Questions, answered

An AI penetration testing platform. You connect a target, a domain you have verified or a GitHub repository, and an autonomous agent tests it inside its own isolated sandbox. It keeps only the findings it can prove with a working exploit, and can re-run that exploit later to check a fix. The same engine also reviews pull requests.

A scanner matches signatures and reports what might be wrong. The Vulnix agent plans an engagement, chains requests the way an attacker would, and only reports a vulnerability once it has exploited it, with the request and response that prove it.

Web apps and APIs on domains you have verified, public IP ranges (internet-facing infrastructure only), and GitHub repositories. A whitebox scope can also carry a verified domain, so one run covers the source and the live app.

Blackbox attacks a live target from the outside with no source access, and each finding carries the request and response that reproduce it. Whitebox clones a connected repository into the sandbox and reads the code first, so findings point at the exact file and line. Both cost one pentest.

Yes, on a paid plan. Vulnix Agent is a chat with the same engine: agree a plan, watch it test in its sandbox, and steer it as it goes.

No separate form. Proving you control the domain, with a DNS TXT record, an uploaded file or a meta tag, is what lets a run against it start. If the domain is on Cloudflare or Vercel, connect the provider and Vulnix adds the record for you.

Every account is created with an address at a company's own domain, Google sign-up included. It keeps the platform for teams testing what they own, and a confirmed work email also verifies your company's own domain when you sign up.

It depends on the size of the target. You can watch it live the whole time: the agent's plan, the requests it sends and each finding as it is proven.

A finding is kept only once the agent has exploited it, with the evidence that proves it. Whatever the target returns is treated as a claim to check, never as proof.

Marking a finding fixed is a status change you make yourself. Validate Fix is a real re-test: it replays the original exploit against just that finding's asset to confirm the fix holds before you close it.

Every proven finding in your workspace, and a PDF report with each one, the steps to reproduce it and how to fix it.

For an eligible whitebox finding, yes: a real GitHub pull request with the fix already applied, opened when you ask for it.

One full pentest, blackbox or whitebox, and 5 PR reviews a month, with no card and no expiry. High and critical findings show as a preview until you choose a plan.

No. PR reviews have their own monthly allowance on every plan: 5 on Free, then 20, 50 and 200 on the paid plans.

You can move up at any time; the new plan starts straight away. Enterprise is set up with our team rather than at checkout.

In a fresh, network-isolated sandbox created for each run and torn down after it. Vulnix runs on Google Cloud in Frankfurt, Germany.

Test-user credentials and custom headers are encrypted at rest and decrypted only inside that run's own isolated sandbox.

No. It only tests verified domains, connected repositories and public IP ranges you add, and anything it reads while testing is treated as data, never as an instruction to widen the scope.

GitHub (whitebox pentests, PR reviews and fix pull requests), Jira (create an issue from a finding), Slack (channel notifications), and Cloudflare and Vercel for domain verification. GitLab, Bitbucket, Microsoft Teams and Linear are on the roadmap, not available yet.

Yes: a REST API at api.vulnix.dev with scoped tokens, and signed webhooks for finished pentests, PR review verdicts and finding changes. New tokens and webhooks need the Startup plan or above.

Yes, through the hosted Vulnix MCP server. Your AI tool signs in with your Vulnix account and can start runs and read findings, read-only by default.