xalgorixFind and fix your app's real vulnerabilities.
Proven with a working exploit — not guessed.
Point Xalgorix at your app or repo. An autonomous AI agent runs a full pentest, proves every finding with a working exploit, and hands your engineers the fix — no wall of false positives to triage. Gate releases in CI on verified results, and give auditors dated, evidence-backed reports.
self-serve from $1 · SSO, self-hosted & invoicing for teams · no card required to try
proof · not a demo
What it found on a real target
We pointed Xalgorix at pentest-ground.com:9000 — a public, deliberately-vulnerable target. In about 17 minutes it returned 9 findings and reproduced every exploit before reporting it.
Remote Code Execution
Arbitrary Python code as root via the /eval endpoint (uid=0 confirmed).
SQL Injection — full DB dump
Auth bypass on /tokens; dumped 21 accounts with plaintext passwords.
Plaintext password exposure
/user/{id} returned every account's password by incrementing the id.
for developers & CI
Ship secure code. Break the build on real bugs.
Add Xalgorix to your pipeline and every pull request gets an autonomous, exploit-verified security pass. Catch the IDOR, SSRF, or auth bypass before it merges — not after it ships. It only fails the build on findings it actually proved.
Runs on every pull request
Drop the Action into your workflow. Each PR gets an autonomous, exploit-verified security pass alongside your tests.
Breaks the build only on proven bugs
It fails the check on findings it actually reproduced, at the severity threshold you set — so you gate merges on real risk, not scanner noise.
API, CLI & webhooks
A public REST API, signed scan.completed webhooks, and the open-source CLI wire Xalgorix into whatever pipeline you already run.
# .github/workflows/security.yml
name: security
on: [pull_request]
jobs:
xalgorix:
runs-on: ubuntu-latest
steps:
- name: Xalgorix security scan
uses: xalgord/Xalgorix-SaaS/integrations/github-action@main
with:
api-key: ${{ secrets.XALGORIX_API_KEY }}
target: https://staging.example.com
fail-on: high # none | low | medium | high | criticalfree, open-source Action · scans use credits, same as the API
Xalgorix reviews every pull request.
Install the GitHub App once and every PR gets an automatic security review, posted as a comment on the diff. Need a re-run? Just comment @xalgorix review — it reacts 👀, reviews the changes, and replies with findings. No workflow file, no API key, no account required.
- ✓ Free, diff-scoped reviews — install and go
- ✓ Catches injection, auth/IDOR, SSRF, secrets, and unsafe patterns in the changed code
- ✓ Updates in place on new commits — never spams the PR
- ✓ Upgrade to full exploit-verified pentests and merge gating when you need them
api/users.ts — `req.query.id` is interpolated into the query. Use a parameterized statement.
free diff-scoped review by xalgorix · comment @xalgorix review to re-run
install once · reviews on every PR · free
features
Everything you need for autonomous security testing.
From live scan telemetry to branded PDF reports — Xalgorix handles the full engagement lifecycle, hosted on our infrastructure.
Hosted Web Dashboard
No installs, no Go toolchain, no LLM keys. Sign in and launch your first scan in 60 seconds.
Live Scan Telemetry
WebSocket event stream: tool calls, agent messages, HTTP activity, phase progress — all in real time.
22-Phase Methodology
Run the full sweep or focus on recon, injection, auth, API, upload, cloud, or WebSocket phases.
Validated, Not Just Detected
A dedicated validation phase confirms each finding before it reaches your report — depth over noise.
Branded PDF Reports
Executive summary, severity breakdown, PoC, remediation steps — with your company logo.
Scan Modes
Single target or wildcard / multi-target. Credit-based, no surprise bills.
Schedules & Automation
Recurring scans on cron-style schedules. Continuous coverage of your attack surface.
Team & Sharing
Share findings and reports with stakeholders via signed links. No login needed for read-only views.
REST API
Programmatic scan creation, status, and report retrieval. Wire Xalgorix into your CI/CD.
Rate Limits & Safety
Configurable request rates, circuit breakers, and blocked destructive commands protect your infra.
Scan Persistence
Resume interrupted scans. Multi-target queues process sequentially with full state recovery.
Multi-LLM Backend
We run on top frontier models — GPT-5, Claude, Gemini. You don't manage providers or keys.
Your data stays yours.
Security testing means trusting us with sensitive targets and findings. We treat that data as private by design — isolated per customer, encrypted in transit, and never sold or used to train models.
Isolated by default
Every scan, finding, and report is scoped to your account with database row-level security. No other customer — or team — can read your data.
Encrypted in transit
All traffic runs over TLS. Reports are shared only through signed, expiring links that you create and can revoke at any time.
You stay in control
Export or delete your scans and reports whenever you want. We never sell your data, and we never train models on your targets or findings.
Authorized & logged
Scans run only against targets you confirm you're allowed to test, and every scan is tied to your account for a clear audit trail.
methodology
22 phases. Every engagement.
Pick the full sweep or focus on a single phase. Output from each phase feeds the next — recon flows into exploitation, exploitation into a validated, documented finding.
workflow
From signup to report in 7 steps.
