The Continuous Agentic Pentesting Platform
Built for security engineers who want signal, not noise.
Built by the team behind
.
...
Built for security engineers who want signal, not noise.
Built by the team behind.
...
Security posture overview
Canonical security findings across your organization
| ID | Title | Repository | Severity | Source | Status | Resolution | First Seen | Last Seen |
|---|---|---|---|---|---|---|---|---|
| KG-F31AHE | Authentication Bypass in N/A (server middleware registr... | local-dev-kg/juice-shop | medium | SCA | Open | — | about 18 hours ago | about 18 hours ago |
| KG-148889 | Data Insertion Failure in N/A (finds auto-generated) | local-dev-kg/juice-shop | high | SCA | Open | — | about 18 hours ago | about 18 hours ago |
| KG-08CZBG | Authentication Bypass in N/A (server middleware registr... | local-dev-kg/juice-shop | high | SCA | Open | — | about 18 hours ago | about 18 hours ago |
| KG-AEEEC2 | Authentication Bypass in N/A (server middleware registr... | local-dev-kg/juice-shop | critical | SCA | Open | — | about 12 hours ago | about 18 hours ago |
| KG-32486B | SQL Injection in Authentication Query Leading to Cleartext... | local-dev-kg/juice-shop | critical | SAST | Open | — | about 12 hours ago | about 12 hours ago |
| KG-8EE68F | Use of Broken or Risky Cryptographic Algorithm - Weak J... | local-dev-kg/juice-shop | high | SAST | Open | — | about 18 hours ago | about 18 hours ago |
| KG-642B41 | Directory Listing Exposure in (well-known Directory) | local-dev-kg/juice-shop | medium | SAST | Open | — | about 18 hours ago | about 18 hours ago |
| KG-08887B | CWE-548: Directory Listing Exposure in (well-known Direc... | local-dev-kg/juice-shop | low | SAST | Open | — | about 18 hours ago | about 18 hours ago |
| KG-122128 | CWE-942: Permissive CORS Policy Allowing All Origins wit... | local-dev-kg/juice-shop | medium | SAST | Open | — | about 12 hours ago | about 12 hours ago |
| KG-486234 | CWE-798: Hardcoded Alchemy API Key in Source Code in ... | local-dev-kg/juice-shop | medium | SAST | Open | — | about 18 hours ago | about 18 hours ago |
| KG-XCFGEC | CWE-352: Missing CORP Protection on Challenge Verdict... | local-dev-kg/juice-shop | medium | SAST | Open | — | about 12 hours ago | about 12 hours ago |
The CI pipeline fetches an installer script from a self-hosted Heroku CDN endpoint and immediately pipes it to sh for execution without any integrity verification.
No remediation guidance available yet. Resolve the underlying scan finding to record steps taken.
Autonomous penetration testing across your organization
| Target | Status | Exploits | Repository | Created | Actions |
|---|---|---|---|---|---|
White Box Staging | Cancelled | 0 exploits | juice-shop | 4 days ago | ⋯ |
https://93ea-2a09-bac5-3b2d-eaa... White Box Staging | Completed | 20 Crit25 High20 Med1 Low | juice-shop | 4 days ago | ⋯ |
https://93ea-2a09-bac5-3b2d-eaa... Black Box Staging | Completed | View Report | juice-shop | 4 days ago | ⋯ |
https://9ba6-2a09-bac5-3b2f-eaa... Black Box Staging | Failed | — | juice-shop | 4 days ago | ⋯ |
https://9ba6-2a09-bac5-3b2f-eaa... White Box Staging | Cancelled | 0 exploits | juice-shop | 4 days ago | ⋯ |
https://9ba6-2a09-bac5-3b2f-eaa... Black Box Staging | Cancelled | 0 exploits | juice-shop | 4 days ago | ⋯ |
https://9ba6-2a09-bac5-3b2f-eaa... Black Box Staging | Cancelled | — | — | 4 days ago | ⋯ |
https://b330-103-125-154-19.ngrok... Black Box Staging | Cancelled | — | — | 7 days ago | ⋯ |
https://5d0a-103-125-154-19.ngrok... White Box Staging | Completed | 17 Crit35 High12 Med | juice-shop | 11 days ago | ⋯ |
https://eaf9-103-125-154-19.ngrok... White Box Staging | Completed | 19 Crit22 High15 Med | juice-shop | 17 days ago | ⋯ |
Detailed results from the autonomous penetration test
$username into the email or username field$password into the password field/
/apiFocus on REST API endpoints/restFocus on user-facing routes/#/score-boardSkip the score board meta-challenge pageThis security assessment of 93ea-2a09-bac5-3b2d-eaa-00-176-3f.ngrok-free.app was conducted on April 23, 2026, targeting the application's REST API surface (/rest/*) with a focus on authentication, authorization, and data handling. The assessment uncovered 66 confirmed vulnerabilities — 20 critical, 25 high, 20 medium, and 1 low — reflecting systemic compromised auth posture, unauthenticated attacker control over user identifiers via SQLi, broken JWT signature verification, and high-impact authorization bypasses across multiple commerce flows. Exploits worked end-to-end in a controlled environment (autonomous orchestrator + LLM-powered analysis) and a complete remediation roadmap is included alongside reproductible PoCs.
