WhiteboxCode ReviewBillingIntegrationsDashboard
Scope your pentest to exactly the folders that matter
Folder-based scan scope: The Whitebox pentest wizard now includes a Scope step where you pick which folders to include or exclude using a checkbox file tree. All files are selected by default, so you only need to touch the tree when you want to narrow or skip specific paths.Closed status from the finding menu: You can now mark a single finding as Closed directly from its status menu, the keyboard shortcut, and the command palette - the same place you set False Positive. No more bulk-only workaround.Attestation letters: Your organization now has an Attestation Letters page where Hacktron-issued letters appear with a unique shareable link and a PDF download. Share the link with a customer or auditor and they can view or download the letter without logging in.PR reviews up to 500 changed files: Code Review now accepts pull requests with up to 500 changed files, up from 200. Large refactors and wide migrations no longer hit the limit.Org-level system comment control: Organization admins can now turn off automated code review comments for the whole org from Settings. OSS organizations also get 50 free PR reviews per month, up from the previous limit.People page with separate Members and Invitations tabs: The People page now splits into a Members tab and an Invitations tab so you no longer have to scroll past your full member list to reach pending invitations. The Invitations tab includes an empty state and revoked invitations stay listed with a Delete option instead of disappearing.Bot seat disclosure on auto-assignment: Tooltips and prompts at every auto-assignment opt-in point now say that bot PR authors take billable seats. The excluded-authors filter note clarifies that excluded authors never consume a seat.Enable all repositories in one step: The trial activation modal now has an enable-all button so you can turn on PR reviews for every connected repository without visiting the Repositories page.GitLab connection with incomplete setup: Connecting a GitLab installation no longer requires completing every step before saving. You can save a partial setup, and the connection page detects your current access level and shows only the actions available to you.Clearer Whitebox review step: The final review step before launching a scan is rebuilt as a structured summary panel with Source, Target, Access, and Context sections. Each section shows an Edit button that jumps back to that step, and the verification status for every account is visible at a glance.Start a Whitebox scan → · See billing and plans → · Connect GitLab → · Manage people →WhiteboxCode ReviewSelf-Hosting
Findings get an identity, a history, and a command palette
Human-readable finding IDs: Every finding now has a short, stable ID that appears at the top of the row, in the panel, on the full page, and in the URL. Click the ID to copy it.Finding activity timeline: The finding detail panel gains an Activity tab that shows the full history of a finding: when the engine detected it, which scans sighted it (collapsed into “Detected again in N scans” when consecutive), and every status or severity edit by a team member, with the actor and changed fields on each entry. Switch to the Comments view to see only the thread.Finding actions in the command palette: With a finding open, the command palette leads with a group of actions for it - change status, change severity, mark or unmark as duplicate, create a ticket, start remediation, copy its ID, copy its link, and open it on the full page.New finding filters and multi-ID search: The findings list gains Source, Reopened, and Date range filters, each saved in the URL. Paste two or more finding IDs into the search box to filter to exactly those findings.CWE name on hover: The CWE badge on a finding now shows the full weakness name in a tooltip so you know what you are looking at without leaving the page.Whitebox retest wizard: Request a retest for a completed scan directly from the scans list or the scan detail page. The retest covers every reported finding except false positives and accepted risk, and the scan detail shows the retest status and results once it is complete.Clearer whitebox report coverage: The Methodology section of a whitebox scan report now shows how many functions each area selected, instead of an arbitrary list of five names. Coverage Detail caps the unselected entry-points table at 50 rows rather than listing every one.Inline browser-auth instructions in the scan wizard: The browser-auth audit instructions in the whitebox scan wizard’s target step now appear directly on the page with live verification status, instead of opening in a separate modal.PR Review setup vs. active: The Repositories page now shows a notice when PR Review is toggled on for a repo but no active trial or subscription is backing it, with a direct link to start a trial for owners.On-prem GitHub.com reachability check: An on-prem appliance that cannot reach GitHub.com now disables the GitHub.com integration card with a clear reason (DNS, blocked, or TLS) instead of letting you start the setup flow and failing at the code exchange.See findings → · Start a Whitebox scan → · Set up GitHub →WhiteboxIntegrationsDashboard
See what a Whitebox scan actually established
