Black box, grey box or white box. Interopt tests with whatever you give it.
Start your first free runConnect GitHub, GitLab or Bitbucket and the agent walks the path behind every endpoint instead of guessing at it. Findings still arrive with a request and a response — now with the file and the line as well.
Everything a black box run does still happens. The source is what turns a behaviour into an explanation, and an explanation into a patch.
A person opens the routes they can reach in the days they were booked for. Reading the repository means every branch behind every endpoint gets walked, which is where the criticals nobody reaches turn up.
A finding points at the code that produced it rather than at a URL. Whoever picks it up starts at the right place instead of reconstructing the route from a description.
Which role a check actually consults, what a background job trusts, the branch that only runs for one tenant. From the outside these are invisible; in the source they are readable.
Keys, tokens and connection strings in history, in configuration, in a test fixture someone forgot. Anything live is a finding on its own, not a footnote.
The package versions you deploy, checked against known vulnerabilities, rather than what the lockfile claimed at the start of an engagement.
The patch uses the safe functions the rest of your code already uses, so it reads like it belongs and reviews like a normal pull request.
The order matters. Source explains a behaviour it already observed; it never becomes the reason a finding exists.
GitHub, GitLab or Bitbucket, authorised for the organisation. One connection covers every application and every run after it, with no per-repository setup.
Point it at the deployment you choose, or have it stand the target up from the repository itself and tear it down afterwards, so nothing of yours is touched.
The finding is established against the running application. The source is then read to say which code produced it, which is why a white box finding still carries a request and a response.
Pulled into an isolated environment for the run and destroyed when it ends. Nothing is kept afterwards and nothing is used to train models.
The same agent under all three, held to the same standard of proof. What changes is how much it has to infer.
A URL and nothing else. It maps what is reachable, registers its own account where signup is open, and works from the position an outside attacker actually starts from. Everything it reports, it reached from outside.
Test accounts for the roles that matter. This is where broken access control surfaces, because comparing what two roles can reach means being both of them at once.
Everything black box and grey box reach, plus the repository. The code path behind an endpoint is read rather than inferred, secrets and dependencies come into scope, and the fix arrives as a pull request instead of a paragraph of advice.
One authorisation covers every application. The agent tests what you deploy, reads what produced it, and opens the fix on its own branch.
