Hacktron Whitebox
Full white-box pentests. At machine speed.
Hacktron Whitebox gives your pentest what black-box testing lacks: your source code. With it, Hacktron finds the business-logic and data-flow flaws an outside tester can’t see, and proves each one.
You see the price before you start and finish with a report ready for SOC 2 or ISO 27001.
Scope
One application, from its source code to its deployed app.
Testing
Agents read the application and trace untrusted input from where it enters to where it is used. Each candidate finding is tested in an isolated sandbox, or against your deployed app when dynamic testing is on, then confirmed or dismissed with the reason. Security researchers validate findings and deliver reproducible issues with remediation guidance.
Fixes
Choose Remediate on a finding and a Hacktron agent writes a fix, tests it and opens a pull request.
Reporting
Each confirmed finding comes with where it is, how it was proven and how to fix it. The full report is for your engineers and the executive report for leadership and auditors. Both are reissued after the free retest, and an attestation letter confirms the pentest.
The sample full report is from a pentest of a demo expenses app.
Price
The price follows the size of the code.
Questions
Is it a black-box test?
No. Whitebox reads the source, so it follows implementation details, data flows and business logic. For sensitive code, upload an archive, or run it inside your own network on the Enterprise plan.
Is dynamic testing safe?
Point it at a staging deployment with test accounts. Before the pentest starts, Hacktron follows your sign-in steps while you watch, and every action is logged.
Can we start it from our own tools?
Yes. Start a pentest from Slack, over MCP or through the API. An organisation admin approves the start.