Reports describe the assessment: Whitebox PDF reports now include the repositories and targets in scope, the testing window, a severity rubric, limitations, and a confidentiality notice. Where scan coverage is available, the methodology and coverage detail show which code the analysis passes selected for review.Live validation evidence: Findings with recorded live-validation evidence now have a Live Validation section in the PDF report showing what the attempt established, what it did not establish, and any blocker. Successful exploit attempts can also include the observed output.Jira and Linear status sync: Sync finding status changes to linked Jira and Linear issues, and bring supported issue status changes back into Hacktron. Organization admins can enable or disable each direction separately in the integration settings. Jira updates follow the transitions available in your project’s workflow.Integration settings in one place: The Integrations page groups providers into a list with connection details, repository counts where applicable, and a Connect or Manage action. Connected providers show a status badge; connections needing attention show the action to resolve it. Open a provider to manage its settings or disconnect it.Docs from the top navigation: The help menu links directly to each product’s documentation, the API reference, the MCP server, and the changelog.Start a Whitebox scan → · Connect Jira → · Connect Linear → · Manage integrations →Code ReviewIntegrationsDashboardSelf-Hosting
Choose GitHub repositories without leaving Hacktron
GitHub repository selection: Organization admins can select which repositories to enable from the GitHub integration in Hacktron, within the access granted to the GitHub App. Repositories added back to the App installation are selected again automatically.Separate repository access from PR reviews: Keep a repository available to Hacktron while switching its automatic PR reviews on or off. The Repositories table now shows Repository and Owner separately, alongside Open Findings, PR Scans, and Last Scan. Its platform filter lists only providers your organization has connected.Replies to explicit review requests: When you post@hacktronai review for a commit with an existing review, Hacktron replies with the completed result or tells you that the review is still in progress.GitHub.com reviews on appliances: Self-hosted Hacktron deployments can connect a customer-owned GitHub App and review GitHub.com pull requests on their own infrastructure.Set up GitHub → · Manage repositories → · Configure Code Review → · Configure self-hosting →WhiteboxCode Review
Check your fixes without repeating the full assessment
Request a finding retest: On a completed hosted Whitebox scan, choose Retest findings, select the findings to check, and provide instructions about your fixes. The Hacktron pentest team reviews the request and records each finding’s outcome and notes. Completed retests are available in the scan’s retest history and PDF report.Preview login for dynamic validation: Where dynamic validation is enabled, add login instructions and test credentials in the Whitebox scan wizard, then preview the browser session before starting. Hacktron uses those instructions to authenticate against your deployed targets when validating findings.Find developers across the People list: Search by name, email, or SCM username, filter by role or Code Review seat, and sort and page through the results. Search and filters cover the full member list rather than only the rows already loaded.Prepare scan scope and access → · Manage Code Review seats →Code ReviewWhiteboxIntegrationsDashboardSelf-Hosting
A rebuilt findings view, and fix PRs that close themselves
New findings table and drawer: The findings list and its detail drawer have a new layout. Severity, status, and the main actions - Remediate, Copy markdown, Mark as duplicate - now sit in one header tray, and previous/next arrows move you through findings without going back to the list. A collapse control opens the drawer as a full page.OWASP Top 10:2025 category on findings: You can set or change a finding’s OWASP Top 10:2025 category from the overflow menu. The category appears in the findings table and drawer, and you can filter the list by it.CWE ID and fix recommendation on findings: Findings now carry a CWE identifier and a plain-language fix recommendation, where the scan engine supplies them. Both appear in the finding detail.Download a scan’s context documents: A download button in the triage header pulls the context the scan worked from - the threat model, architecture notes, and any files you uploaded - without leaving the findings view.Scan failure reason: When a scan fails, the scan detail page now shows the reason the engine reported, instead of leaving you to guess.Severity in global search: Findings in global search results show their severity badge, so you can pick out the Critical and High matches without opening each one.Fix PRs close when the fix lands elsewhere: If Hacktron detects that a finding was fixed by a commit on your base branch, it closes any open fix PR for that finding and leaves a comment saying why, so you do not have to clear out stale fix PRs by hand.Fix PRs retry instead of failing on a stale diff: If a file changes on the base branch while an AI fix is being generated, the fix no longer applies cleanly. Rather than surfacing a patch error, the automation re-runs against the updated file, up to three retries per chain.Remediation on