What is a white box pentest?

A penetration test run with access to the source, rather than only to the running application. The tester can read how a feature is implemented instead of inferring it from the outside, which means every code path gets covered and a finding can name the file and line it came from.

White box or black box — which should we run?

White box, unless you specifically want to know what an outsider with no knowledge can reach. White box includes everything a black box run does and adds the code path, the secrets, the dependencies and the patch. Black box answers a narrower question, which is sometimes exactly the question being asked.

Does reading the source mean fewer proven findings?

No. The run establishes a finding against the running application first, then reads the source to explain it. Anything the agent cannot back up is dropped before it reaches you, whether it came from behaviour or from code.

How do you handle our source code?

It is pulled into an isolated environment for the run and destroyed when the run finishes. Nothing is kept afterwards and nothing is used to train models. If you have specific requirements, ask and we will tell you exactly where we stand.

Which code hosts do you support?

GitHub, GitLab and Bitbucket, authorised once at the organisation level. There are no credentials to paste into a form and no setup per repository.

Do we need a running environment as well?

Not necessarily. Point it at a deployment you name if you have one. If you would rather it touched nothing of yours, it builds the target from the repository, runs against that, and tears it down when the run ends.

Does a white box run produce a different report?

The same report, with more in it. Findings carry the file and the line alongside the request and the response, and the fix is attached as a pull request. It is ready when the run is, and it is what teams hand over as pentest evidence for ISO 27001 or SOC 2.

white box pentest

A white box pentest that reads the code and still has to prove it.

Connect GitHub, GitLab or Bitbucket and the agent walks the path behind every endpoint instead of guessing at it. Findings still arrive with a request and a response — now with the file and the line as well.

Start 7-day trial See pricing

01 / How a run works

It tests first, then reads.

The order matters. Source explains a behaviour it already observed; it never becomes the reason a finding exists.

Connect

Connect the repository once.

GitHub, GitLab or Bitbucket, authorised for the organisation. One connection covers every application and every run after it, with no per-repository setup. Tag each repository with its role so the agent knows how the parts fit together.

Roles such as runtime, frontend, backend or infra
Several repositories read alongside one target

Code hosts

Workspace / Integrations

Code

GitHubacme · 12 repositories connected

GitLabSync projects, open fix MRsConnect

BitbucketCloud repos, fix PRsConnect

Source reposfor app.acme.io

acme/frontendFrontend

acme/backendBackend / API

acme/monorepoMain source

acme/marketing-site—

Environment

Name the environment, or let it build one.

Point it at the deployment you choose, or have it boot the application from the repository in a managed runtime, so nothing of yours is touched. No deployment, allowlisting or firewall change is needed.

An env profile injects the variables the build needs
The code is pulled into an isolated environment for the run
Destroyed when the run ends, never used to train models

Scan modes

Step 3

Configuration

Runtime target

Use existing URLThe target is already running. The scanner reads the paired repo for context.

Set up from sourceBoots the app from the repository in a managed runtime. No deployment or allowlisting.

Env profilebilling-api · stagingfrom .env

DATABASE_URLpostgres://•••••••

STRIPE_SECRET_KEYsk_test_•••••

NODE_ENVstaging

Injected into install and build, encrypted at rest

Evidence

It exploits, then explains.

The finding is established against the running application. The source is then read to say which code produced it, which is why a white box finding still carries a request and a response as well as the file and the line.

Findings

highF-7BB9DDDEPath traversal in invoice attachment download

FindingSuggested fixAIActivity3Notes

Observation

1GET /api/invoices/INV-2201/attachment?file=../../../etc/passwd

2HTTP/2 200

3root:x:0:0:root:/root:/bin/bash

The handler joins the query parameter onto the upload directory without normalising it:

src/invoices/attachments.ts: 22 - 26

22export async function download(req, res) {

23 const invoice = await findInvoice(req.params.id);

24 const filePath = path.join(UPLOAD_DIR, req.query.file);

25 return res.sendFile(filePath);

26}

Fix

A fix written in your own idiom.

The patch uses the safe functions the rest of your code already uses, so it reads like it belongs and reviews like a normal pull request. Once it ships, Re-test checks that one finding again with the configuration it ran with.

Edit the diff or drop files before it opens
A pull request or merge request on its own branch

Fixes and pull requests

1 of 1 file included · +3 −1Branch fix/invoice-attachment-path · base main Open PR

src/invoices/attachments.ts: +3 −1

2+import { safeJoin } from "../lib/fs";

2223export async function download(req, res) {

2324 const invoice = await findInvoice(req.params.id);

24− const filePath = path.join(UPLOAD_DIR, req.query.file);

25+ const filePath = safeJoin(UPLOAD_DIR, req.query.file);

26+ if (!filePath) return res.status(404).end();

2527 return res.sendFile(filePath);

Re-test after the mergeChecks F-7BB9DDDE with the configuration it ran with.

02 / What the source adds

Six things you only get with the code.

Everything a black box run does still happens. The source is what turns a behaviour into an explanation, and an explanation into a patch.

Every path, not the handful there was time for

A person opens the routes they can reach in the days they were booked for. Reading the repository means every branch behind every endpoint gets walked, which is where the criticals nobody reaches turn up.

The file and the line behind the behaviour

A finding points at the code that produced it rather than at a URL. Whoever picks it up starts at the right place instead of reconstructing the route from a description.

Logic you cannot see from outside

Which role a check actually consults, what a background job trusts, the branch that only runs for one tenant. From the outside these are invisible; in the source they are readable.

Secrets committed where they should not be

Keys, tokens and connection strings in history, in configuration, in a test fixture someone forgot. Anything live is a finding on its own, not a footnote.

What your dependencies actually ship

The package versions you deploy, checked against known vulnerabilities, rather than a list taken at the start of an engagement.

A fix written in your own idiom

The patch uses the safe functions the rest of your code already uses, so it reads like it belongs and reviews like a normal pull request.

03 / Black, grey, white

What each box gets to see before it starts.

The same agent under all three, held to the same standard of proof. What changes is how much it has to infer.

Black box

A URL and nothing else. It maps what is reachable, registers its own account where signup is open, and works from the position an outside attacker actually starts from. Everything it reports, it reached from outside.

Grey box

Test accounts for the roles that matter. This is where broken access control surfaces, because comparing what two roles can reach means being both of them at once.

White box

Everything black box and grey box reach, plus the repository. The code path behind an endpoint is read rather than inferred, secrets and dependencies come into scope, and the fix arrives as a pull request instead of a paragraph of advice.

04 / Questions

Questions, answered.

ready when you are

Connect the repository. Get the line, not a guess.

One authorisation covers every application. The agent tests what you deploy, reads what produced it, and opens the fix on its own branch.

Start 7-day trial See pricing