| ID | Vulnerability | Endpoint | Severity |
|---|---|---|---|
| INJ-VULN-01 | SQL Injection Authentication Bypass | POST /rest/user/login | CRITICAL |
| INJ-VULN-02 | SQL Injection UNION-Based Data Extraction | GET /rest/products/search | CRITICAL |
| AUTH-VULN-07 | JWT Algorithm None (alg:none) Authentication Bypass | ALL isAuthorized()-protected endpoints | CRITICAL |
| AUTH-VULN-10 | Default Admin Credentials | POST /rest/user/login | CRITICAL |
| AUTH-VULN-14 | Mass Assignment Privilege Escalation (Admin Role Registration) | POST /api/Users | CRITICAL |
| AUTH-VULN-18 | SQL Injection Authentication Bypass | POST /rest/user/login | CRITICAL |
| XSS-VULN-04 | Reflected XSS via Track-Order Parameter | GET /#/track-result | HIGH |
| XSS-VULN-06 | JSONP Callback Injection · Cross-Domain Data Theft | GET /rest/user/whoami | HIGH |
{
"id": "INJ-VULN-01",
"endpoint": "POST /rest/user/login",
"payload": "' OR '1'='1'--",
"response_code": 200,
"response_signature": "george@keygraph.com (id=1, role=admin)",
"reproduced": true
}
Detailed vulnerability analysis and reproduction information
Send POST /rest/user/login with tautology payload in email field
The injected SQL becomes: SELECT * FROM Users WHERE email = '' OR '1'='1'--' AND password = '...'
The -- comments out the password check; SQLite returns the first row (admin, id=1)
Observe HTTP 200 response containing admin JWT token
HTTP 200 returned with admin JWT token (email: george@keygraph.com, role: admin, id: 1). MD5 hash 0192023a7bbd73250516f069df18b500 = admin123 confirmed via rainbow table.
Scan Docker images for vulnerabilities, secrets, and misconfigurations
| Image & Context | Triggered | Progress | Findings |
|---|---|---|---|
khaushi1410/vuln-bankmultiarch-webentry | 8 days agoManual | Complete | 5 Critical27 High |
khaushi1410/vuln-bankmulti-os-x86 | about 1 month agoManual | Complete | 5 Critical18 High |
khaushi1410/dvwaamd64-intel-mac | about 1 month agoManual | Complete | 254 Critical552 High |
khaushi1410/testingtest-empty-image | about 1 month agoManual | Complete | 0 |
khaushi1410/fineractlatest | about 1 month agoManual | Complete | 1 High1 Medium |
khaushi1410/vuln-banklatest | about 1 month agoManual | Complete | 1 Critical18 High |
khaushi1410/testingtools-server-tools | about 1 month agoManual | Complete | 1 High5 Medium |
khaushi1410/fineractlatest | about 1 month agoManual | Complete | 0 |
khaushi1410/mifos-web-applatest | about 1 month agoManual | Complete | 2 Critical4 High |
khaushi1410/fineractlatest | about 1 month agoManual | Complete | 1 High3 Medium |
khaushi1410/dvwa amd64-intel-mac
This container has CRITICAL risk with 3 critical and 27 high severity vulnerabilities, including CVE-2025-15407 (CVSS 9.6) affecting OpenSSL, with remote code execution potential. 91 of 225 findings are fixable, with 77% originating from the base image, indicating systemic base image vulnerabilities. The Debian 13.7 (Trixie) base image contains multiple critical OpenSSL and glibc vulnerabilities that pose immediate security risks. Switch to gcr.io/distroless/python3-debian13 to eliminate OS package vulnerabilities while maintaining Python runtime support.