Azure DevOps: Automations open and track fix pull requests on Azure DevOps repositories, alongside GitHub and GitLab.Triage status syncs to Linear: Triage a finding anywhere - the web app, Slack, a PR comment, or the API - and the linked Linear issue moves to the matching workflow state. Dispatching an AI fix moves it to In Progress. Findings already mirrored status to GitHub, GitLab, and Slack.Bot pull requests reviewed on GitHub: Eligible bot pull requests - Dependabot, Renovate, and similar - were being skipped on GitHub. They are now reviewed, matching GitLab and Bitbucket. Trust rules and author filters are unchanged, so you can still exclude a bot withexclude.authors.Pin a GitLab scan to a tag or commit: When you start a Whitebox Scan on a GitLab repository, you can target a specific tag or commit SHA rather than the tip of a branch.Application filter on the PR Review dashboard: The Application filter now scopes every widget on the PR Review tab, including the security score card and the low-score banner, which previously stayed org-wide.One page for personal settings: The separate Account and Settings pages are now a single Personal settings page, organized into Profile, Security, Connected accounts, Preferences, Sessions, and Organizations.API keys for every member: Any organization member can create, rotate, and revoke their own API keys from personal settings, without an owner or admin doing it for them.Fuller pentest PDF reports: Pentest PDF exports carry more detail on each finding, number findings in display order, and highlight code blocks in the right language.License details and expiry warnings on appliances: Organization settings on an appliance show the installed license - who it is licensed to, expiry date, days remaining, seat count, and covered products. A banner appears 30 days before expiry. Once the grace deadline passes, new scans are blocked, while findings, reports, and exports stay readable.Self-managed GitLab on appliances: Appliances can connect a self-managed GitLab instance and scan merge requests. The Reviews link, PR Review dashboard tabs, and source control settings appear once the integration is configured.GitHub Enterprise Server via GitHub App: Appliance operators can connect GitHub Enterprise Server through a GitHub App installation rather than a personal access token, which avoids long-lived tokens.Appliance onboarding: First-time users on an appliance get a setup flow of their own - Welcome, Connect your code, You’re all set - pre-filled for the configured Git host, in place of the hosted trial flow.Explore findings → · Set up remediation automations → · Connect Azure DevOps → · Connect Linear → · Configure on-premises deployments →BillingIntegrationsWhiteboxSelf-Hosting
Separate credit accounts and more on-premises scan options
Automation and Whitebox credits: Billing now shows separate accounts for Automation credits and Whitebox Scan Credits. Each account has its own balance, current-period usage, purchase flow, and history. Auto top-up is available for Automation credits only.Microsoft account connection: Members can connect the Microsoft account they use for Azure DevOps from Personal settings. When its email matches the pull request author’s Azure DevOps UPN, Hacktron can attribute later pull request activity to the correct member and Code Review seat.More Whitebox sources on-premises: On-premises deployments can select enabled GitHub Enterprise Server repositories or upload.zip, .7z, .tar.gz, and .tgz source archives when starting a Whitebox Scan.Internal Git and air-gapped support: Appliance operators can allow specific private Git hosts, add trusted CA certificates, and collect masked support bundles without an outbound internet connection.Glob patterns for author filters: Repository and organization author filters accept *, **, ?, and {a,b} patterns as well as exact names. Pattern length, wildcard count, and brace alternatives have bounded limits.Clearer Automation feedback: Deleting an automation shows a confirmation with its name. Trying to enable an incomplete automation identifies the missing configuration.See billing and plans → · Connect your Microsoft account → · Configure on-premises deployments → · Configure scan filters →IntegrationsCode ReviewDashboardWhiteboxBilling
Azure DevOps is here, plus bulk triage and live AI runs
Azure DevOps PR scanning: Connect your Azure DevOps organization with a personal access token and Hacktron will review pull requests automatically, assign developer seats, and report findings - matching the GitHub and GitLab experience end to end.Bulk findings triage: Select any number of findings with checkboxes, then change their status or severity in one action. When a full page is selected, you can extend the action to every finding that matches your current filters across all pages.Per-run credit caps: Set a credit limit on each automation environment and a run that hits the cap stops cleanly instead of running unbounded. Once you raise the limit, you can restart the stopped run from where it left off.Live automation run transcript: Watch the AI agent’s reasoning, tool calls, and output appear in real time on the run detail page as a run executes, rather than seeing the result only after it finishes.Manual remediation runs in history: Every run started from the “Remediate” button on a finding now appears in the main runs list alongside scheduled automation