starts. More than one login is the thing that makes role testing possible at all.
Start it, stop it
Run it now, run it on a schedule, or run it from your build pipeline. Cancel a scan in progress and the worker stops there and then.
Nobody hogs the queue
Limits on how many scans run at once, per team and across the platform, so one busy project cannot starve another.
Re-run just the hits
After a fix, re-run against only the findings that were confirmed, instead of paying for a whole scan to check one line of code.
Findings
From a result to a decision
Six levels of severity
Critical, high, medium, low, informational and best practice: the six your team already reads. How sure we are is tracked separately, so you can sort by how bad it is or by how certain it is.
A clear lifecycle
New, triaged, confirmed, false positive, fixed, came back. Assign an owner, leave a note, paste in your ticket reference.
The same bug once
An issue found again next week joins the record you already have, with its history, instead of appearing as a brand new item every night.
What changed since last time
Every scan compared with the previous run of that app: what is new, what is fixed, and what came back after being closed.
Search
Across findings, applications, saved settings and scans. Only ever across your own organisation.
Take it with you
CSV and JSON export, for whatever you already do with security findings. Ticket sync with Jira and GitHub Issues is on the list, not built. Today you paste the reference in by hand.
Operations
Running it as a team
Who is allowed to do what
Forty-three separate permissions grouped into roles. They are checked on the way into every route, and 105 routes are verified against the policy when the platform starts. Nothing is merely hidden from the menu.
Teams and groups
Group your people, give the group a role, and keep each team's work visible to the people it belongs to.
Sign-in that survives an audit
Okta single sign-on configured per organisation, one-time codes for multi-factor, and API tokens for machines. Other providers are coming; today it is Okta.
An audit log
Who ran which scan, who changed a finding, who edited the settings, who touched a stored login. Per organisation, and yours to export.
Scheduling
A recurring scan per app, plus one-off runs booked for a future date. Schedules survive a restart and reload themselves.
What a scan costs
You bring your own AI provider key, so the inference is billed to you directly with nothing added by us. Spend is recorded against each scan today; hard caps, and the cost shown before and after every run, land 13 November.
Output
Getting the results out
Reports with your name on them
HTML and PDF under your company name and logo, with anything that looks like a password or a key blanked out before the page is rendered.
Stop a bad merge
Trigger a scan from your pipeline, wait for the result, and fail the build if something serious is new. A GitHub Action ships in the repository.
Notifications
Scan finished. New critical finding. Both go to the channel and the inbox each team actually reads. Ships 23 October.
An API for everything
Anything the console can do, a token can do. See the API reference →
No hype
What is live, and what has a date
We would rather you found the gaps on this page than three weeks into a pilot. Dates are what we are building to, and we report a slip the week it happens.
The authorization matrix
Every role against every resource, each cell allowed, denied or leaked.
Evidence on every finding
The request, the response, the screenshot and the line of code.
Running it on your own hardware
The self-hosted agent works today. Source never leaves your perimeter.
Confirmed-only mode
One list, holding only what we actually broke. No maybes to work through.
The benchmark
Measured against public vulnerable apps and real projects with known bugs, misses included.
Prove the fix
We re-run the attack that worked. The finding closes only when it fails.
Multi-client console
Every client, every finding, one screen. For firms running this for other people.
Business-logic abuse
Discounts, quantities, quotas and payment timing, tested as an attacker would.
The things we have not built
Ticket sync, single sign-on beyond Okta, self-serve signup and billing. The full list →
Try it on one of your own applications.
Everything above is built for running this across a portfolio rather than one application. Show us your list and we will walk the parts your team would live in: registering an app, the settings every scan reuses, and the findings screen.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.