Does Strix cover the OWASP Top 10?

Yes. Strix agents test for the OWASP Top 10 categories and beyond, including business logic and authorization flaws that signature-based scanners cannot detect, and validate each finding with a working proof of exploit.

Can the scanner test behind a login?

Yes. Give Strix test accounts and agents authenticate, hold real sessions, and test every role, including the privilege boundaries between users.

Does Strix scan REST and GraphQL APIs?

Yes. Agents read schemas and observed traffic, then test REST and GraphQL endpoints for authorization, object reference, injection, and rate-limit issues.

How are false positives handled?

Strix reports a finding only after an agent has exploited it and captured the request and response that prove it. That validation step removes the manual triage a conventional scanner leaves to your team.

How do I get started with the Strix web vulnerability scanner?

Sign up with GitHub and run a self-serve one-time pentest of your web app and APIs, with a free retest after you fix the findings. Move to the continuous platform to test every pull request and deploy, or run the free open-source core on your own infrastructure.

Web Vulnerability Scanner With Proof of Exploit

Trusted by security teams at

What a web vulnerability scanner should do

Find the vulnerabilities in your web application and APIs before an attacker does, and tell you which ones are real. Most scanners stop at the first half. Strix agents finish the job: they exploit the weakness, capture the proof, rank it by real impact, and open the fix.

What gets tested

Full coverage of the web and API attack surface, authenticated where it matters.

OWASP Top 10 and beyond

Injection, broken access control, SSRF, insecure deserialization, misconfiguration, and the logic flaws no list covers.

REST and GraphQL APIs

Agents read schemas and traffic, then probe authorization, object references, rate limits, and mutation abuse.

Authenticated scans

Log in with real accounts and roles to test what is behind the login, including privilege boundaries between users.

Attack chains

A low-severity leak plus a weak check becomes account takeover. Agents chain steps the way an attacker would.

Source-aware when you connect a repo

Connect GitHub and agents read the code while attacking the running app, so coverage goes deeper than black-box alone.

Free retest after the fix

Merge the fix and agents replay the exact exploit to confirm it is closed.

Built for engineers, not report readers

Sign up with GitHub, connect a domain, and get results the same day.

Proof of exploit on every finding

The exact request, response, and reproduction steps, so you never argue about whether it is real.

Fix PRs, not remediation text

Validated findings arrive as merge-ready pull requests that fit your existing review flow.

Continuous or one-time

Run a one-time pentest today, or put agents on every pull request and deploy with the continuous platform.

Web vulnerability scanner vs Strix

How a signature-based scanner compares to agents that exploit and validate.

Capability

Strix

Typical web scanner

Finding validation

Exploited and proven before reporting

Flagged from a signature match

OWASP Top 10 coverage

yes

Business logic and authorization

yes

no

GraphQL and REST APIs

yes

Partial

Authenticated testing

Real sessions and roles

Recorded login scripts

Fix delivered

Merge-ready pull request

Remediation advice

Retest after fix

Free, replays the exploit

Rescan

Open source and self-hostable

yes

no

How you buy

Self-serve one-time pentest; free open-source core

Annual license, often per target

Finding validation

Strix

Exploited and proven before reporting

Typical web scanner

Flagged from a signature match

OWASP Top 10 coverage

Strix

yes

Typical web scanner

yes

Business logic and authorization

Strix

yes

Typical web scanner

no

GraphQL and REST APIs

Strix

yes

Typical web scanner

Partial

Authenticated testing

Strix

Real sessions and roles

Typical web scanner

Recorded login scripts

Fix delivered

Strix

Merge-ready pull request

Typical web scanner

Remediation advice

Retest after fix

Strix

Free, replays the exploit

Typical web scanner

Rescan

Open source and self-hostable

Strix

yes

Typical web scanner

no

How you buy

Strix

Self-serve one-time pentest; free open-source core

Typical web scanner

Annual license, often per target

From issue to fix in seconds

Find critical issues, auto-validate, and auto-fix with merge-ready PRs.

←Issues/STR-00847

SSRF via URL Parameter in /api/proxy

OpenHigh · 8.6CWE-918

TL;DR

The /api/proxy endpoint accepts a user-supplied URL without validation. An attacker can access internal services, read cloud metadata, and exfiltrate credentials.

Impact

Access to cloud metadata at 169.254.169.254, potential credential theft, and internal network scanning.

Location

acme/api · proxy-handler.ts:23

GET/api/proxy?url=

Severity

High

CVSS

8.6

Fix Effort

Low

Discovered

2h ago

Discover & Validate

Pentests your entire attack surface continuously. Reproduces each finding, confirms exploitability with proof, and prioritizes by real impact.

FixReproduction

How do I fix it?

Validate and restrict the target URL using an allowlist of permitted hostnames. Reject private/internal IP ranges and enforce HTTPS-only.

proxy-handler.ts:23-29Copy

23	23	const targetUrl = req.query.url;
24		const resp = await fetch(targetUrl);
	24	const parsed = new URL(targetUrl);
	25	if (!ALLOWED_HOSTS.has(parsed.hostname)) {
	26	throw new ForbiddenError("blocked");
	27	}
	28	const resp = await fetch(parsed.href);
25	29	return res.json(await resp.json());

✓Fix verified — vulnerability no longer exploitable

→PR #247 fix/ssrf-proxy-handler ready to merge

Auto-Fix

Generates a fix, retests to confirm the vulnerability is gone, and delivers a merge-ready PR. Review, merge, done.

Frequently asked questions

Common questions about web and API vulnerability scanning.

It probes a web application and its APIs for security weaknesses such as injection, broken access control, misconfiguration, and vulnerable components. Most scanners stop at flagging suspicious responses. Strix goes further and exploits each candidate to prove which findings are real.