The autonomous offensive security platform
Find what matters.
Prove what breaks.
An autonomous AI agent pentests your app, proves every finding with a working exploit, and hands your engineers the fix.
Non-destructive payloads · safe for staging & production · built on the Apache-2.0 engine
22
test phases, from recon to final report
~20 min
to first results on a single target
$10
credit packs that never expire
How it works
No proof, no finding.
Every finding in your report has already been exploited once — safely, by the agent — before it reaches you.
- 01
Point it at your app
Paste a URL, hostname, or wildcard. Scope is validated before anything runs.
- 02
It proves what it finds
22 phases from recon to exploit verification. Findings that can't be reproduced never reach your report as confirmed.
- 03
Ship the fix
Severity, CVSS, evidence, and remediation — as a branded PDF or a signed link for your team.
22 phases. Every engagement.
Explore the methodology- 01Reconnaissance
- 02Manual vulnerability discovery
- 03Directory and file discovery
- 04CORS and cookie analysis
- 05Authentication and session testing
- 06Injection testing
- 07SSRF testing
- 08IDOR and broken access control
- 09API and GraphQL testing
- 10File upload testing
- 11Deserialization and RCE
- 12Race conditions and business logic
- 13Subdomain takeover
- 14Open redirect testing
- 15Email security testing
- 16Cloud and infrastructure
- 17WebSocket testing
- 18CMS-specific testing
- 19Broken link hijacking and content spoofing
- 20Exploit verification
- 21Novel vulnerability discovery
- 22Final report
For developers
Catch it in the PR. Not in production.
Free diff-scoped reviews from the GitHub App, or exploit-verified merge gating with the Action.
Install once. Every PR gets reviewed.
- Free — no workflow file, API key, or account
- Catches injection, auth/IDOR, SSRF, secrets, and unsafe patterns in the changed code
- Updates in place on new commits — never spams the PR
- Comment
@xalgorix reviewto re-run on demand
HighSQL injection via unsanitized id
api/users.ts — req.query.id is interpolated into the query. Use a parameterized statement.
Free diff-scoped review · comment @xalgorix review to re-run
Privacy & open source
Your data stays yours.
The engine stays open.
Don't take our word for it. Read the engine.
Cloud runs the same exploit-verified engine that's public on GitHub, under Apache-2.0. An independent verifier re-exploits each finding before it's reported — inconclusive ones are flagged for review, never passed off as confirmed. Self-host it free with your own LLM key or fully local with Ollama, or let Cloud run it for you.
- internal/methodology/The 22 phases, defined in one registry. Phase 20 is exploit verification.(opens in a new tab)
- internal/oob/The out-of-band oracle that catches DNS, HTTP and SMTP callbacks from blind bugs.(opens in a new tab)
- internal/ratelimit/Per-domain rate limiting on every outbound request the agent makes.(opens in a new tab)
- Go + TypeScript · Apache-2.0
Isolated by policy
Every scan, finding, and report is scoped to your account by database row-level security, enforced on every public table by a CI gate.
Encrypted in transit
All traffic runs over TLS. Reports are shared only through signed, expiring links you can revoke.
You stay in control
Export or delete your scans and reports anytime. We never sell your data or train models on it.
Authorized & logged
Scans run only on targets you confirm you're allowed to test, each tied to your account.
Read the details: Privacy Policy · Data Processing Agreement · Security
Why Xalgorix
Pentest depth. Scanner speed.
Without the false positives of legacy DAST or the four-week wait for an agency.
| Capability | Xalgorix | Pentest agency | DAST scanner |
|---|---|---|---|
| Time to first results | ~20 minutes | 3–4 weeks | Hours |
| Typical cost | From $10 · $49/mo | $4,000–$20,000+ | $5,000+/yr per seat |
| Exploit-verified findings | Executed PoC | Manual | Pattern matches |
| Fix patches as git diffs | Yes | No | No |
| CI release gating | GitHub Action | No | Yes |
| Evidence report for SOC 2 reviews | Yes | Yes | Limited |
Comparison reflects typical offerings in each category; exact capabilities vary by vendor and tool.
Pricing
Credits, not contracts.
Subscribe for monthly credits, or buy packs that never expire. No sales call.
Hacker
- 60 scan credits a month
- 2 concurrent scans
- Full 22-phase methodology
- Exploit-verified findings
- Standard PDF/HTML reports
- Public share links
- Findings dashboard & history
Pro
Most popular- 150 scan credits a month
- 4 concurrent scans
- Everything in Hacker
- Scheduled recurring scans
- CI/CD integrations & webhooks
- Slack & Discord alerts
- Priority scan queue
- Custom report branding
Max
- 360 scan credits a month
- 6 concurrent scans
- Everything in Pro
- Full API access & higher rate limits
- Priority execution
- White-label reports
- Extended findings retention (365 days)
- Priority email & chat support
Single target = 1 credit · Wildcard = 1 credit per live subdomain (minimum 1) · Packs never expire and stack on any plan · Full pricing
Who's behind it
Built by someone who breaks things for a living.
Xalgorix automates the repetitive half of a real engagement — recon, injection sweeps, evidence collection — so the hard, high-value bugs get the attention. It runs the same methodology its founder works by hand.
Krishna Kumar · Founder & Lead Security Engineer · 5+ years in offensive security · 1.8k★ pentesting notes
Questions, answered.
How long does a scan take?
Single-target scans typically finish in 10–30 minutes. Wildcard scans depend on attack surface and can run for several hours. You'll see live progress the whole time.
Are findings actually exploit-verified?
Yes. Phase 20 is dedicated to exploit verification: an independent verifier re-exploits each finding before it's reported, and anything it can't reproduce is flagged for review instead of reaching your report as confirmed. You get evidence, not noise.
Is it safe to run against production?
Payloads are non-destructive, request rates are configurable, and circuit breakers, blocked destructive commands and an instant kill-switch protect your infrastructure. Only scan systems you own or have explicit written permission to test — we require you to confirm authorization on each target and log every scan.
Where is my data stored, and who processes it?
Your account, scans, findings, and reports live in our managed Postgres database with per-customer row-level isolation, and the app is hosted on Cloudflare. To run a scan, target details and findings are processed by the frontier LLM providers behind our agents (OpenAI, Anthropic, Google); transactional email is sent via Resend and billing is handled by Dodo Payments. We never sell your data or use your targets and findings to train models. Our Privacy Policy and DPA list every subprocessor and explain how to export or delete your data.
How does pricing work?
Credit-based. Single = 1 credit, Wildcard = 1 credit per live subdomain (minimum 1 credit; dead hosts add no extra cost). Subscriptions include monthly credits; top-up packs never expire and stack on any plan. See the pricing page for details.
Can I use this for bug bounty?
Yes, on programs where you have authorization and the scope permits automated testing. Respect every program's rules of engagement.
Find it before attackers do.
Launch your first autonomous scan in under 60 seconds.
From $10 · credits never expire · no sales call