# Xalgorix

> Hosted autonomous AI pentesting. Runs a 22-phase offensive methodology against web apps and APIs and ships verified, evidence-backed findings on demand.

Xalgorix is a SaaS that turns the `xalgo` offensive engine into a click-to-scan service. Users pick a target, choose a scan mode (single / wildcard), and receive live phase progress, severity-rated findings with evidence, and a branded PDF report. Pricing is credit-based with monthly subscriptions and one-time top-up packs.

## Pages

- [Home](/): Product overview, 22-phase methodology, scan modes, and sample finding.
- [Methodology](/methodology): The 22 phases Xalgorix runs on every engagement.
- [Pricing](/pricing): Subscription tiers (Starter, Pro, Teams / Enterprise) and one-time credit packs from $1.
- [Docs](/docs): Quickstart, scan modes, and FAQ.
- [API docs](/docs/api): Public REST API — start scans, poll status, pull findings, plus webhooks, status badges, and the GitHub Action.
- [Sign up](/signup): Create an account (credit packs from $1).
- [Sign in](/login): Account access.

## API & integrations

- REST API (Bearer `xlg_live_…` keys): `POST /api/public/v1/scans` to start a scan, `GET /api/public/v1/scans?id=` for status, `GET /api/public/v1/findings?scan_id=` for findings. 30 scans/min per key.
- Webhooks: register HTTPS endpoints to receive a signed `scan.completed` event (HMAC-SHA256 over `${timestamp}.${body}`, `X-Xalgorix-Signature` header).
- Status badge: `GET /api/public/v1/badge?slug=<trust-page-slug>` returns an SVG for embedding in a README (params: `metric`, `label`). No auth.
- GitHub Action: `xalgord/Xalgorix-SaaS/integrations/github-action@main` runs a scan in CI and can fail the build on findings above a severity threshold.