Penetration Testing as a ServiceContinuous, validated, and yours to run.
Traditional pentests describe a system that no longer exists by the time the report lands.
Strix runs penetration testing as a service — autonomous agents that test every deploy, prove what's exploitable, and ship the fix.
Trusted by security teams at
What is penetration testing?
The types of penetration testing
Pentests divide two ways — by how much the tester knows, and by which surface they target.
Black, white & gray box
Defined by tester knowledge: black box simulates an external attacker with zero information, white box has full source and architecture access, and gray box — the most commonly commissioned — sits in between.
Web application
Tests the app layer for the OWASP Top 10 — injection, broken authentication, and access-control flaws — using the OWASP Web Security Testing Guide.
API
Probes REST and GraphQL endpoints for the OWASP API Security Top 10: broken object-level authorization, excessive data exposure, and auth gaps.
Network & infrastructure
Internal and external network testing — PCI DSS Requirement 11.4 mandates both at least annually for in-scope environments.
Cloud
Tests cloud configuration, IAM, and workload exposure across AWS, GCP, and Azure environments.
Continuous (PTaaS)
Testing that runs on every deploy and pull request rather than once a year, closing the ~180-day gap between when a vulnerability ships and when it's found.
Penetration testing as a service, the Strix way
PTaaS reimagines the annual pentest for teams shipping weekly. Here is what continuous, autonomous testing delivers.
Continuous coverage
Autonomous agents test on every deploy and pull request, so new code is exploited and fixed before it ships — not once a year.
Validated with real PoCs
Every finding is exploited and proven, so your team triages confirmed risk instead of scanner noise.
Merge-ready fix PRs
Findings ship as a reproduction plus a ready-to-merge pull request — outcomes that land in the dev workflow, not a static PDF.
Full-stack coverage
Code, APIs, web apps, infrastructure, and cloud — all tested from one autonomous pentester.
Runs inside your perimeter
Open-source and self-hostable, fully air-gappable, and BYO-LLM — so source code, credentials, and findings never leave your network.
Free to start
Begin with the open-source core or usage-based hosted plan with no credit card — versus $25k–$96k/yr incumbents.
Traditional pentest vs penetration testing as a service
How a continuous, autonomous PTaaS model compares to the point-in-time consultant engagement.
Strix PTaaS
Traditional pentest
Strix PTaaS
Traditional pentest
Strix PTaaS
Traditional pentest
Strix PTaaS
Traditional pentest
Strix PTaaS
Traditional pentest
Strix PTaaS
Traditional pentest
Strix PTaaS
Traditional pentest
Strix PTaaS
Traditional pentest
Strix PTaaS
Traditional pentest
Strix PTaaS
Traditional pentest
Strix PTaaS
Traditional pentest
From issue to fix in seconds
Find critical issues, auto-validate, and auto-fix with merge-ready PRs.
SSRF via URL Parameter in /api/proxy
TL;DR
The /api/proxy endpoint accepts a user-supplied URL without validation. An attacker can access internal services, read cloud metadata, and exfiltrate credentials.
Impact
Access to cloud metadata at 169.254.169.254, potential credential theft, and internal network scanning.
Location
acme/api · proxy-handler.ts:23Severity
CVSS
8.6Fix Effort
LowDiscovered
2h agoDiscover & Validate
Pentests your entire attack surface continuously. Reproduces each finding, confirms exploitability with proof, and prioritizes by real impact.
How do I fix it?
Validate and restrict the target URL using an allowlist of permitted hostnames. Reject private/internal IP ranges and enforce HTTPS-only.
| 23 | 23 | const targetUrl = req.query.url; |
| 24 | const resp = await fetch(targetUrl); | |
| 24 | const parsed = new URL(targetUrl); | |
| 25 | if (!ALLOWED_HOSTS.has(parsed.hostname)) { | |
| 26 | throw new ForbiddenError("blocked"); | |
| 27 | } | |
| 28 | const resp = await fetch(parsed.href); | |
| 25 | 29 | return res.json(await resp.json()); |
Auto-Fix
Generates a fix, retests to confirm the vulnerability is gone, and delivers a merge-ready PR. Review, merge, done.
Frequently asked questions
Common questions about penetration testing and PTaaS.
Start testing in minutes
Continuous pentesting for teams that ship often — with proofs, fixes, and ownership inside your perimeter.