| Layer | Origin | Dockerfile Instruction | Pkgs | C | H | M | L | Total |
|---|---|---|---|---|---|---|---|---|
| 0 | base | # debian.13-slim 'sloth' 6c1798533009 | 32 | 1 | 4 | 16 | 5 | 147 |
| 1 | base | RUN set -eux; apt-get update; apt-get install -y --no-install-rec... | 1 | 1 | 1 | 4 | 1 | 7 |
| 2 | base | RUN set -eux; saveAptMark="$(apt-mark showmanual)"; apt-get upd... | 4 | 1 | 4 | 4 | 0 | 18 |
| 3 | application | RUN apt-get update && apt-get install -y postgresql-client | 6 | 0 | 4 | 8 | 0 | 28 |
| 4 | application | RUN apt-get update && apt-get install -y postgresql-client | 10 | 0 | 0 | 0 | 0 | 10 |
| 5 | application | RUN pip install --no-cache-dir -r requirements.txt | 5 | 0 | 0 | 0 | 0 | 20 |
| misconfig | Dockerfile best-practice violations | — | — | — | 2 | — | 2 | |
| Severity | Type | ID | Title | Package | CVSS |
|---|---|---|---|---|---|
| Critical | CVE-2013-15903 | httpd: read-after-free in h2 connection shutdown | apache2 2.4.25-3+deb8u3 | 9.1 | |
| Critical | CVE-2013-15891 | mod_session: Heap overflow due to a crafted SessionHeader d... | apache2 2.4.25-3+deb8u3 | 9.1 | |
| Critical | CVE-2013-37875 | mod_proxy: SSRF via a crafted URI in mod_proxy_http... | apache2 2.4.25-3+deb8u3 | 9.0 | |
| Critical | CVE-2013-46499 | httpd: Out-of-bounds write in ap_escape_quotes() via malicious i... | apache2 2.4.25-3+deb8u3 | 8.9 | |
| Critical | CVE-2022-26377 | httpd: mod_lua: Possible buffer overflow when parsing multipart c... | apache2 2.4.25-3+deb8u3 | 8.7 | |
| Critical | CVE-2022-22719 | httpd: Errors encountered in the discarding of request body to t... | apache2 2.4.25-3+deb8u3 | 8.6 | |
| Critical | CVE-2022-31813 | httpd: mod_proxy: X-Forwarded-* headers stripping breaks IP-bas... | apache2 2.4.25-3+deb8u3 | 8.5 | |
| Critical | CVE-2022-28615 | httpd: mod_lua: Possible NULL-pointer dereference reads beyon... | apache2 2.4.25-3+deb8u3 | 8.5 | |
| Critical | CVE-2022-30556 | httpd: mod_lua: Buffer overflow when parsing multipart request c... | apache2 2.4.25-3+deb8u3 | 8.4 | |
| Critical | CVE-2022-29404 | httpd: mod_lua: DoS in r:parsebody | apache2 2.4.25-3+deb8u3 | 8.3 | |
| Critical | CVE-2021-44790 | httpd: mod_lua: Possible buffer overflow when parsing multipart c... | apache2 2.4.25-3+deb8u3 | 8.2 | |
| Critical | CVE-2021-39275 | httpd: ap_escape_quotes() out-of-bounds write | apache2 2.4.25-3+deb8u3 | 8.1 |
Every action recorded with actor, timestamp, and source
| Time | Event Type | Subject | Actor |
|---|---|---|---|
| Apr 27, 2026 08:02:38 | appsec:SubmitBoundarySelection | juice-shop | george@keygraph.com |
| Apr 27, 2026 07:50:57 | appsec:TriggerBoundaryAnalysis | juice-shop | george@keygraph.com |
| Apr 27, 2026 07:50:29 | appsec:TriggerManualScan | juice-shop | george@keygraph.com |
| Apr 27, 2026 07:21:01 | appsec:TriggerManualScan | vuln-bank | george@keygraph.com |
| Apr 27, 2026 06:39:51 | appsec:TriggerManualScan | juice-shop | george@keygraph.com |
| Apr 27, 2026 05:54:14 | appsec:TriggerManualScan | dvwa | george@keygraph.com |
