Black box, grey box or white box. Interopt tests with whatever you give it.
Start your first free runGive it a URL and it tests what an assessment tests: the interface, the API behind it, and who can reach what once they are past the login. Every finding arrives with whatever proves it.
An attacker does not work from a list of bug names, and neither does a run. Every one of these gets asked of the interface and of the API behind it.
Reset tokens that still work after they have been used, sessions that survive a password change, a login endpoint with nothing throttling it, a second factor that can be stepped around. Whatever the route, the end of it is the same: somebody else inside one of your accounts.
An identifier swapped in a URL, an admin route that trusts the interface instead of the session, one tenant's records reachable from another tenant's login. It holds two accounts at once and compares what each is allowed to do, so a clean answer here means something.
SQL and command injection, the template and header cases that travel with them, an upload that lands somewhere it can execute, cross-site scripting judged by whether it runs rather than whether it appears. What proves it is what the application did, never a pattern that matched.
Server-side request forgery: input that reaches something making requests on the server's behalf, redirects carrying a destination, importers and webhooks that fetch whatever they are handed. Confirmed on a second channel, so a slow response is never mistaken for a hit.
A checkout that takes a negative quantity, a discount that stacks with itself, a step in a flow you can simply skip, two requests racing to spend the same balance. Nothing has a signature for these, because they are specific to what you built.
Stack traces on malformed input, secrets committed where they should not be, a dependency shipping a known CVE, an error page naming the stack and its version. With your repository connected it reads the source instead of inferring from the outside.
The same agent, given more each time. Nothing about the depth changes what it has to prove.
A URL and nothing else. It maps what is reachable, registers its own account where signup is open, and works from the position an outside attacker actually starts from.
Test accounts for the roles that matter. This is where broken access control surfaces, because comparing what two roles can reach requires being both of them.
Your repository connected. It reads the code path behind an endpoint rather than inferring it, and the fix comes back as a pull request written with the functions your codebase already uses.
They appear during the run rather than arriving together at the end, so the first one can be on someone's desk while the rest is still going.
The report we used to write by hand after an engagement, generated from the run instead of typed up in the week after it. It is what teams hand over as pentest evidence for ISO 27001 or SOC 2, and it is ready when the run is.
Explained, written out, and opened against your branch for review. Every fix is yours to read and merge, or to reject.
Weekly, monthly, or on every push to a branch. The depth you chose is frozen into the schedule, so the tenth run goes as deep as the first.
A URL is enough to start. Add logins and it goes deeper, connect the repository and the fix comes back with the finding.
