Test the running app as every user
Blackbox agents sign in as admin, member and guest, learn who should see what, then try to cross those lines. No code access needed.
Scans
Blackbox scans test running apps. Whitebox scans read your code.
A Blackbox scan in progress. Agents work through the app in parallel, and each finding shows how it was reproduced.
How it works
- 1
Add a host and test logins
Give it a URL and a test account for each role. It can create inboxes for sign-up flows.
- 2
Map the app
Agents crawl pages and APIs as each user and capture the traffic, including GraphQL and OpenAPI specs.
- 3
Model intended access
From that traffic, Wakefield builds a model of who should reach which data and actions.
- 4
Try to break it
Agents swap IDs, replay requests across roles and tenants, and race workflows. The verifier replays anything they find.
Every finding, replayed
The verifier repeats each exploit against your app with a negative control, and keeps the requests, responses and a browser recording. You can rerun it yourself with the reproduction script.
Questions
Do you need my source code?
No. Blackbox works from the outside with test logins. Add a repository later for Whitebox and patches.
Which accounts should I provide?
One test account per role you want tested, such as admin, member and guest. Two accounts in different tenants help test tenant isolation.
Will it slow down my app?
Traffic goes through our egress proxy with per-organization rate limits. Only add hosts you are allowed to test.
How often does it run?
As often as you choose: on a schedule, when a new host is added, or from a webhook in your deploy pipeline.