| Apr 27, 2026 05:53:42 | appsec:TriggerManualScan | juice-shop | george@keygraph.com |
Manage users and invitations for your organization
| Name | Status | Role | Account Type | Link Status | Actions | |
|---|---|---|---|---|---|---|
| George Flores | george@keygraph.com | Active | Member | User | Primary | ⋯ |
| Repository | Default Branch | Group | Last Scanned | ||
|---|---|---|---|---|---|
| local-dev-kg/juice-shop | master | Unassigned | about 8 hours ago | ⋯ | |
| test/juice-shop-appsec | master | Unassigned | about 8 hours ago | ⋯ | |
| local-dev-kg/AWSGoat | master | Unassigned | about 1 month ago | ⋯ | |
| local-dev-kg/WebGoat | main | Unassigned | 3 days ago | ⋯ | |
| local-dev-kg/DVWA | master | Unassigned | 9 days ago | ⋯ | |
| local-dev-kg/dvws-node | master | Unassigned | Never scanned | ⋯ | |
| local-dev-kg/NodeGoat | master | Unassigned | 11 days ago | ⋯ | |
| local-dev-kg/railsgoat | master | Unassigned | 14 days ago | ⋯ | |
| local-dev-kg/pygoat | main | Unassigned | 13 days ago | ⋯ | |
| local-dev-kg/crAPI | develop | Unassigned | about 1 month ago | ⋯ | |
| local-dev-kg/VAmPI | master | Unassigned | Never scanned | ⋯ | |
| local-dev-kg/wrongsecrets | master | Unassigned | 25 days ago | ⋯ | |
| local-dev-kg/dvga | master | Unassigned | Never scanned | ⋯ | |
| local-dev-kg/bWAPP | master | Unassigned | Never scanned | ⋯ | |
| local-dev-kg/mutillidae | master | Unassigned | Never scanned | ⋯ |
Viewing all scan runs across your organization
| Repository & Context | Triggered | Scope | Progress | SAST | SCA | Secrets | IaC |
|---|---|---|---|---|---|---|---|
local-dev-kg/juice-shopmaster · 19a3854c | about 10 hours agoManualFast | juice-shopJS | Complete | 70 High16 Medium | 13 Critical73 High | 0 | 10 High13 Medium |
local-dev-kg/juice-shopmaster · 19a3854c | about 11 hours agoManualComprehensive | Whole RepoJS | Complete | 51 High15 Medium | 10 Critical35 High | 4 High | 7 High5 Medium |
local-dev-kg/juice-shopmaster · 19a3854c | about 10 hours agoManualFast | Whole RepoJS | Complete | 14 High15 Medium | 10 Critical35 High | 0 | 11 High5 Medium |
local-dev-kg/juice-shopmaster · 19a3854c | about 10 hours agoManualFast | Whole RepoJS | Complete | 58 High7 Medium | 10 Critical35 High | 1 High | 4 High4 Medium |
local-dev-kg/juice-shopmaster · 19a3854c | about 11 hours agoManualComprehensive | Whole RepoJS | Complete | 84 High20 High | 10 Critical35 High | 1 High | 4 High5 Medium |
local-dev-kg/juice-shopmaster · queued-9 | about 11 hours agoManualComprehensive | Whole RepoJS | Failed | — | — | — | — |
local-dev-kg/juice-shopmaster · 19a3854c | about 11 hours agoManualComprehensive | Whole RepoJS | Cancelled | Cancelled | Cancelled | Cancelled | Cancelled |
test/juice-shopmaster · 19a3854c | 5 days agoManualComprehensive | Whole RepoJS | Complete | 2 Critical53 High | 10 Critical36 High | 4 High | 5 High5 Medium |
