Private beta, applications open

Pentest and fix in 24 hours.

Whitebox Autonomous Pentesting now delivers the fix. Every confirmed finding arrives as a pull request on your GitHub repository: the code change and a regression test, ready for your review.

Apply for the private beta How it works
Fix as a pull request on your repo Regression test included Zero false positives Works with GitHub
What arrives

A finding used to be a ticket. Now it is a pull request.

The report tells you what is exploitable. The pull request shows you the fix, with a test that guards it. Your team reviews and merges in the flow it already uses.

squr-dev opened a pull request into main from squr/fix/a3f9Draft
Fix IDOR on GET /api/invoices/{id}: enforce invoice ownership before returning the record
CriticalCWE-639Proof-of-exploit in the SQUR reportRegression test included
src/invoices/views.py+6 −1
tests/test_invoice_ownership.py+38
CompilesStatic analysisRegression testSecond-model review
Opened as a draft. SQUR never merges. Your reviewers decide.

Illustrative pull request. The real one carries your repository, your file paths and the finding from your report.

How it works

Find. Prove. Fix. Re-test.

One loop, every pentest. Connect the repository once; the rest runs as part of the whitebox pentest.

01

Find

SQUR reads your source code and tests your running application. A full whitebox pentest, results in 24 hours.

02

Prove

Every confirmed finding is exploited against the live application before it is reported. Zero false positives, nothing to argue about.

03

Fix

Starting with the highest severity, SQUR writes the fix and a regression test, re-runs its own checks, and opens a pull request on your repository.

04

Re-test

The next pentest re-tests every open finding and marks it Fixed, Regressed or New. A clean run refreshes your certificate.

  1. Connect your repository. Install the SQUR GitHub App on the repositories you want covered. It opens pull requests; nothing else.
  2. Run the whitebox pentest. As today: target, roles, scope. Results in 24 hours, every confirmed finding with proof-of-exploit.
  3. Review the pull requests. Each confirmed finding arrives as a draft pull request with the fix and a regression test. Merge, change, or close, as with any PR.
Built for review

Your repository stays yours

Autonomous Remediation was designed around one rule: a machine proposes, your team decides.

Draft pull requests only

SQUR never merges. Every fix opens as a draft, in your normal review flow, with your branch protection untouched.

Application code only

A fix changes application code and adds a test. Workflows, CI configuration and dependency manifests are off limits by construction.

Sealed and erasable

Each fix runs in an isolated, egress-locked environment. Disconnect the repository and SQUR erases its source snapshot, closes its pull requests and deletes its branches.

Secrets stay out

Pull request descriptions are built from the finding, never from raw evidence, and scrubbed for secrets before they are written.

Checked before it reaches you

The fix compiles, passes static analysis and ships with its regression test. A second model reviews it before the pull request opens.

EU data residency

All data stays in the EU (GCP Brussels), including the source snapshot used for the pentest and the fix.

The beta

Who we are onboarding first

Teams that ship web and API software continuously, on GitHub. The more services you run and the more often you deploy, the more the loop returns: every release gets a pentest, every confirmed finding gets a pull request.

Your code is on GitHub

The SQUR GitHub App opens the pull requests. Private and public repositories, any organisation size.

You ship continuously

A web application or API in active development. Weekly deploys or faster get the most out of monthly pentests with fixes attached.

A 30-minute setup call

You book it right after applying. We connect the repository together and agree the scope of the first whitebox pentest.

A feedback session

After your first pentest, one conversation about the pull requests you received. It shapes what we build next.

Beta members pay the standard pentest price: €1,995 per pentest, or Professional at €995 per app per month. Autonomous Remediation is included during the beta. All prices exclude VAT.

Apply

Apply for the private beta

Apply in two minutes, then book your setup call straight away. We read every application personally. Places in the first cohort are limited.

Your application goes directly to the SQUR founding team. No newsletter, no automated sequence. Privacy.

FAQ

Common questions

Does SQUR merge anything?

No. Every fix opens as a draft pull request. Your team reviews, changes if needed, and merges. Your branch protection applies as always.

What does the GitHub App get access to?

The repositories you select, with the permissions needed to open a pull request. Uninstall it and SQUR closes its pull requests, deletes its branches and erases the source snapshot.

Is this part of the whitebox pentest?

Yes. Autonomous Remediation works from the source code the whitebox pentest already uses. A black-box pentest continues to deliver remediation guidance per finding.

What does the beta cost?

The standard pentest price, €1,995 per pentest or Professional at €995 per app per month, with Autonomous Remediation included for the duration of the beta.

Which platforms are supported?

GitHub today, through the SQUR GitHub App. Tell us in the application if your code lives elsewhere.

Where does my source code go?

Into a sealed, egress-locked environment in the EU (GCP Brussels), used for the pentest and the fix, and erased when you disconnect.

Pentest and fix in 24 hours

Join the private beta and get the fix with the finding.

Apply for the private beta About whitebox pentesting