Whitebox Security QA runs every open-source and AI scanner we can point at your repository, then does the part they can’t: it stands your code up in a sandbox we control and actually attacks it — guided by the source, and again blind. What reaches your inbox isn’t a scan dump. It’s four short lists: what’s exploitable, what’s noise, what’s unreachable, and what’s low priority.
$299 per scan, currently $99 — temporary launch discount. A one-off charge, not a subscription.
The run starts the moment you submit. By submitting you confirm you’re authorised to have the repository security-tested. Read-only access is enough — the sandbox is torn down after the run.
See a full sample report → — the whole document a scan produces, published in full, with juice-shop/juice-shop, OWASP’s deliberately vulnerable reference app, as its subject. Four confidence tiers, CWE with file and line, attack paths as ordered chains, and the raw scanner leads underneath, CVSS-scored where the scanner scored them — the document a paid scan produces, not a screenshot.
The problem
Point enough tools at a codebase and you don’t get clarity — you get a queue. Three structural failures turn scanner output into something nobody reads twice.
A single mid-size service returns thousands of findings across SAST, DAST and dependency scanners. No team triages thousands of entries by hand, so the list gets skimmed once and archived — and the one that mattered goes with it.
Static tools flag shapes in the code, not attacks that land. A large share of what they surface never holds up when you actually try it — but every one still costs an engineer the hours to prove it wrong before they can close it.
A scanner can’t tell you whether an attacker can reach the line it flagged. A critical behind three auth layers on a private network is not the same risk as the same bug on your login page — yet the report scores them identically.
The pipeline
Scanners run first and flood the field. Then we do the thing a scanner can’t: run the code and attack it, twice, with and without the map.
Point us at a GitHub repo — OAuth, or a read-only personal access token.
We clone and read. Nothing is written back to your repository.
The broad, fast baseline everyone starts from.
SAST (Semgrep, Bandit), DAST (OWASP ZAP), and fuzzers. Wide coverage, high volume, noisy.
Different noise — models reason about the code instead of matching patterns.
Claude Mythos, GPT-5.5-Cyber, and Necromicon (Kimi K3.0 abliterated). They surface findings a linter never would.
Your app, running for real, on infrastructure we control.
Real dependencies live in an isolated instance. Production is never in scope.
An attacker who has read your source.
Necromicon reads the scanner output and the code — which layers are soft, which business logic has weird edges, which auth chains are fragile — then runs coordinated sequences against the live instance.
A stranger at the front door, working inward from nothing.
The same agent, a new persona, zero source access. It finds what an external attacker with no map would find.
Every finding sorted into four buckets — then the sandbox is destroyed.
One deduplicated report leaves; the isolated instance does not survive the run.
The differentiator
This is the whole point. A raw finding is a question; a triaged finding is a decision. We answer the question for you — proven, dismissed, out of reach, or out of scope — so the report is a to-do list, not a to-investigate list.
Proven against your live sandbox — not inferred from a pattern, reproduced end to end.
The chain that landed it, step by step, with the evidence each step rests on — plus the CWE and the file and line it sits on. This is the list you fix.
A scanner flagged it; the attack never held up when we actually tried it.
The specific reason it does not hold — so you close it once and stop re-checking it.
A real bug with no path to it from outside the sandbox as we deployed it.
A note on why nothing external reaches it. Worth knowing, not worth an incident tonight.
Real in another threat model or deployment — just not the one in front of us.
Filed with the context that makes it matter elsewhere. Not forgotten, not urgent.
Two passes
Each pass catches what the other structurally can’t. Running both is why nothing falls into the gap between “too deep for an outsider” and “too obvious for someone reading the code.”
Necromicon reads the scanner output and the code together, decides which layers are soft, which business logic has weird edges, and which auth chains are fragile — then runs coordinated sequences against the live sandbox.
The same agent, a new persona, zero source access. It works inward from nothing — the way an external attacker actually meets your app, with no map and no assumptions.
The deliverable
Confirmed, observed live, static lead, or likely false positive — with the reason it landed there. What held up against the running app is never filed beside what a linter guessed.
A CWE identifier plus the file and the line. Enough to open the right file and read the code, not a pattern name and a severity.
Entry, pivot, impact — the steps in the order the run walked them, each with the evidence that link rests on.
The full merged lead list the triage reasoned over, including what it down-ranked — deduplicated, so a bug three scanners all shouted about appears once, and carrying each scanner’s own CVSS base score where it computed one. You can audit the verdict instead of taking it.
The engine
Three agents, held to the same configs, the same sandboxes and the same suite. The one that chains deepest, refuses least and invents the fewest phantoms is the one we run against your code.
| Metric | Claude Mythos | GPT-5.5-Cyber | Necromicon |
|---|---|---|---|
| Attack success rate | 64% | 58% | 80% |
| Multi-step chains | 2–3 steps avg | 1–2 steps avg | 4–6 steps avg |
| False positives | 34% | 41% | 8% |
| Time to first exploit | 45 min | 52 min | 18 min |
| Context retained | 128K | 200K | 1M |
| Refusals mid-engagement | 18% | 12% | None |
Our internal adversarial harness — 50 AI agents, 1,000+ attack scenarios, real business logic. Same agent configs, same sandboxes, same suite across all three.
What stays yours
You draw the line on what is in and out. We test what you authorise, nothing past it.
Attacks only ever run on the isolated instance we stand up. Your production systems are never touched.
We report; you decide. Nothing is written back to your repository and no change ships without you — the deliverable ends at the finding and the evidence behind it.
You decide what that word means for your business. We sort every finding against your bar, not ours.
Questions
A read-only personal access token, or GitHub OAuth scoped to the repository. Read-only is enough — we clone the code and read the scanner output. We never need write access.
No. Every attack runs against the isolated sandbox we stand up from your source. Your production systems, data and traffic are never in scope.
It is cloned into an isolated environment for the duration of the run and the sandbox is torn down when the run ends. The run exists to produce one report; it is not a place your code lives.
Anything we can stand up with its real dependencies live in a sandbox — web apps and APIs are the sweet spot, because the guided and unguided passes need a running surface to attack. If we cannot deploy your project, we tell you before charging.
It depends on the repository — its size, how much noise the scanners raise, and how deep the guided chains go. There is no fixed clock we can honestly promise. You get a live progress link the moment the run starts, and the finished report lands in your inbox when it is done.
Then the report says so, and shows what we tried. An empty confirmed-exploitable list is a genuine result — but it is scoped to what we could reach and deploy, not a certificate that the code is flawless.
PenClaw is the blackbox, no-source, self-serve path: point it at a live target and a stranger works in from outside. Whitebox adds the source — every scanner, plus a guided pass that reads your code — and then still runs the blackbox stranger on top. Same attacker, far more context.
Read-only access, one signal-only report, one repository at a time. $299 per scan, currently $99 — temporary launch discount. The run starts the moment you submit — by submitting you confirm you’re authorised to have the repository security-tested.
See a full sample report → — what $99 buys, in full: the whole document a scan produces, with juice-shop/juice-shop, the industry’s reference vulnerable app, as its subject. Every section a paid run delivers, unredacted.