runs, so you have one place to review all activity.Triage thread auto-resolution: Posting a triage command (!fp, !valid, !accepted_risk, !fixed) as a reply to a finding comment on a GitHub PR or GitLab MR now resolves that review thread automatically.Fix PRs loop in the original author: When an automation opens a fix PR into a developer’s feature branch rather than the default branch, it adds that branch’s author as a reviewer so the right person sees the fix.Finding category filter: Findings now show their OWASP category as a badge and you can filter the findings list by category to focus on a class of issues.Usage page by product: The usage page is reorganized into three tabs - PR Reviews, Automations, and Whitebox - each with its own credit and usage breakdown.Bot-authored PRs now reviewed: On GitHub, Hacktron reviews eligible bot PRs when the source branch belongs to the same repository. Bot PRs from forks and PRs from outside human contributors are not scanned automatically. Use author filters to exclude specific bot accounts.Glob patterns in author filters: Author include and exclude filters in.hacktron/config.yaml and organization scan settings accept *, **, ?, and {a,b} patterns as well as exact names.Cleaner Whitebox scan setup: Pasting a browser URL (including /tree/branch or /commit/sha suffixes) into the repository field during cost estimation now strips the suffix automatically. Private repos that cannot be accessed show an error immediately instead of proceeding silently.5,000 automation credits on first subscription: Organizations receive a one-time grant of 5,000 automation credits when they subscribe for the first time, applied at the point of payment.Connect Azure DevOps → · See automations → · Start a Whitebox scan → · Manage seats and usage →WhiteboxCode ReviewIntegrationsAPI
Walk a taint trace, export your findings, and scan Bitbucket PRs
Interactive taint trace reader: Taint findings now open an annotated code view where you can step through each source, propagation, and sink in sequence. Click any step in the sidebar to jump directly to that line in the file.Findings export: Download your findings as CSV, JSON, or SARIF directly from the findings page, filtered to exactly what is currently visible. The export respects all active filters - severity, status, scan, and repository.Findings export API: A new API endpoint (GET /rest/findings/export) lets you pull findings programmatically in CSV, JSON, or SARIF, with the same filter options available in the UI including scoping by repository.Bitbucket PR scanning: Connect a Bitbucket workspace and Hacktron will automatically scan pull requests, the same way it does for GitHub and GitLab.Model tier selection for scans: When starting a whitebox scan, you can now choose between the Default and Legacy model tiers before committing to a cost estimate.PR filter rules for authors and labels: Your .hacktron/config.yaml now supports skip.authors and include.authors to exclude or restrict scans by PR author, and include.labels to trigger scans only on labeled pull requests.GitHub file-level comments for line-agnostic findings: Findings with no specific line number now post as file-level comments on the GitHub pull request instead of being silently dropped.Mark Resolved from Slack: The finding Work Object overflow menu in Slack now includes a Mark Resolved action alongside the existing triage options.Read the API reference → · Set up GitLab → · Connect Slack →ContextCode ReviewWhiteboxIntegrationsMCP
A new Context page for your repositories, applications, and threat models
Context page: A dedicated Context page now gathers what Hacktron knows about your code, split across Repositories and Applications tabs. Cards are sorted by most recent threat-model update and show a badge for each model’s status; clicking one opens its threat model.Applications: Group related repositories into an application, and Hacktron synthesizes an application-level threat model by merging the threat models of its member repos. You can scan an application as a single target so findings are grounded in the combined model, and any context documents you upload to the application are folded into it.Threat models: Repository and application threat models now open in an inline reading view with a file tree and outline, and you can edit them with your changes preserved across regenerations.Redacted findings on public PRs: For public repositories, the PR review comment no longer includes full titles, descriptions, proof-of-concept code, or file locations for findings outside the changed lines. You see a count and a link back to Hacktron, so sensitive details stay out of the public thread. Private and internal repos are unchanged, and inline comments on the diff itself are unaffected.Org-level fail-on severity default: Organization admins can now set a default severity threshold for PR/MR checks in settings. Individual repo configs still take precedence when set.Enterprise SSO sign-in: A dedicated single sign-on page and a “Single sign-on (SSO)” button on the login screen let users authenticate via your organization’s SAML or OIDC identity provider. Invite tokens survive the IdP round-trip, so onboarding links still work.Duplicate marking in the MCP tool: Theupdate_finding MCP tool now accepts a duplicate_of field so you can mark or unmark duplicates programmatically.Explore the Context page → · Group repositories into an application → · Learn how threat models work → · Set a fail-on severity threshold → · Read the API reference →Code ReviewWhitebox
