Sample report

Example data — this is what your report looks like, including AI-suggested fixes. Connect a repo to scan your own code.

acme-inc/checkout-service

github.com/acme-inc/checkout-service
0
Security Score
CFair
7 findings across this scan

By severity

7
Findings
Critical2
High2
Medium2
Low1

Hotspots

Top files
app/api/orders.py1
app/config/payments.ts1
src/routes/invoices.js1
src/components/SearchResults.tsx1
src/lib/auth.js1

Compliance impact

Standards triggered
OWASP Top 106
Injection
PCI DSS v4.01
Secure development
SOC 21
Access control
NIST 800-63B1
Cryptography
NameScoreDetails
SQL injection via string-interpolated query
CWE-89 · 5/30/2026
9.5Visit
Category:Injection
Type:SAST
Rule:python.sqlalchemy.sql-injection

User-controlled `customer_id` is concatenated directly into a raw SQL string. An attacker can read or modify arbitrary rows by injecting SQL through the request parameter.

app/api/orders.py:64
AI-suggested fixpython
Open as PR

Use a parameterized query so user input is bound, never interpolated.

  def get_orders(customer_id: str):-     query = f"SELECT * FROM orders WHERE customer_id = '{customer_id}'"-     return db.execute(query).fetchall()+     query = "SELECT * FROM orders WHERE customer_id = :cid"+     return db.execute(query, {"cid": customer_id}).fetchall()

Compliance Impact

OWASP Top 10A03

A03:2021 – Injection

PCI DSS v4.06.2.4

Requirement 6.2.4 – protect against injection attacks

Hardcoded API secret committed to source
CWE-798 · 6/2/2026
9.5Visit
Broken access control — missing ownership check
CWE-639 · 5/21/2026
7.8Visit
Reflected XSS in search results page
CWE-79 · 5/18/2026
7.8Visit
Weak hashing algorithm (MD5) for passwords
CWE-327 · 4/29/2026
5.5Visit
Vulnerable dependency: lodash < 4.17.21 (prototype pollution)
CVE-2021-23337 · 3/11/2026
5.5Visit
Missing secure & httpOnly flags on session cookie
CWE-614 · 2/8/2026
3.2Visit
Plexicus mascot

Now scan your own code — free

This is example data. Connect your GitHub repo to get a real report like this — with AI-suggested fixes — in about 60 seconds.
Qualification

Check whether AI Swarm Pentest fits your environment.

Share the minimum context. We will review the scope and tell you the next commercial step.

Before submitting — verify you fit
Do you have a recent classic pentest you're not happy with?

0 / 280

No commitment. If you don't fit, we'll tell you.
SAMPLE HANDOVER · ILLUSTRATIVE

Sample evidence handover

A trimmed view of what your team receives at the end of an AI Swarm Pentest engagement. Real engagements include full technical evidence, executive narrative, and a remediation plan.

VALIDATED FINDING Evidence attached

Server-Side Request Forgery in webhooks/receiver

demo-project/sample-app · src/webhooks/receiver.py:42

SeverityHigh CVSS 3.18.6 Priority79 Confirmedvia replay

Untrusted caller-supplied URLs reach an internal egress without an allowlist. Replayed in a sandbox against a fresh authorised target — the same control was validated to fail twice.

REVIEWER-READY REMEDIATION Merge-ready PR

Validate the target URL against an allowlist of permitted hostnames. Reject private/internal IP ranges. Enforce HTTPS only.

plexicus/remediation/webhooks-ssrf 3 changed · 0 new files
42resp = requests.get(target_url)
42+if not is_allowed_host(target_url):
43+  raise WebhookRejected(target_url)
44+resp = requests.get(target_url, timeout=5)
Every engagement hands over:
  • Executive briefing
  • Validated findings list
  • Merge-ready PRs
  • Compliance mapping (NIS2 · DORA · CRA)