Sample report

Example data — this is what your report looks like, including AI-suggested fixes. Connect a repo to scan your own code.

acme-inc/checkout-service

github.com/acme-inc/checkout-service
0
Security Score
CFair
7 findings across this scan

By severity

7
Findings
Critical2
High2
Medium2
Low1

Hotspots

Top files
app/api/orders.py1
app/config/payments.ts1
src/routes/invoices.js1
src/components/SearchResults.tsx1
src/lib/auth.js1

Compliance impact

Standards triggered
OWASP Top 106
Injection
PCI DSS v4.01
Secure development
SOC 21
Access control
NIST 800-63B1
Cryptography
NameScoreDetails
SQL injection via string-interpolated query
CWE-89 · 5/30/2026
9.5Visit
Category:Injection
Type:SAST
Rule:python.sqlalchemy.sql-injection

User-controlled `customer_id` is concatenated directly into a raw SQL string. An attacker can read or modify arbitrary rows by injecting SQL through the request parameter.

app/api/orders.py:64
AI-suggested fixpython
Open as PR

Use a parameterized query so user input is bound, never interpolated.

  def get_orders(customer_id: str):-     query = f"SELECT * FROM orders WHERE customer_id = '{customer_id}'"-     return db.execute(query).fetchall()+     query = "SELECT * FROM orders WHERE customer_id = :cid"+     return db.execute(query, {"cid": customer_id}).fetchall()

Compliance Impact

OWASP Top 10A03

A03:2021 – Injection

PCI DSS v4.06.2.4

Requirement 6.2.4 – protect against injection attacks

Hardcoded API secret committed to source
CWE-798 · 6/2/2026
9.5Visit
Broken access control — missing ownership check
CWE-639 · 5/21/2026
7.8Visit
Reflected XSS in search results page
CWE-79 · 5/18/2026
7.8Visit
Weak hashing algorithm (MD5) for passwords
CWE-327 · 4/29/2026
5.5Visit
Vulnerable dependency: lodash < 4.17.21 (prototype pollution)
CVE-2021-23337 · 3/11/2026
5.5Visit
Missing secure & httpOnly flags on session cookie
CWE-614 · 2/8/2026
3.2Visit
Plexicus mascot

Now scan your own code — free

This is example data. Connect your GitHub repo to get a real report like this — with AI-suggested fixes — in about 60 seconds.
Qualifizierung

Prüfen Sie, ob AI Swarm Pentest zu Ihrer Umgebung passt.

Teilen Sie den wichtigsten Kontext. Wir prüfen den Umfang und nennen den nächsten kommerziellen Schritt.

Vor dem Absenden — prüfen Sie, ob Sie passen

0 / 280

Keine Verpflichtung. Wenn Sie nicht passen, sagen wir es Ihnen.
SAMPLE HANDOVER · ILLUSTRATIVE

Sample evidence handover

A trimmed view of what your team receives at the end of an AI Swarm Pentest engagement. Real engagements include full technical evidence, executive narrative, and a remediation plan.

VALIDATED FINDING Evidence attached

Server-Side Request Forgery in webhooks/receiver

demo-project/sample-app · src/webhooks/receiver.py:42

SeverityHigh CVSS 3.18.6 Priority79 Confirmedvia replay

Untrusted caller-supplied URLs reach an internal egress without an allowlist. Replayed in a sandbox against a fresh authorized target — the same control was validated to fail twice.

REVIEWER-READY REMEDIATION Merge-ready PR

Validate the target URL against an allowlist of permitted hostnames. Reject private/internal IP ranges. Enforce HTTPS only.

plexicus/remediation/webhooks-ssrf 3 changed · 0 new files
42resp = requests.get(target_url)
42+if not is_allowed_host(target_url):
43+  raise WebhookRejected(target_url)
44+resp = requests.get(target_url, timeout=5)
Every engagement hands over:
  • Executive briefing
  • Validated findings list
  • Merge-ready PRs
  • Compliance mapping (NIS2 · DORA · CRA)
 Private Runde Für Investoren