Authorized AI pentesting
Pentest your own app.
Find weaknesses in the websites, APIs, and applications you own. Use Strix with Abliteration to test your app, investigate the findings, and check that your fixes work.
Concerned by a breach? Check what applies to your app.
A breach report can tell you what to investigate. It cannot tell you whether your own application is affected. Review the software you run, the accounts and data you expose, and the changes you have shipped. Turn that context into a focused test.
Penetration testing investigates whether a weakness can be used in your application. Use it alongside code review, dependency checks, and monitoring, then fix and retest the issues you confirm.
OWASP Web Security Testing GuideTest the boundaries that protect your users.
Can one user access another user's data?
Test account and organization boundaries with separate test users. Check whether your API enforces access on each request, including direct links to records and files.
Can a normal account perform admin actions?
Check roles, permissions, and server-side checks. Hiding a button in the interface does not establish that the underlying operation is protected.
Are sensitive files and settings exposed?
Review what your app makes public: configuration, debug routes, exports, and uploaded files. Use test data to investigate exposure without collecting customer information.
Do important flows hold up to unexpected input?
Examine sign-in, password reset, uploads, and other critical workflows. Look at the behavior of the running application alongside its source code.
Get started
Run Strix with Abliteration.
Strix is an open-source AI pentesting tool. It runs testing tools and investigates your application; Abliteration supplies the model through its OpenAI-compatible API.
Explore the Strix projectOur integration guide covers Docker, installing Strix, setting the API key and base URL, choosing a model, and starting a bounded test. Follow it for current setup and compatibility details.
Pick a local project or staging app you own, give the agent a clear scope, and review its actions. Start from a clean checkout: Strix can edit files in a local project. Keep findings with their evidence so you can decide what to fix.
Open the Strix guideAll integrations in our docsFrom the first test to a verified fix.
Define what you are testing
Define the apps, repositories, domains, accounts, and actions included in the test. Use systems you own or have explicit permission to assess, and exclude third-party services outside that permission.
Prepare a controlled environment
Start in a local or staging environment with representative test data and accounts for the roles you need to check. Agree on limits and stop conditions before testing a live service.
Connect your testing tools
Follow the Strix integration guide to configure Abliteration, then give the testing agent your target, scope, and focus areas. Begin with a bounded run and review what the agent does.
Verify the findings
Review each finding's affected route or function, reproduction steps, observed result, and impact. Confirm the issue in your test environment before treating it as a verified vulnerability.
Fix and retest
Fix confirmed issues, rerun the relevant checks, and add regression coverage. Repeat testing after meaningful changes to authentication, permissions, APIs, and other exposed functionality.
Keep legitimate security work moving.
If your current model refuses an authorized test, evaluate Abliteration’s reduced-refusal models on that workflow. The latest models and Policy Gateway are included with every plan, including pay as you go.
Policy Gateway applies your rules to model requests and responses. Configure the testing tool’s permissions and target restrictions separately.
Pentesting your own app: common questions.
Can I pentest my own website or app with AI?
Yes. AI-assisted pentesting can help you investigate weaknesses in applications you own or are explicitly authorized to test. Define the scope, use appropriate test accounts and data, and review the agent's actions and findings. Ownership of your app does not extend permission to unrelated third-party services.
How do I use Strix with Abliteration?
Follow the Strix guide in our docs' Integrations section. It covers installation, the Abliteration API key and base URL, model selection, and an initial bounded test. Strix runs the testing tools; Abliteration supplies the model API.
Should I test a production website?
Start locally or in staging when possible. Active tests can change data or disrupt a service. Production testing needs an agreed scope, suitable accounts, monitoring, limits, and a way to stop the run. Check the testing tool's behavior before giving it access.
Does a clean AI pentest mean my app is secure?
No. A test covers the paths, context, and time available to it. Review findings, retest fixes, and combine pentesting with code review, dependency checks, secure configuration, monitoring, and specialist assessment when needed.
Can I test an app built with an AI coding tool?
Yes. Whether a person or a coding agent wrote it, check the running application's authentication, access controls, exposed data, and critical workflows. Working features and successful build checks do not by themselves demonstrate that those security boundaries hold.
What if my model refuses legitimate security testing?
Evaluate Abliteration's reduced-refusal models on your authorized workflow. Our API works with supported OpenAI- and Anthropic-compatible clients. Policy Gateway is included with all plans, including pay as you go, for your rules on model requests and responses. Configure testing-tool permissions and target restrictions separately.