Continuous SecurityOn Every Deploy.
Secure your entire stack with autonomous pentesting.
Find and fix vulnerabilities 24/7.
Used by security teams at
Your full-stack security platform
One platform to secure your code, APIs, web apps, infrastructure, and cloud.
PentestStatusIssues
api.example.com
Completed
3
7
4
staging.app.io
Running
1
3
2
auth-service
Completed
2
5
8
payments-api
Completed
1
3
dashboard.app.io
Completed
1
2
5
APIs & Web Apps
Full-coverage pentesting across REST, GraphQL, and web apps - with proof-of-exploit for every finding.
strix-securitybot🔴 IDOR in invoice download endpoint
Severity: HIGH · CWE-639
The GET /api/invoices/:id/pdf handler fetches the invoice by id from the global scope without scoping it to req.org. Any authenticated user can download invoices belonging to other organizations.
Suggested change
| 47 | const inv = await Invoice.findById(id); |
| 47 | const inv = await Invoice.findOne({ |
| 48 | _id: id, org: req.org._id }); |
Commit suggestion ▾
Code & Pull Requests
Analyze code and pull requests for security issues in your CI pipeline. Catch vulnerabilities at the source.
IssueSeverityCVSS
S3 bucket public access
Critical
9.8IAM wildcard policy
Critical
9.1SSH open to 0.0.0.0/0
High
8.1RDS unencrypted at rest
Medium
5.3CloudTrail logging disabled
Medium
4.7Infrastructure & Cloud
Find misconfigurations and exposures across cloud environments and infrastructure before attackers do.
"Strix is a game-changer for our security toolbox. It's fast, easy to configure, and finds great stuff. Continuous external testing, year-round."
Jim Hebert
Head of Application Security, Chegg, Inc.
From issue to fix in seconds
Find critical issues, auto-validate, and auto-fix with merge-ready PRs.
←Issues/STR-00847
SSRF via URL Parameter in /api/proxy
OpenHigh · 8.6CWE-918
TL;DR
The /api/proxy endpoint accepts a user-supplied URL without validation. An attacker can access internal services, read cloud metadata, and exfiltrate credentials.
Impact
Access to cloud metadata at 169.254.169.254, potential credential theft, and internal network scanning.
Location
acme/api · proxy-handler.ts:23GET/api/proxy?url=
Severity
High
CVSS
8.6Fix Effort
LowDiscovered
2h agoDiscover & Validate
Pentests your entire attack surface continuously. Reproduces each finding, confirms exploitability with proof, and prioritizes by real impact.
FixReproduction
How do I fix it?
Validate and restrict the target URL using an allowlist of permitted hostnames. Reject private/internal IP ranges and enforce HTTPS-only.
proxy-handler.ts:23-29Copy
| 23 | 23 | const targetUrl = req.query.url; |
| 24 | const resp = await fetch(targetUrl); | |
| 24 | const parsed = new URL(targetUrl); | |
| 25 | if (!ALLOWED_HOSTS.has(parsed.hostname)) { | |
| 26 | throw new ForbiddenError("blocked"); | |
| 27 | } | |
| 28 | const resp = await fetch(parsed.href); | |
| 25 | 29 | return res.json(await resp.json()); |
✓Fix verified — vulnerability no longer exploitable
→PR #247 fix/ssrf-proxy-handler ready to merge
Auto-Fix
Generates a fix, retests to confirm the vulnerability is gone, and delivers a merge-ready PR. Review, merge, done.
Deploy with confidence
Ensure nothing vulnerable reaches production. Every vulnerability discovered, validated, and resolved before it reaches production.
Every PR reviewed
Catches vulnerabilities at the source. Every pull request is reviewed before it can be merged.
Blocks vulnerable deploys
Plugs into your CI/CD pipeline. Vulnerable code never reaches production.
Monitors your attack surface
New CVEs tested against your systems. Latest threats flagged instantly.
Runtime validation
Each finding ships with a PoC and reproduction steps. Proven against your live environment.
Context-aware pentesting
Knows your stack, architecture, and business logic. Tests tailored to your environment.
Continuous learning
Learns from past findings and how you fixed them. Every pentest builds on the last.
Ship fast without compromising security
Everything you need to track your security posture, validate findings, and ship fixes — without slowing your team down.
Enterprise-grade security
Built for teams that need full control over deployment, data privacy, and compliance.
Self-Hosted Deployment
Deploy in your own VPC, on-premise, or air-gapped environment with complete control over your infrastructure.
Internal Infrastructure Pentesting
Go beyond external attack surfaces. Test internal networks, services, and infrastructure from inside your environment.
Zero Data Retention
Your source code is never stored or used for model training. All model providers operate under zero data retention agreements.
Dedicated Support & SLA
Dedicated support, custom SLAs, priority Slack channel, and hands-on onboarding. SOC 2 Type II and ISO 27001 compliant.
From the blog
Security research, product updates, and insights from the Strix team.
Start testing in minutes
Connect your GitHub repos and domains, and get fully set up in a few clicks.