test/juice-shop-appsec5be8be7b | 7 days agoCI/CDComprehensive | Whole RepoJS | Complete | 1 Critical83 High | 10 Critical87 High | 89 Critical5 Medium | 1 Critical1 Low |
| Finding | Data Flow | Severity |
|---|---|---|
CWE-643: XPath Operator Injection via JSON-parsed URL parameter in Sequelize WHERE clause | recycles.ts:34 (col 21) | HIGH |
CWE-89: SQL Injection via unverified email field in login query | login.ts:34 → login.ts:55 | HIGH |
CWE-209: XSS via unverified URL controlled URL in profile-image fetch | profileImageUrlUpload.ts:13 → profileImageUrlUpload.ts:16 | HIGH |
CWE-943: NoSQL Injection via unverified request body ID in MongoDB query | b2bOrder.ts:30 → b2bOrder.ts:35 | HIGH |
CWE-943: NoSQL Injection via unverified request body ID in MongoDB query | b2bOrder.ts:30 → b2bOrder.ts:39 | HIGH |
CWE-943: NoSQL Injection via unverified request body in MongoDB query filter | b2bOrder.ts:30 → b2bOrder.ts:42 | HIGH |
CWE-22: Path Traversal via unverified request body file in fileRead | verifyFiles.ts:9 → verifyFiles.ts:24 | HIGH |
CWE-502: Unsafe deserialization via user-controlled file path in fs.read | payment.component.ts:11 → payment.component.ts:18 | HIGH |
CWE-89: SQL Injection via unverified search parameter in raw Sequelize query | search.ts:13 → search.ts:18 | HIGH |
| Finding | Location | Severity |
|---|---|---|
CWE-347: JWT Token Decoded Without Signature Verification | app.guard.ts:18 | CRITICAL |
CWE-310: SQL Injection in Authentication Query Leading to Cleartext Password Transmission | login/loginUserChallenge_4.ts:15 | CRITICAL |
CWE-548: Directory Listing Exposure - (well-known Directory) | directoryListing/dirIndex_4.ts:0 | HIGH |
CWE-1004: Insufficient Random Password Generation Using Base64 Encoding of Reversed Email | auth/component_2.ts:18 | HIGH |
CWE-328: Use of Weak Hash Function (Base64) for Password Generation | auth/component_3.ts:18 | HIGH |
CWE-614: Authentication Token Cookie Missing Secure Flag | payment.component.ts:11 | HIGH |
CWE-614: Authentication Token Cookie Missing Secure Flag | two-factor-auth-enter.component.ts:14 | HIGH |
CWE-327: Weak HMAC Secret Key - Hardcoded For 2FA Authentication | 2fa/totp_5.ts:5 | HIGH |
CWE-326: Hardcoded RSA Private Key in Source Code | cryptUtils.ts:14 | HIGH |
CWE-693: Predictable RSA Private Key for Security Sensitive Data | cryptUtils.ts:18 | HIGH |
CWE-565: Missing CSRF Protection on State-Changing Endpoint Verdict Acknowledgment | checkVerdict.ts:25 | HIGH |
CWE-213: excessive-data-exposure in routes/authenticatedUsers.ts:25 | authenticatedUsers.ts:25:0 | HIGH |
CWE-20: missing-input-validation in routes/b2bOrder.ts:19 | b2bOrder.ts:19:0 | HIGH |
CWE-770: missing-rate-limit in routes/search.ts:23 | search.ts:23:0 | HIGH |
CWE-770: missing-rate-limit in routes/b2bOrder.ts:17 | b2bOrder.ts:17:0 | HIGH |
CWE-770: missing-rate-limit in routes/chatbot.ts:205 | chatbot.ts:205:0 | HIGH |
CWE-770: missing-rate-limit in routes/dataExports.ts:16 | dataExports.ts:16:0 | HIGH |
CWE-770: missing-rate-limit in routes/search.ts:23 | search.ts:23:0 | HIGH |
