Book a demoGet started

From a URL to a fix your team can trust.

Wakefield agents sign in to your app as every role, look for places where one user can reach another's data, and prove each bug before it reaches you. Your teams get the evidence, the fix, and a way to check it worked.

Get startedBook a demo
01

Test the app as every user

Add a host and a test login for each role. Blackbox agents map the pages and APIs each role can reach, learn who should see what, and try to cross user, role and tenant lines. Connect a repository and Whitebox agents review the code on every pull request.

  • Blackbox and Whitebox scans in one list
  • Runs on a schedule, on each pull request, or when you start one

Scans

Blackbox scans test running apps. Whitebox scans read your code.

Schedule a scanNew scan
AllBlackboxWhitebox
  Search by target…Status
ScanStatusTriggerResultAgentsWhen
acme-billing.appRunningSchedule42%612 min ago
acme-corp/billing · PR #482RunningPull request70%23 min ago
api.acme-billing.appCompletedSchedule81 hour ago
acme-corp/web · PR #479CompletedPull request23 hours ago
staging.acme-billing.appCompletedManual5yesterday
acme-corp/helpdeskCompletedSchedule3yesterday
02

Validate every finding without a security expert

A separate agent replays each finding in a real browser and records it before you see it. Every finding comes with the steps to reproduce it, the requests and responses, and the recording, so a product team can check it on its own.

  • The full trace of what the agent did and which role it used
  • Findings it cannot reproduce never reach your list
Vulnerabilities / acme-billing.app

Guest can view another member's invoice

High8.1ExploitedNo login neededCross-account read
MOOpen Retest
OverviewTrafficScan traceFix

Impact

Any guest can open another member's invoice by changing its number. The page shows the member's name, amount and billing address.

CWE-639 · Seen 3 times, last 2 hours ago

How we reproduced it

PoC agent · Oct 20, 2026, 2:14 PM
acme-billing.app/invoices/INV-8812
Invoices
INV-8790Guest plan$120.00
You have 1 invoice.
Invoice INV-8812
Billed toMaya Ortiz (member)
Amount$12,480.00
Billing address41 Harbour St, Leeds
StatusPaid
This invoice belongs to a member. A guest should not see it.
▶0:140:16
0:00Looked at the sign-in page
0:03Typed guest@acme-corp.com
0:05Clicked Sign in
0:09Opened Invoices
0:12Changed the invoice number to INV-8812
0:14Saw Maya Ortiz's invoice, $12,480.00
03

Get clear guidance, then check the fix

Wakefield writes a patch with its confidence level and a plain explanation of the fix. Nothing reaches your repository until someone on your team opens the pull request. After you ship, retest that one finding to confirm it is closed.

  • Patch, diff and confidence on the finding page
  • Retest a single finding instead of a full rescan
Vulnerabilities / acme-billing.app

Guest can view another member's invoice

High8.1ExploitedNo login neededCross-account read
MOOpen Retest
OverviewTrafficScan traceFix

Impact

Any guest can open another member's invoice by changing its number. The page shows the member's name, amount and billing address.

CWE-639 · Seen 3 times, last 2 hours ago

How we reproduced it

PoC agent · Oct 20, 2026, 2:14 PM
acme-billing.app/invoices/INV-8812
Invoices
INV-8790Guest plan$120.00
You have 1 invoice.
Invoice INV-8812
Billed toMaya Ortiz (member)
Amount$12,480.00
Billing address41 Harbour St, Leeds
StatusPaid
This invoice belongs to a member. A guest should not see it.
▶0:140:16
0:00Looked at the sign-in page
0:03Typed guest@acme-corp.com
0:05Clicked Sign in
0:09Opened Invoices
0:12Changed the invoice number to INV-8812
0:14Saw Maya Ortiz's invoice, $12,480.00
04

Send the work where your teams already are

Findings and fixes go to Jira, Linear, GitHub, Slack, Microsoft Teams, PagerDuty or a webhook. Add Wakefield to Claude Code or any MCP client with one API key.

  • Jira issues for each finding your teams need to act on
  • One command to connect an MCP client

Integrations & MCP

AppsAPI and MCP
Source Control
GitHubConnect repositories for security analysis.
Connect
BitbucketConnect repositories for security analysis.
Connect
ForgejoConnect a self-hosted source code instance.
Connect
Integrations
SlackSend findings and fixes to a channel.
Connect
LinearCreate issues for new findings.
Connect
JiraCreate issues for new findings.
Connect
05

Ask what to do next

Ask which finding to fix first, start a scan, or check whether a fix worked, in plain language. From the console or your own MCP client.

  • Answers link to the findings and hosts they mention
Show me my open critical findings
Searched vulnerabilities · open, critical✓
Three are open. The worst is Member can export another tenant's customers on api.acme-billing.app. The PoC agent reproduced it twice.
Ask Wakefield
Default model ↑

Built to stay inside the lines you set.

Autonomous testing needs firm limits. These are the ones Wakefield works within on every scan.

Only approved targets

Agents test only the hosts and repositories you add, and you confirm you are allowed to test them.

One controlled path

All agent traffic goes through our egress proxy, with rate limits for each organization.

People decide what changes

Agents do not push code. A fix becomes a pull request only when someone on your team opens it.

Stop at any time

Stop any running scan from the console, at once or in bulk.

Every step on record

Each finding links to the agent's trace: the requests it sent, the role it signed in as, and the tools it ran.

Isolated and SOC 2 compliant

Agents run in sandboxes, and each customer's data is kept separate. Reports and policies are in our Trust Center.

Security documentation in the Trust Center ›
Blackbox

Test the running app as every user

A URL and a test login for each role. No code access needed.

How Blackbox works ›Whitebox

Review the code behind every request

Reviews the default branch and every pull request, with inline comments and patches.

How Whitebox works ›

Questions

Where are people in the loop?

Agents test and prove findings on their own, inside the scope you approve. People decide what changes: a fix becomes a pull request only when your team opens it, and anyone can stop a scan at any time.

How does Wakefield know what each role should see?

Agents sign in as each role you give them, map what each one can reach, and build a model of intended access from that. A finding is a place where a role reaches data or actions the model says it should not, and the replay shows it happening.

Do I need to give Wakefield my source code?

No. Blackbox needs only a URL and test logins. Connect a repository if you also want Whitebox review and patches.

What happens if a finding cannot be reproduced?

It does not reach you. Every finding is replayed by a separate agent before it shows in your list.

Does Wakefield merge fixes on its own?

No. It prepares a patch with a confidence level. A pull request opens only when you click to open it.

See it on your app.

Get startedBook a demo