FAQ
General
-
What is Hacktron?
An AI-native offensive security company built by security researchers. Red tests your whole organisation, Whitebox pentests one application in depth and Review checks every pull request.
-
How is Hacktron different from a scanner?
Scanners flag patterns that might be wrong. Hacktron reasons about how an attacker would exploit your code and only reports what it can show is exploitable.
-
What vulnerabilities has Hacktron found?
Remote code execution in PHP, Node.js and Metabase Cloud, a path into OpenAI’s internal repositories and a way to push code to the upstream Bash repository. Read the research.
-
What languages does Hacktron support?
Any language. Those below get deeper, language-aware analysis. Not listed? Book a demo and we’ll confirm coverage.
- Python
- JavaScript
- TypeScript
- Go
- Java
- Ruby
- PHP
- Rust
- C
- C++
- C#
- Kotlin
- Swift
- Scala
- Elixir
- Solidity
Red
-
What does red teaming with Hacktron cover?
Your organisation’s entire attack surface, continuously. Hacktron keeps a living model of your external services, authentication, SaaS providers, supply chain, features and components, and tests new assets as they appear.
-
How is it different from a pentest?
A pentest tests a fixed scope once. Red teaming runs all the time, so new assets and newly disclosed vulnerabilities are tested as they appear.
-
Is the testing safe?
Yes. Destructive actions are off limits, our researchers monitor the agents, and we stop and contact you if a test could affect availability.
-
Do you check that fixes work?
Yes. Hacktron reruns the attack to confirm the path is closed.
-
How is it different from a bug bounty?
A bug bounty pays for whatever outside researchers report. Red proves complete attack paths continuously, before they become incidents or payouts.
Whitebox
-
What does a white-box pentest include?
A pentest of one application from its source code, with optional dynamic testing. Researchers validate every finding, and you get technical and executive reports, remediation guidance, an attestation letter and a free retest.
-
Can the reports support SOC 2 or ISO 27001?
Yes. They serve as pentest evidence for SOC 2, ISO 27001 and customer security reviews.
Review
-
How does Hacktron review pull requests?
It posts a security check and comments on the affected lines of each pull or merge request. Comment
@hacktron reviewto run it again, and triage findings in the thread.pkg/middleware/healthcheck.go
func isHealthCheckRequest(paths, userAgents map[string]struct{}, req *http.Request) bool {if _, ok := paths[req.URL.EscapedPath()]; ok {return true}if _, ok := userAgents[req.Header.Get("User-Agent")]; ok {return true}return false}hacktron-app Bot
High Authentication Bypass via Spoofable User-Agent Header in Health Check Middleware
The health check middleware in
oauth2-proxydetermines if a request should bypass authentication by checking if theUser-Agentheader matches a configured value (ping-user-agent). Since theUser-Agentheader is entirely controlled by the client, an attacker can spoof this header to match the configured value, thereby bypassing authentication for any arbitrary path. This allows unauthenticated access to the protected upstream service.Triage: Reply
!fp(false positive),!valid(confirmed), or!accepted_risk. Any other reply is saved as a triage note. -
Can Hacktron fix the code for me?
Only when you ask. Hacktron writes the fix, runs your tests and opens a pull request for your team to review. It never merges.
-
Which source control platforms are supported?
GitHub, including GitHub Enterprise Server, GitLab, Azure DevOps and Bitbucket.
-
Can I give Hacktron context about my codebase?
Yes. Add a
.hacktron/rules.mdfile or upload context documents. Triage feedback also teaches it.
Integrations
-
Which tools does Hacktron work with?
Slack for alerts, triage and questions in the thread: ask about a change, check a CVE against your repositories or set up a pentest by mentioning @Hacktron AI. Jira and Linear for tickets.
-
Is there an API?
Yes. A REST API with organisation-scoped keys, plus an MCP server and a Slack assistant.
-
Can I export findings?
Yes. Download executive and technical reports, or export findings as CSV, SARIF or JSON.
Deployment and access
-
Can I run Hacktron on-premises?
Yes. The on-premises edition runs entirely in your own infrastructure, including air-gapped environments.
-
How does Hacktron access my source code?
Cloud scans clone your repository into an isolated environment and store findings, with the relevant code snippets, in your account. The on-premises edition keeps your code in your environment.
-
Is my code used to train AI models?
No. Our AI providers, OpenAI, Anthropic and Google, may not train on Hacktron’s data, and zero data retention agreements mean they don’t store it.
-
How do I sign in?
With an email and password, or SAML single sign-on. Admins can require MFA for everyone in the organisation.
-
Is Hacktron SOC 2 compliant?
Yes. Hacktron has SOC 2 Type 1 and Type 2 reports from Insight Assurance. Request access in the trust centre.
Pricing
-
Is there a free trial?
Yes. Review has a 14-day free trial.
-
How is Hacktron priced?
Review per developer each month, Whitebox per pentest by the size of the code and Red per organisation. See pricing.
-
Is Hacktron free for open source?
Yes. Qualifying public repositories get Review free. Apply on the open source page.