Connect repo & verify staging
Install the read-only rattle-fyi GitHub App (contents: read) and prove ownership of each non-production app, API, and auth host via DNS TXT or /.well-known plus a 5-second production canary.
WHITEBOX APPLICATION & API PENETRATION TESTING
Autonomous whitebox pentests.
Scheduled at batch-fleet economics.
Connect your read-only GitHub repository and verify your staging or acceptance hosts. Rattle dispatches hundreds of recursive frontier-model agent loops across your pinned source code and live APIs in consolidated GPU waves — delivering reproducible PoCs, file-and-line code citations, and coding-agent remediation prompts.
✓ Read-only GitHub commit snapshot
✓ DNS / HTTP target proof + 5s prod canary
✓ Metered Stripe compute · no annual contract
HOW IT WORKS
Book a full whitebox App + API pentest in three steps
Skip multi-week scoping calls. Enroll your repository and staging environment once, then schedule assessments on demand or automatically after acceptance deploys.
Schedule into a batch wave
Select your compute profile and spend ceiling. Assessments consolidate into 6-hour B300 GPU batch waves so hundreds of recursive agent loops execute at a fraction of on-demand pricing.
Ship verified fixes
Review findings backed by live HTTP witnesses and exact source citations at the pinned commit SHA. Export SARIF 2.1.0, Markdown, or JSON, or copy ready-to-run fix prompts into Claude Code or Codex.
WHAT WE TEST
Source-code cartography paired with live exploitation proofs
Static scanners drown teams in unverified alerts; black-box scanners miss internal routes and tenant models. Rattle combines both planes in every standard run.
Cross-tenant BOLA & IDOR
Maps route handlers, auth middleware, and ORM queries directly in source, then tests cross-workspace and cross-role object access against your live acceptance API.
Joined web app + API graph
Tests frontend origins, REST and GraphQL backends, OIDC/session handshakes, and gated previews (Cloudflare Access, Vercel Protection, Basic Auth) as one coherent system.
Workflows & state abuse
Probes multi-step business logic, invite/token exchanges, presigned upload concurrency bounds, webhook signature checks, and server-side request forgery sinks.
Production safety interlocks
Refuses unverified hosts, halts before dispatch if the 5-second passive canary detects live production or payment markers, and honors instant DNS or UI revocation.
TRANSPARENT PRICING
Pay per scheduled assessment. Metered to actual compute.
Fund compute credits via Stripe Checkout with no recurring seat fees or annual minimums. Every tier sets a hard ceiling; you only pay for the GPU compute consumed.
BASELINE
Up to $25/ assessment
Fast whitebox delta & single-service checks
- 8 parallel recursive agent sessions
- 1-hour active assessment budget
- Pinned GitHub commit + verified hosts
- Markdown, SARIF 2.1.0 & JSON exports
STANDARD APP + API
RECOMMENDEDUp to $100/ assessment
Full multi-origin web app, API & tenant authz review
- 24 parallel recursive agent sessions
- 2-hour active assessment budget
- Hundreds of frontier-model exploitation loops
- Verified HTTP PoCs + line-exact code citations
- One-click Claude Code & Codex fix prompts
DEEP RECURSIVE
Up to $250/ assessment
Large monorepos, multi-role SaaS & complex APIs
- 48 parallel recursive agent sessions
- 4-hour active assessment budget
- Extended multi-tenant & workflow exploration
- Automated post-deploy
/v1wave coalescing
CI / CD INTEGRATION · /v1 REST API
Stage assessments automatically after every acceptance deploy
Trigger wave enrollments from GitHub Actions or any deployment hook using a scoped rtl_… token. Multiple deploys before the next 6-hour cutoff coalesce cleanly into a single project slot without slowing down PR merges.
curl --fail-with-body -X POST 'https://rattle.fyi/v1/projects/<project_id>/enrollments' \
-H "Authorization: Bearer $RATTLE_API_TOKEN" \
-H 'Content-Type: application/json' \
--data '{"profile":"standard","submit_now":false}'
INTERACTIVE SAMPLE DELIVERABLE
Inspect a sample whitebox App + API penetration test report
Explore how Rattle pairs source-code root causes at a pinned commit SHA with live HTTP witnesses, severity filters, SARIF 2.1.0 downloads, and coding-agent remediation prompts.
