Strix - Autonomous Security for the AI Era

Continuous SecurityOn Every Deploy.

Secure your entire stack with autonomous pentesting.<br>Find and fix vulnerabilities 24/7.

Start testing

Used by security teams at

Try Strix Open Source34K

Your full-stack security platform<br>One platform to secure your code, APIs, web apps, infrastructure, and cloud.

PentestStatusIssuesDate<br>api.example.com<br>Completed

2h ago<br>staging.app.io<br>Running

Now<br>auth-service<br>Completed

1d ago<br>payments-api<br>Completed

3d ago<br>dashboard.app.io<br>Completed

5d ago

APIs & Web Apps<br>Full-coverage pentesting across REST, GraphQL, and web apps - with proof-of-exploit for every finding.

strix-securitybot<br>🔴 IDOR in invoice download endpoint<br>Severity: HIGH · CWE-639<br>The GET /api/invoices/:id/pdf handler fetches the invoice by id from the global scope without scoping it to req.org. Any authenticated user can download invoices belonging to other organizations.<br>Suggested change<br>47 const inv = await Invoice.findById(id);47 const inv = await Invoice.findOne({48 _id: id, org: req.org._id });Commit suggestion ▾

Code & Pull Requests<br>Analyze code and pull requests for security issues in your CI pipeline. Catch vulnerabilities at the source.

IssueSeverityCVSSTested<br>S3 bucket public access<br>Critical<br>9.81h ago<br>IAM wildcard policy<br>Critical<br>9.13h ago<br>SSH open to 0.0.0.0/0<br>High<br>8.11d ago<br>RDS unencrypted at rest<br>Medium<br>5.32d ago<br>CloudTrail logging disabled<br>Medium<br>4.73d ago

Infrastructure & Cloud<br>Find misconfigurations and exposures across cloud environments and infrastructure before attackers do.

Start testingGet a demo →

"Strix is a game-changer for our security toolbox. It's fast, easy to configure, and finds great stuff. Continuous external testing, year-round."

Jim Hebert<br>Head of Application Security, Chegg, Inc.

From issue to fix in seconds<br>Find critical issues, auto-validate, and auto-fix with merge-ready PRs.

←Issues/STR-00847<br>SSRF via URL Parameter in /api/proxy<br>OpenHigh · 8.6CWE-918<br>TL;DR<br>The /api/proxy endpoint accepts a user-supplied URL without validation. An attacker can access internal services, read cloud metadata, and exfiltrate credentials.

Impact<br>Access to cloud metadata at 169.254.169.254, potential credential theft, and internal network scanning.

Location<br>acme/api · proxy-handler.ts:23<br>GET/api/proxy?url=

Severity<br>High

CVSS<br>8.6<br>Fix Effort<br>Low<br>Discovered<br>2h ago

Discover & Validate<br>Pentests your entire attack surface continuously. Reproduces each finding, confirms exploitability with proof, and prioritizes by real impact.

FixReproduction<br>How do I fix it?<br>Validate and restrict the target URL using an allowlist of permitted hostnames. Reject private/internal IP ranges and enforce HTTPS-only.

proxy-handler.ts:23-29Copy<br>2323 const targetUrl = req.query.url;24 const resp = await fetch(targetUrl);24 const parsed = new URL(targetUrl);25 if (!ALLOWED_HOSTS.has(parsed.hostname)) {26 throw new ForbiddenError("blocked");27 }28 const resp = await fetch(parsed.href);2529 return res.json(await resp.json());<br>✓Fix verified — vulnerability no longer exploitable<br>→PR #247 fix/ssrf-proxy-handler ready to merge

Auto-Fix<br>Generates a fix, retests to confirm the vulnerability is gone, and delivers a merge-ready PR. Review, merge, done.

Deploy with confidence<br>Ensure nothing vulnerable reaches production. Every vulnerability discovered, validated, and resolved before it reaches production.

Every PR reviewed<br>Catches vulnerabilities at the source. Every pull request is reviewed before it can be merged.

Blocks vulnerable deploys<br>Plugs into your CI/CD pipeline. Vulnerable code never reaches production.

Monitors your attack surface<br>New CVEs tested against your systems. Latest threats flagged instantly.

Runtime validation<br>Each finding ships with a PoC and reproduction steps. Proven against your live environment.

Context-aware pentesting<br>Knows your stack, architecture, and business logic. Tests tailored to your environment.

Continuous learning<br>Learns from past findings and how you fixed them. Every pentest builds on the last.

Get startedGet a demo →

Ship fast without compromising security<br>Everything you need to track your security posture, validate findings, and ship fixes — without slowing your team down.

Real-time security posture

Validated findings with proof

Auto-fix with merge-ready PRs

Enterprise-grade security<br>Built for teams that need full control over deployment, data privacy, and compliance.

Self-Hosted Deployment<br>Deploy in your own VPC, on-premise, or air-gapped environment with complete control over your infrastructure.

Internal Infrastructure Pentesting<br>Go beyond external attack surfaces. Test internal networks, services, and infrastructure from inside your environment.

Zero Data Retention<br>Your source code is never stored or used for model training. All model providers operate under zero data retention agreements.

Dedicated Support & SLA<br>Dedicated support, custom SLAs, priority Slack channel, and hands-on onboarding. SOC 2 Type II and...