Dismiss a finding and your PR check clears instantly
PR and MR checks update on triage: When you mark a finding as a false positive or accepted risk, the GitHub check or GitLab commit status flips back to passing right away, with no manual re-run needed. If you later reopen the finding, the check fails again to match.Close findings as duplicates: You can now mark a finding as a duplicate of another finding in the same repository, and unmark it if needed. A duplicated finding inherits its canonical finding’s severity when the PR gate counts blocking issues.Scan volume chart: The dashboard’s scan volume widget now shows a stacked bar chart instead of a line graph, with a tooltip on each bar showing the Code Review and Whitebox scan counts for that day.Upload scans named after the archive: When you start a Whitebox scan from an uploaded archive, the scan now takes the archive’s filename as its name instead of a generic label.Set up GitHub or GitLab →Code ReviewBillingMCP
Control your scans and account security like never before
Multi-factor authentication controls: Secure your account with MFA requirements and additional verification steps. Admins can enforce MFA across their organization.API access through MCP protocol: Connect external tools and scripts to Hacktron’s finding-triage toolset through a new remote MCP server endpoint with OAuth and API key authentication.Exclude scans with repository configuration: Use.hacktron/config.yaml to exclude pull request scans based on file patterns, keywords in titles, or labels.Secure your account with MFA → · See MCP integration → · Configure repository scanning →IntegrationsCode Review
GitLab now works just like GitHub
Automatic merge-request scanning: Connect a GitLab project and merge-request scans turn on by themselves, exactly as they do for GitHub. Turn them off per project whenever you want.GitLab in signup and trials: Connect GitLab during signup or a trial and it follows the same guided setup as GitHub, start to finish.Set up GitLab →Code ReviewBillingIntegrations
Go from a Slack alert to a fix in one click
Fix with AI in Slack: Finding alerts in Slack now carry a “Fix with AI” button that deep-links the issue straight into Cursor or Claude. See the alert, open your editor, fix it.No-card free trials: Start a free trial without a credit card. You enter payment details only when you decide to subscribe.Findings close themselves on abandoned PRs: Close a pull or merge request without merging and its findings move to a new “Closed” state. Reopen the PR and they come back, and anything you already triaged stays put.Up-front unsupported-language notices: Cost estimation now tells you when a repository is mostly in a language Hacktron cannot scan yet, instead of failing with no explanation.Clearer GitLab connection setup: The Connect GitLab dialog walks you through GitLab’s group Service Accounts step by step and adds a GitLab.com / Self-hosted toggle that matches the GitHub Enterprise setup.Connect Slack → · Start a free trial →Self-HostingIntegrationsCode ReviewWhitebox
Scan self-hosted GitHub Enterprise Server
GitHub Enterprise Server: Point Hacktron at self-hosted GitHub Enterprise Server for white-box scans and PR reviews, and run several Enterprise hosts next to github.com at the same time.GitLab MR feedback matches GitHub: Merge-request comments now carry severity badges, collapsible proof-of-concept, trace diagrams, and a “Fix with AI” block. Trigger a review with@hacktronai review, and triage shows up the
same across the web app, Slack, and the MR thread.Scan an exact tag or commit: Target a specific tag or commit when you pick
a repository for a Whitebox scan, not just a branch.Richer Jira ticketing: Search large Jira projects and assignee lists while
filing a ticket, and issues you create from a finding link back to it.Set up GitHub Enterprise Server → · See how reviews work → · Set up Jira →Code Review
PR comments that fix the bug for you
Sharper GitHub PR comments: Pull-request comments now use crisp severity badges instead of emoji, with a “Fix with AI” prompt that reproduces the issue, fixes the root cause, and adds a regression test.See how PR reviews work →BillingCode ReviewIntegrations
Share Code Review limits across your whole org
Org-pooled limits, annual seats, and a Usage page: Code Review limits are now pooled across your whole organization instead of capped per seat, you can buy developer seats on an annual prepaid plan, and a new owner-only Usage page shows usage and any overage for the period.Redesigned sidebar navigation: Cleaner, collapsible sections that remember what you left open, with account actions moved into the sidebar header.On-demand PR reviews: Comment@hacktron review on a pull request to
review it on the spot, even on drafts or external-contributor PRs.Request GitHub access without being an admin: If you do not own the GitHub
organization, clicking Connect sends an installation request to your admin and
marks it pending. The integration appears the moment they approve.Smoother Jira setup: A cleaner Jira configuration and per-ticket dialog,
with sensible defaults already on for new installs.Slack Connect onboarding: Sign up with a work email and set up
notifications right away through a Slack Connect step.See billing and plans → · Set up Code Review →WhiteboxCode Review