Zero to scanning in under 60 seconds. We handle the infrastructure, methodology execution, and report generation.
Sign up
Create an account in seconds — credits from $1, never expire.
Add target
Paste a URL, hostname, or wildcard. We validate scope on submit.
Pick mode
Single or wildcard. Choose all 22 phases or a focused subset.
Launch
Scan kicks off instantly on our infrastructure. No queue, no waiting.
Monitor live
Watch tool calls, agent messages, and phase progress stream in real time.
Review findings
Verified findings with severity, evidence, CVSS, and remediation guidance.
Share report
Download a branded PDF or share a signed link with your team.
scan modes
Two ways to engage.
Single target
One URL or host. Fastest path to actionable findings.
Best for: known URLs, quick assessments
Wildcard / multi
Enumerate attack surface, then scan everything discovered.
Best for: bug bounty, surface discovery
More tools from Xalgorix.
A growing family of offensive-security products. Built by the same team, sharing the same methodology.
BountyLabs
liveHands-on labs and CTF-style environments to sharpen your bug-bounty edge.
HuntFlow
coming soonWorkflow automation for bug-bounty hunters — recon, triage, and reporting in one pipeline.
BugReportly
coming soonBeautiful, structured bug reports that program managers actually want to read.
live observability
Watch every scan in real time.
WebSocket-powered event stream surfaces tool invocations, agent reasoning, findings, HTTP activity, LLM token usage, and phase transitions — the second they happen.
- 147
- Tool Calls
- 12
- Findings
- 48.2k
- LLM Tokens
- 2,341
- HTTP Requests
findings & reports
From scan output to report-ready findings.
Centralized findings with severity filters, CVSS details, evidence, and branded PDF report generation.
SQL Injection in Search Parameter
https://target.com/api/search
Unauthenticated SQL injection via the 'q' parameter allows arbitrary database queries.
IDOR on User Profile Endpoint
https://target.com/api/users/{id}
Authenticated users can access any user profile by modifying the ID parameter.
Missing Rate Limiting on Login
https://target.com/login
No rate limiting on authentication endpoint allows brute-force attempts.
pricing
Simple. Credit-based.
$Xalgorix token
Every scan runs on the token.
$Xalgorix is the platform's utility token on Solana. Pay for credits and subscriptions with it at a 15% discount, hold it to unlock tiers (up to 30% off, more concurrent scans, priority queue, premium reports), and a portion of SaaS revenue buys $Xalgorix on the open market and burns it — permanently reducing supply. Real usage, not promises. Every burn is verifiable on-chain.
15–30% off credits
1 credit = $0.40 at our best fiat rate or $0.34 in $Xalgorix at base rate, priced from a live DEX rate at payment time. Higher holder tiers pay less. Optional — never required to scan.
Hold for tiers
Holding $Xalgorix unlocks Bronze, Silver, and Gold: bigger discounts, more concurrent scans, priority queue, and premium reports. Read live from your wallet — no lock-up.
Revenue buys & burns
A share of SaaS revenue buys $Xalgorix on-market and burns it. More usage → more burns → less supply, all recorded on-chain. Not a dividend or payout, and the token can still lose value.
5hEn1uvHEfwyAjJgMZg4n6b8FkFsfxZnWgeySKZZpump$Xalgorix is a utility coupon, not an investment or security. Crypto is volatile and can lose all value. Verify the contract against our official links before sending anything — nothing here is financial advice.
why xalgorix
How we compare.
The depth of a real pentest, the speed and price of a scanner — without the false positives of legacy DAST or the wait of an agency.
Comparison reflects typical offerings in each category; exact capabilities vary by vendor and tool.
hosted vs self-hosted
Two ways to run Xalgorix.
The engine is open source. This site is the hosted version — same methodology, zero setup. Or grab the CLI and run it on your own infrastructure.
Prefer self-hosted? Get the open-source CLI on GitHub →
faq
Common questions.
Do I need to install anything?+
How long does a scan take?+
Are findings actually exploit-verified?+
Can I use this for bug bounty?+
What about authorization?+
Where is my data stored, and who processes it?+
Which LLMs power the agents?+
How does pricing work?+
Is there an API?+
Do you review GitHub pull requests?+
What is the $Xalgorix token — do I need it to run scans?+
who's behind it
Built by a working bug-bounty hunter.
Not a faceless startup — Xalgorix is built by a hands-on security practitioner who ships the tool he uses himself.
Krishna Kumar
@xalgordKrishna Kumar is a web-application penetration tester and bug-bounty hunter with over 5 years in offensive security, and an active member of the open-source security community. He authored a widely-used web app pentesting & bug-bounty methodology guide that's been starred over 1,800 times on GitHub.
Xalgorix grew directly out of his own bug-bounty workflow — automating the repetitive parts of an engagement (recon, injection sweeps, evidence collection) so the hard, high-value bugs get the attention. It runs that same methodology he works by hand: OWASP Top Ten coverage, Burp-style probing, and Python/Bash tooling, only autonomously and reproducibly.