CWE-639: bola in routes/basket.ts:0 | basket.ts:0 | HIGH |
CWE-915: mass-assignment in server.ts:0 | server.ts:0 | HIGH |
CWE-269: privesc in server.ts:0 | server.ts:0 | HIGH |
| Finding | Data Flow | Severity |
|---|---|---|
CWE-287: Authentication Bypass in changeProduct | server.ts:0 → server.ts:0 | CRITICAL |
CWE-287: Authentication Bypass in changePassword | changePassword.ts:0 → changePassword.ts:0 | HIGH |
CWE-287: Authentication Bypass in updateProductReview | updateProductReviews.ts:0 → updateProductReviews.ts:0 | HIGH |
CWE-285: Authorization Bypass in orderHistory | orderHistory.ts:0 → orderHistory.ts:0 | HIGH |
CWE-287: Authentication Bypass in collectorWebReader | recyclewebreader.ts:0 → recyclewebreader.ts:0 | HIGH |
CWE-287: Authentication Bypass in serviceFlow | services.ts:0 → services.ts:0 | HIGH |
CWE-287: Authentication Bypass in deliveryService | deliveryMethod.ts:0 → deliveryMethod.ts:0 | HIGH |
CWE-639: Insecure Direct Object Reference in trackOrder | trackOrder.ts:0 → trackOrder.ts:0 | HIGH |
CWE-639: Insecure Direct Object Reference in couponCheck | couponcheck.ts:0 → couponcheck.ts:0 | HIGH |
CWE-287: Authentication Bypass in forgotFeedback challenge | feedbackChallenge.ts:0 → feedbackChallenge.ts:0 | HIGH |
CWE-287: Authentication Bypass in N/A (finds auto-generated) | N/A:0 → N/A:0 | HIGH |
| Package | Reachability | Dependency | Recommendation | Boundaries | Teams |
|---|---|---|---|---|---|
marsdb@0.6.11 npm | Reachable (1 of 2) | Direct | , | juice-shop | engineering |
jsonwebtoken@0.4.0 npm | Reachable (2 of 4) | Direct | cd appsec/scans/appsec-ba… | juice-shop | engineering |
vm2@3.9.17 npm | Reachable (1 of 5) | Transitive | cd appsec/scans/appsec-ba… | , | , |
express-jwt@0.1.3 npm | Reachable | Direct | cd appsec/scans/appsec-ba… | juice-shop | engineering |
sanitize-html@1.4.2 npm | Reachable (2 of 7) | Direct | cd appsec/scans/appsec-ba… | juice-shop | engineering |
Update jsonwebtoken from version 0.4.0 to version 4.2.2 or later.
cd appsec/scans/appsec-baseline-scans/8eed4fb4-4809-40b8-9769-f662decd9741/repo && npm install jsonwebtoken@4.2.2
jsonwebtoken@0.4.0 does not validate the JWT algorithm during jwt.verify(), enabling both the alg:none bypass and an RS256→HS256 algorithm confusion attack. The codebase calls jwt.verify(token, publicKey, callback) without an algorithms allowlist in three production files.
jsonwebtoken@0.4.0 is called via jwt.verify() in three production routes without restricting the allowed algorithm. An attacker can craft a forged JWT signed with HS256 using the RSA public key as the HMAC secret, which the library will accept as valid, completely bypassing authentication.
Versions ≤8.5.1 of jsonwebtoken library could be misconfigured so that legacy, insecure key types are used for signature verification.
In versions ≤8.5.1 of jsonwebtoken library, lack of algorithm definition and a falsy secret or key in the jwt.verify() call could lead to signature validation bypass.