Findings open straight into the taint trace
Redesigned vulnerability views: The taint-trace and call-graph views are rebuilt, opening right into the trace with smooth collapse animations, and the full-page finding view now has the same actions as the sidebar.“Whitebox” everywhere: Scans we used to call “Pentest” are now “Whitebox”, with “Whitebox Scans” and “PR Reviews” split apart so it is obvious which is a full code scan and which is a pull-request review.Finding history: Every finding now shows a timeline of how it changed from one scan to the next.Explore Whitebox scans →Code Review
No more repeated comments for the same bug
Cross-finding duplicate detection: Hacktron now spots when a new finding repeats one it already reported and links the two, so PR comments point back to the original instead of saying the same thing twice.DashboardCode ReviewIntegrations
A rebuilt dashboard, split by the work you do
New dashboard: Separate Overview, PR Review, and Whitebox Scan tabs, so each kind of work shows the metrics that actually matter for it.Taint-trace timeline and call graph: Vulnerabilities now show a step-by-step taint-trace timeline and an interactive call graph, with source, propagation, and sink marked, so you can follow exactly how an issue moves through your code.Richer Linear integration: Pick a default Linear project, back-fill tickets for existing findings, map finding severity to Linear priority, and mirror Linear status changes back onto the linked finding.Set up Linear →Billing
Keep reviewing past your limit instead of getting blocked
Owner-controlled overage billing: Organization owners can switch on overage billing so PR reviews keep running past your included limit, billed as overage instead of stopping cold.See usage and overage billing →Whitebox
Share a live view of any scan
Public scan activity page: Shared scans now have a public activity page with the scan’s events, timeline, and the agents that worked on it.BillingIntegrations
50 PR reviews a seat, then $1 each instead of a wall
PR review limits with overage: Every developer seat now includes 50 PR reviews per billing period, and any extra reviews bill at $1 each so they keep running instead of stopping.Resubscribe in one click: Canceled organizations now get a Resubscribe button to pick their old plan back up.Slack invite flow: Invite teammates to your Hacktron organization straight from Slack.See usage and overage billing → · Invite your team on Slack →Code Review
Stop a scan mid-run
Cancel a running scan: Stop a scan that is already in progress right from the scan view, no waiting for it to finish.Guided setup checklist: A getting-started checklist walks you through connecting your repositories and turning on Code Review, so new teams reach their first scan faster.Set up Code Review →Code Review
A home for your Code Review findings
Code Review page: A dedicated page with scan-scoped findings, and PR comments that link straight back to the finding in Hacktron.Syntax-highlighted code: Affected code in the finding view is now syntax-highlighted, so vulnerable snippets are far easier to read.Explore Code Review →APIIntegrationsBilling
Drive Hacktron from your own scripts
Public REST API: Reach your scans, findings, and repositories programmatically with API keys, backed by interactive API docs.Slack link unfurling: Finding and scan links now unfurl in Slack with live status, severity, and triage, so your team stays in sync without leaving the channel.Linear tickets from findings: Create a Linear issue straight from a finding, with the details filled in for you.Cancel and reactivate yourself: Cancel or reactivate your subscription right from the billing page, no support ticket needed.Redesigned billing page: A rebuilt billing experience with clearer plans, credits, and subscription status.Read the API reference → · Connect Slack → · Set up Linear → · Manage your subscription →WhiteboxCode Review
See how a vulnerability moves through your code
Visual trace diagrams: Vulnerabilities now include a visual diagram, in both the finding view and the PDF report, so you can trace how an issue moves through your code at a glance.More flexible pentests: Start a pentest from a public repository URL or an uploaded archive, with the source shown in the cost estimate before you commit.Context documents: Upload notes about a repository so reviews understand your codebase and its conventions.Markdown in findings: Finding descriptions, dismiss reasons, and comments now render full Markdown, with one-click copy of the report.Start a Whitebox scan →Code Review
Triage findings without leaving the browser
Triage from the web: Dismiss findings with a reason and leave feedback in an activity thread, right in the app.Read the triage guide →WhiteboxBilling
Watch findings arrive as a scan runs
Live scan progress: Scans now stream their progress in real time, so you watch findings show up as they are discovered instead of waiting for the end.Cost estimation before you scan: See an estimated cost before you start a scan or pentest.Downloadable reports: Generate a PDF report of your findings straight from the browser.BillingWhitebox
Pay for pentests with credits
Pentest credits: Buy pentest credits and spend them on pentests when you are ready.Public scan disclosure: Share a scan and its findings through public, read-only pages.See pentest credits →Billing