Pinned post
zauth
This account is verified because it's an official organization on X. Learn more@zauthinc
cybersecurity for everyone
174 Following 7.2K Followers 1.2K Posts
Latest posts 5
If we can’t break your build, it’s free.
doing a lot of multitasking right now, but wanted to share some progress on our new landing page and product demo. fully e2e interactable Vector setup to show you just how easy it is for Vector to scan or pentest your web app, API, codebase, or smart contract.
and yes - we will be honoring the "if we cant break in, its on us" policy on this release. meaning that if Vector produces 0 findings of high or critical severity, every penny of the scan is covered by us.
while we want to keep Vector fully autonomous, we will be adding an option where you can opt for an additional human review for that extra peace of mind for your project. this will be auto applied for codebases > 200k SLOC, and > 100k SLOC for smart contracts (which are still coming soon).
we have argued and have published reserach regarding how Vector is the most powerful pentesting platform in its class - its time for you to see it for yourself, completely free if we find nothing.View quoted post on X
Vector is offline while we push the biggest backend update since launch.
For our technical followers, here's what changed:
Before, live exploitation only ran if you handed us a running URL. If you sent source without one, you got static analysis. Now the agent stands your app up on its own in an isolated environment, so a scan that starts from source ends the same way a live scan does, with a working exploit against your running app.
Before, your code ran inside a fixed, locked down worker that couldn't build arbitrary apps or start dependencies. Now every scan gets its own isolated environment that can build and run your app. If you have a compose file the agent runs it. If you don't, it reads the repo, figures out what the app needs, and provisions it.
Before, there was no way to stand up an app's backing services at all. Now Postgres, MySQL, MariaDB, Redis, Mongo, S3 and an SMTP capture come prebaked alongside node, python, ruby, go, java and php runtimes.
Before, testing for IDORs and broken access control leaned on test accounts you made for us. Now the agent registers its own users through your app's signup page, reads the verification email out of the SMTP capture, logs in, and repeats that for every role your app has. Then it tries to reach one user's data from another user's session. Authorization bugs get proven across privilege boundaries your app actually created, with no credentials from you.
If your app is already deployed, you can still send the URL with accounts, cookies, tokens and WAF notes, pair it with your source, and Vector scans the real production surface directly.
The most accessible and powerful pentest on the internet just got a whole lot better.
For our technical followers, here's what changed:
Before, live exploitation only ran if you handed us a running URL. If you sent source without one, you got static analysis. Now the agent stands your app up on its own in an isolated environment, so a scan that starts from source ends the same way a live scan does, with a working exploit against your running app.
Before, your code ran inside a fixed, locked down worker that couldn't build arbitrary apps or start dependencies. Now every scan gets its own isolated environment that can build and run your app. If you have a compose file the agent runs it. If you don't, it reads the repo, figures out what the app needs, and provisions it.
Before, there was no way to stand up an app's backing services at all. Now Postgres, MySQL, MariaDB, Redis, Mongo, S3 and an SMTP capture come prebaked alongside node, python, ruby, go, java and php runtimes.
Before, testing for IDORs and broken access control leaned on test accounts you made for us. Now the agent registers its own users through your app's signup page, reads the verification email out of the SMTP capture, logs in, and repeats that for every role your app has. Then it tries to reach one user's data from another user's session. Authorization bugs get proven across privilege boundaries your app actually created, with no credentials from you.
If your app is already deployed, you can still send the URL with accounts, cookies, tokens and WAF notes, pair it with your source, and Vector scans the real production surface directly.
The most accessible and powerful pentest on the internet just got a whole lot better.