Scope
Define exactly what's in.
Domains, IPs, paths, wildcards. Excludes enforced before any request lands. The same scope model your bug-bounty programme uses.
include: *.acme.app · exclude: */admin/**
Product
Replace your annual pentest. Get an agent that doesn't skip.
Continuous offensive testing tuned on live bug-bounty programs. Every endpoint, every parameter, every API key in your repo. Every finding ships with a runnable PoC — so your team triages real exploits, not a 30-page report full of theory.
target
acme.app
engagement
2h 13m
Agent fleet
147 active·38 done·12 queued
target-research
1×
org-recon
38×
asset-recon
84×
authentication
12×
exploit
8×
poc-builder
4×
Findings delivered
3 · all reproduced
critical
Cross-tenant order leak via /orders/:id
SH-241·reproduced 2m ago
high
Account takeover via reset oracle
SH-238·reproduced 8m ago
high
3-hop IAM chain reaches billing-svc
SH-235·reproduced 21m ago
The current state
The pentest is broken.
An annual pentest is how security used to look. Two senior engineers, five days, a sampling of your endpoints. Three months later you get a PDF. Half the findings are theory. The rest are missing the context you needed yesterday. Meanwhile your stack drifted seven times since the kickoff call.
Capability
Pentest
annual engagement
Scanner
Burp · Nessus
Superhack
this thing
Continuous coverage
Once a year
Always-on
Continuous + on-demand
Full-scope, agent-deep
A sample of your stack
Surface only
Every endpoint, every path
Real exploitation
Bounded by human time
Pattern matching
End-to-end chains
Runnable proof of exploit
“Likely exploitable”
CVE / signature match
curl + Playwright pack
Zero false positives
Low (manual review)
High noise
Replayed before delivery
Same-day results
3+ months
Real-time, noisy
First critical inside hours
No per-engagement billing
$50–100k per engagement
Flat annual subscription
Free during early access
Proof, not theory
Every finding ships with a runnable PoC.
Curl command. Playwright script. Step-by-step HTTP replay. Whatever shape your team prefers, Superhack delivers it.
Click Run again — the PoC re-executes against your stack and tells you whether the bug is still live. No “likely exploitable.” No “requires manual verification.” Just exploits we can prove.
superhack.io / findings / SH-241 / replay
live
Replay PoC
SH-241 · cross-tenant order leak
curlPlaywrightHTTP~3s · zero setup
✓Spin up isolated session
✓Authenticate as tenant A
✓GET /api/orders/8124 as tenant B
✓Diff response against oracle
Confirm cross-tenant leak
VerdictStill vulnerable · reproduced 2s ago
You're in control
Authorisation isn't a checkbox. It's a config.
Bug-bounty programmes taught us that offensive testing only works when scope, rate limits and agent behaviour are all granular. So they are here. Every knob a programme manager would expect — exposed, configurable, enforced before any request lands.
Rate limits
We respect your infra's pain threshold.
Cap requests per second, per hour, per endpoint. Set quiet hours. Agents back off on 429s and don't retry until allowed.
5 rps · 1,000/hr · quiet 09:00–18:00 UTC
Optional depth
Connect code and infra — or don't.
Hand us read-only repo access for taint analysis. Connect cloud accounts for IAM-aware testing. Or run black-box against just the public surface. Every layer is opt-in.
github.com/acme/api · aws-account-prod
Agent directives
Plain-English rules. Agents follow them.
Tell the agent what bounty-programme rules look like in your stack. It picks them up and enforces them across the engagement.
“skip /payment/* · prefer business-hours · use header X-test-run”
Tenant isolation
Your findings, your data, your tenant.
Engagement data, evidence, scope rules — all isolated. We don't train models on your data, and findings never cross tenants.
Full audit trail
Every request the agent made, queryable.
Method, URL, headers, body, timing, response code. Stream it to your SIEM if you want. Nothing happens in your stack that you can't replay later.
Battle-tested
The same rules we ran on live bug-bounty programmes.
Before we sold a single engagement, we trained Superhack on dozens of real European bug-bounty programmes — strict scopes, rate limits, prohibited paths, custom test headers. The agent learned the boundaries the way a serious hunter does. The same enforcement runs against your stack.
Always on
Continuous, not point-in-time.
Your attack surface drifts every day — new endpoints, new repos, new cloud roles. Superhack drifts with it. Findings are re-verified automatically before they reach you, and again after you fix them.
Coverage rhythm
annual vs continuous
annual
Pentest
One engagement. Then your stack drifts for the rest of the year.
continuous
Superhack
Hourly drift, daily sweep, weekly deep. Re-verified after every fix.
Outer · hourly
drift detection on every new asset
Middle · daily
full inventory diff + dispatch
Inner · weekly
every authn flow, every IAM chain
Talk to us
Want to see what
Superhack finds on your stack?
Early engagements are free. We point the agent at the surface you choose and walk you through every finding on a call.