Every pull request pentested before it ships
Neo reads the diff with the whole repository as context, runs the exploit in a preview build, and posts the proof as a review comment. Push the fix and the same exploit runs again.
Every diff is read against your threat model. Trust boundaries, data flows and abuse cases from the repository, so Neo knows which of six changed files is worth attacking.
acme/apithreat-modelv14
Internetuntrusted
Public edgecloudflare
Private VPCacme-prod
Dataencrypted at rest
Customer
Partner API client
checkout.acme.com
api.acme.com
auth-service
orders-service
invoice-service
sessions (redis)
orders (postgres)
invoices (s3)
billing-worker
ledger (postgres)
T-03Cross-tenant invoice read
On this diff
Files changed6
- api/invoices/export.tsinvoice-serviceT-03
- api/invoices/schema.tsinvoice-service
- api/lib/session.tsauth-service
- web/routes/invoices.tsxapi.acme.com
- test/invoices.test.ts—
- docs/api.md—
Findings land as review comments. On the lines that introduced them, with the request that proved the exploit.
Add invoice export endpoint #4821
Openacme/apipriya-n wants to merge 3 commits into main from feat/invoice-export
Conversation4Commits3Checks4Files changed6