01
Repository assessment
Look beyond an individual pull request and investigate the source code as a connected application.
Whitebox
Understand the code.
Uncover the path.
Whitebox reads your whole repository with full context and surfaces the exploitable issues that only appear in how the code fits together.
Whitebox testing starts at $100. Mature applications use custom pricing based on assessment scope.
WhiteboxWorkflow illustration
For the team investigating the application
The weakness is often between the files.
An entry point, a service, and a database query can look harmless in isolation. Whitebox investigates how they connect, using a code-derived threat model and cross-file data flow.
Whitebox reads the entire repository, follows how data moves through it, and reports the issues that can actually be exploited — ranked, so your team knows what to fix first.
- Assessment scope
- The whole repository
- When to use it
- For a deeper application assessment
- What you receive
- Prioritized findings & code evidence
Purpose-built capabilities
See the paths that a single change cannot show.
Investigate how the application fits together. Map entry points, trace data across files, and use code-derived context to prioritize the weaknesses worth fixing.
02
Code-derived threat model
Build an understanding of entry points and trust boundaries from what the application actually does.
03
Data-flow tracing
Follow data through handlers, services, and sensitive operations across multiple files.
04
Exploitability context
Investigate how a potential issue can be reached and why it matters within the application.
05
Prioritized findings
Give the security team a clearer starting point for triage and remediation.
06
Assessment report
Review findings with their supporting code context, so engineers can investigate and plan a fix.
Follow the investigation
Inside a repository investigation
Build the assessment around the code
Use a repository-wide view to understand where the application accepts input and where trust boundaries need closer investigation.
- Application entry points
- Code-derived threat model
- Trust boundaries and sensitive operations
Entry point
API handler receives user input
Boundary
Request passes into an application service
Operation
Service reaches a data store
Investigation
Check controls along the path
A finding with the path attached
Follow the evidence from the input to the sensitive operation. Code references and exploitability context give engineering a clearer starting point for triage.
Example scenario
User input travels from an API handler through a service into a database query in another file.
A source-to-sink trace connects the entry point to the unsafe operation and its surrounding code.
Get started
From setup to a useful result.
- 01
Select
Point Whitebox at the repository you want to assess as a whole.
- 02
Map
Build a code-derived threat model around entry points and trust boundaries.
- 03
Trace
Follow data across files to investigate how a weakness can be reached.
- 04
Prioritize
Review a prioritized findings report with the code context needed to plan a fix.
Plan your coverage
Start with Whitebox.
From $100
Custom pricing for mature applications
Whitebox testing starts at $100. Mature applications use custom pricing based on assessment scope.
How much does Whitebox testing cost?
Whitebox testing starts at $100. The final quote depends on the repository, application complexity, and agreed assessment scope.
How are mature applications priced?
Mature applications use custom pricing. Our team scopes the codebase, architecture, integrations, and assessment depth before providing a quote.
Is PR Agent included?
Whitebox and PR Agent address different scopes. Review the pricing page or contact our team to discuss the combination you need; starting prices do not imply a bundle.
Your next security question