Explore the application, investigate how it behaves, and follow the evidence. An AI-led pentesting workflow that connects discovery, authenticated testing and a reviewable handoff—with the operator in control.
Disabled by default. Customer enablement requires deployment and model/runtime acceptance.
Evaluation requirementsOne API. Two workspaces. Explore how a narrow hypothesis becomes an evidence-led handoff.
GET /api/invoicesGET /api/invoices/*POST /api/session · sign-in only/api/payments/*Third-party originsExample values, not product defaults. The illustrated scope permits reads and sign-in, not payment changes.
POST/api/sessionSign-inGET/api/invoicesCollectionGET/api/invoices/{id}Object accessExample network observation. An open port alone does not identify the protocol or prove a vulnerability.
sample-memberCredential values are not placed in model context.
Both objects belong to the controlled fixture. No second login is used for this comparison.
Can workspace A read an invoice owned by B?
GET /api/invoices/inv_A HTTP/1.1
Host: invoice.example.invalid
Cookie: [REDACTED]
Accept: application/jsonGET /api/invoices/inv_B HTTP/1.1
Host: invoice.example.invalid
Cookie: [REDACTED]
Accept: application/json200 OK/api/invoices/inv_A{
"id": "inv_A",
"workspace": "A",
"total": 240
}200 OK/api/invoices/inv_B{
"id": "inv_B",
"workspace": "B",
"total": 760
}A workspace A member receives invoice metadata belonging to workspace B.
Known object ownership is the control. The status code by itself is insufficient.Enforce object ownership on the server before returning invoice data.
EvidenceE-01 → E-02/api/invoices/inv_A{"id":"inv_A","workspace":"A","total":240}/api/invoices/inv_BNo response bodyAuthored report and retest illustration—not a live run or an automatically closed product finding.
The agent selects from the capabilities admitted for the engagement. Discovery supplies context; controlled tests gather observations; the evidence remains available for review.
Endpoint inventory, OpenAPI or GraphQL context, browser-assisted exploration, and scoped DNS, port and service discovery.
Supported login flows, session behavior, object-level authorization and role boundaries, with explicitly selected test identities.
Investigate field changes, request replay, CSRF and business-workflow assumptions. Available actions depend on the admitted runtime and engagement policy.
Retain exchanges and observations, review the finding, export the report, link follow-up work and record a separately scoped retest.
OpenAPI/Swagger, HAR, Postman and GraphQL introspection inputs; bounded crawl and browser context; exact-authority TCP connection probes. Open ports are observations, not proof of exploitable services.
Form or JSON login and OAuth client-credentials or password grants. Broad SSO/MFA support is not implied. Stored credentials are encrypted and engagement-bound; the model works with references rather than secret values.
Subfinder uses the fixed Hackertarget source; httpx probes one authorized URL; Nuclei uses a selected six-template profile, with 18 curated templates across three profiles. These are not the complete upstream tool catalogs.
HTTP, browser, WebSocket and specialized scenario tools depend on runtime admission. Browser checks need the validated Chromium runtime; blind/OOB testing additionally needs its admitted, signed sink. Missing capability is not a passing test.
The scope, budget and approval policy travel with the engagement. Higher-impact actions require approval; new discoveries do not grant new permissions.
This desk illustrates the controls. No job is running and no request will be sent.
Review scope, coverage, evidence and remediation together. The report workflow supports executive, technical and board audiences, with PDF, HTML, Markdown, JSON and evidence-package exports.
Follow-up and retest retain their own records. Where the current evidence cannot support a closure decision, the outcome stays unresolved.
Read the sample report Download sample · HTML This authored sample is not a product export or a captured customer assessment.The web/network profile is implemented and disabled by default. Enabling it is a deployment decision—not a promise that every model or target has already passed live acceptance.
The implemented profile covers the web/API workflow and constrained network discovery. Mobile is outside this evaluation.
Validate the deployed image, isolated worker, available tools and product-to-report path before customer enablement.
Accept the exact model/runtime profile, then agree the target, test identities and authorization. One model’s result does not validate another.
No. The web/network implementation remains disabled by default. The deployed image, isolated worker and exact model/runtime profile need acceptance before customer enablement. A source-code milestone is not evidence that a hosted service is already available.
Supported paths include form and JSON login, and OAuth client-credentials or password grants. Evaluate the exact flow in your environment; SAML, arbitrary SSO and MFA are not blanket promises. Supplied credentials stay behind engagement-bound references, outside model context.
No. The current network path is constrained discovery of explicitly authorized hosts and ports. Service reachability is not proof of vulnerability, and discovery does not grant permission to test newly found assets.
The workflow enforces scope and tool controls outside the model, but research quality and capability still need measurement for the exact provider, model and runtime. An accepted profile does not automatically qualify another model.
The target environment and safeguards must be agreed explicitly. A POC should start with a controlled, authorized environment and a documented scope.
Follow an investigation from endpoint inventory and authenticated requests to evidence, report and a bounded retest. The interactive session and sample report on this page are authored illustrations, not live scans. Your target is only tested after separate authorization and configuration acceptance.
Tell us what you want to evaluate. Our team will review your request and contact you to agree the scope and arrange a time.
Request a demo