Book a demoGet started
Platform

Review the code behind every request

Whitebox agents read your source on the default branch and on every pull request, trace risky paths, comment inline, and offer a patch.

Vulnerabilities / acme-billing.app

Guest can view another member's invoice

High8.1ExploitedNo login neededCross-account read
MOOpen Retest
OverviewTrafficScan traceFix

Impact

Any guest can open another member's invoice by changing its number. The page shows the member's name, amount and billing address.

CWE-639 · Seen 3 times, last 2 hours ago

How we reproduced it

PoC agent · Oct 20, 2026, 2:14 PM
acme-billing.app/invoices/INV-8812
Invoices
INV-8790Guest plan$120.00
You have 1 invoice.
Invoice INV-8812
Billed toMaya Ortiz (member)
Amount$12,480.00
Billing address41 Harbour St, Leeds
StatusPaid
This invoice belongs to a member. A guest should not see it.
▶0:140:16
0:00Looked at the sign-in page
0:03Typed guest@acme-corp.com
0:05Clicked Sign in
0:09Opened Invoices
0:12Changed the invoice number to INV-8812
0:14Saw Maya Ortiz's invoice, $12,480.00

A Whitebox review on a pull request. Agents trace a path from a route to the data it returns, and the fix appears as a diff.

How it works

  1. 1

    Connect a repository

    Install the GitHub app, or connect Bitbucket or Forgejo, and pick the repositories to review.

  2. 2

    Trace risky paths

    Agents follow requests from routes to data, looking for missing ownership and role checks.

  3. 3

    Prove it

    Findings are shown once the verifier has reproduced them.

  4. 4

    Comment and patch

    Findings land as inline review comments. The patch comes with a confidence level, and one click opens a pull request.

What it finds

Code findings, checked

A finding from code is only a claim until it is reproduced. Each one shows the verifier's checks, the evidence, and what it could not establish.

Questions

Which code hosts are supported?

GitHub, Bitbucket and Forgejo.

Does it review every pull request?

Yes, if you turn on pull request reviews for the repository. It reviews new and updated pull requests and posts inline comments.

Can it scan the whole branch?

Yes. You can scan a diff or the entire default branch.

Does Wakefield push to my main branch?

No. Fixes go on their own branch, and a pull request opens only when you click to open it.

See it on your app.

Get startedBook a demo