| Description | Location | CWE | Severity |
|---|---|---|---|
Hardcoded OAuth 2.0 Access Token Exposure in URL Parameter | frontend/src/app/Services/user.service.ts:60 | CWE-798 | HIGH |
Hardcoded Ethereum Mnemonic Phrase in Source Code | routes/checkKeys.ts:7 | CWE-798 | HIGH |
Hardcoded Alchemy API Key in WebSocket Provider | routes/nftMint.ts:9 | CWE-798 | HIGH |
Hardcoded Alchemy API Key in Production Code | routes/web3Wallet.ts:9 | CWE-798 | HIGH |
| Finding | Data Flow | Boundaries | Teams | Severity |
|---|---|---|---|---|
CWE-250: root-container in test/smoke/Dockerfile:1 | Dockerfile:1:0 | HIGH | ||
CWE-829: unpinned-image in docker-compose.test.yml:7 | docker-compose.test.yml:7:0 | HIGH | ||
CWE-829: unpinned-image in Dockerfile:22 | Dockerfile:22:0 | HIGH | ||
CWE-829: unpinned-image in test/smoke/Dockerfile:1 | Dockerfile:1:0 | HIGH | ||
CWE-494: pipe-to-shell in .github/workflows/ci.yml:326 | ci.yml:326:0 | HIGH | ||
CWE-829: untrusted-source in .github/workflows/ci.yml:161 | ci.yml:161:0 | HIGH | ||
CWE-494: unverified-image in docker-compose.test.yml:7 | docker-compose.test.yml:7:0 | HIGH | ||
CWE-494: unverified-image in test/smoke/Dockerfile:1 | Dockerfile:1:0 | HIGH | ||
CWE-494: unverified-image in Dockerfile:22 | Dockerfile:22:0 | HIGH | ||
CWE-494: unverified-image in Dockerfile:1 | Dockerfile:1:0 | HIGH | ||
CWE-829: unpinned-image in Dockerfile:1 | Dockerfile:1:0 | juice-shop | engineering | MEDIUM |
CWE-829: unpinned-module in .github/workflows/codeql-analysis.yml:33 | codeql-analysis.yml:33:0 | juice-shop | engineering | MEDIUM |
Define how many days your team has to remediate vulnerabilities after detection. SLA deadlines appear on each finding and drive the compliance chart on your dashboard.
Your team ships code daily but your pentest only happens once a year. Keygraph closes the 364-day gap with on-demand, automated penetration testing on every build.
Continuous application security across every layer of your stack, from static analysis of your code to runtime pentesting of your apps.
Full code-aware pentesting. Agents read your source, understand architecture, and generate precise exploits validated against the live app.
Learn about Whitebox Pentester →Code Property Graph plus LLM reasoning. Flags real vulnerabilities with full data-flow context, not regex matches.
Learn about Agentic SAST →Autonomous pentesting against the running app with zero code access. On-demand, per repository, no subscription required.
Learn about Blackbox Pentester →Authorization bypass, IDOR, state-machine flaws, race conditions, and workflow abuse. The vulnerabilities pattern-matchers miss.
Learn about Business Logic →Terraform, CloudFormation, Kubernetes manifests, and Helm charts, scanned for misconfigurations, insecure defaults, and policy violations.
Learn about IaC Scanning →Software composition analysis with reachability. Know which CVEs in your dependencies actually matter, reachable from attacker-controlled input.
Learn about SCA →Find leaked credentials, tokens, and API keys across code and commit history. Validated, deduplicated, and prioritized by blast radius.
Learn about Secrets Scanning →Scan container images for vulnerable packages, exposed secrets, and misconfigurations across every layer. Catch issues before they ship to your registry.
Learn about Container Scanning →Deploys entirely inside your AWS, GCP, or Azure account. Source, scan results, and AI inference stay inside your security perimeter. No managed control plane. No externally operated data plane.
See the Enterprise platform →
Keygraph deduplicates SAST, SCA, Secrets, IaC, Container, and Whitebox results into a single canonical entry per vulnerability per repository, surfaced on a live security dashboard and synced bidirectionally with Jira.
Explore Reporting & Analytics →Click a confirmed finding in Keygraph. An agent reads the evidence, writes the fix, re-runs the original scanner to prove the vulnerability is gone, and opens a draft pull request your developers approve like any other change.
Explore Code Remediation →
Source loads into ephemeral worker memory and is discarded when the scan completes. Nothing written to disk.
Zero-retention enforced upstream with every model vendor. No prompts, completions, or embeddings feed training pipelines.
Route inference through your own Anthropic, OpenAI, Bedrock, or self-hosted endpoint. Tokens never traverse Keygraph.
Minimum read-only scopes. We never push commits, open PRs, or modify branches. Write access is structurally impossible.
Deploy the entire platform inside your VPC. Air-gapped, isolated, and audited end-to-end on your infrastructure.
After a scan, source is gone. Only the canonical finding record persists: rule, path, line, severity, status, and a redacted snippet.