WELCOME · YOUR WORKSPACE IS READY
Create your first project to start testing
A project is the scope of one campaign. Bundle the source repositories behind your product (frontend, backend and infra alike) through the read-only GitHub App or a git archive upload, then verify the staging or acceptance hosts you want tested. Or hand the whole setup to your coding agent. Your compute credit is ready. Nothing is spent until you book an assessment.
STAGED FOR WAVE
WHITEBOX APPLICATION + API / REPORT
Penetration test report
Pinned commit scope, reproducible witnesses, and actionable remediation.
Verified findings 0
EXAMPLE REPORTSTEP 1 · REPOSITORIES & NON-PRODUCTION TARGETS
Project scope & target verification
Full Whitebox App + API is recommended: attach every source repository in your stack and verify each staging or acceptance app, API, and auth host.
AGENT-ASSISTED SETUP
Enroll with your coding agent
Copy one prompt, built from this project and anything you have entered on this page, into the coding agent you already use. It uploads each repository in your stack with git archive, enrolls your hosts, publishes the DNS TXT record or well-known file, runs the 5-second production canary and stages the next wave.
Preview the instructions
Source repositories
One or more repositories · read-only snapshots
Bundle every repository in your stack, for example org/frontend, org/backend and org/infra, into this project. Attach each one through the GitHub App or a git archive upload, and mix both freely. Every repository pins an immutable commit; Rattle never gets write access.
Connected repositories
Uploading a repository that is already attached refreshes its snapshot; any other name joins the bundle. Every attached repository is pinned into the same campaign when the wave releases.
Non-production hosts
Staging, acceptance, or preview URLs
Enroll your web app plus companion API and auth hosts under the same production apex. Each host requires ownership proof and a 5-second production canary.
Add an authorized target host
Enrolled target hosts
Select any enrolled host to inspect its DNS / HTTP challenge and 5-second production canary receipt.
OWNERSHIP & SAFETY CHECK
Verify host ownership and run the 5-second production canary
Publish the challenge below, then run verification. Live testing is authorized only when both ownership and the production canary pass.
Publish the record at your DNS provider
Add the record with Domain ConnectNo DNS access? A coding agent that can deploy to this host can serve /.well-known/rattle-verification.txt instead.
Instant revocation. Click Revoke or delete the ownership TXT record / well-known file at any time. Ownership is re-verified immediately prior to wave execution.
STEP 2 · SCHEDULE & DISPATCH
Book a batch-wave penetration test
Actual spend is metered. The ceiling is bounded to your available weights.fyi credit at dispatch.
NEXT CONSOLIDATED B300 WAVE CUTOFF · UTC
Sign in to view the wave schedule.
One slot per project. New commits coalesce automatically until wave release.
Enrolled wave slot scope
Batch wave booking reserves a slot without starting immediate compute; cancel freely before cutoff. Direct dispatch submits straight into the reserve queue and executes as fleet capacity opens.
COMPUTE WALLET & STRIPE CHECKOUT
Compute credits & billing
Your weights.fyi balance funds scheduled assessments on reserve GPU capacity. Eligible accounts receive $25.00 in starter credit.
ADD COMPUTE CREDIT · STRIPE CHECKOUT
Sign in to manage compute credit.
PROGRAMMATIC ACCESS · /v1 API
CI / CD API tokens
Create scoped rtl_… tokens so deployment pipelines can stage newly shipped acceptance commits into the next consolidated batch wave.
Granted scopes: read + enroll
Copy this token now — it is displayed only once.
POST-DEPLOY WAVE ENROLLMENT