Authenticated, across roles
Give it a credential per role. It tests every confirmed operation under each one and proves the cross-role reads it finds — the bug class unauthenticated scanners cannot see.
Coming SoonRequest Early Access
Automated penetration testing, with real credentials
CarbonMantis runs real offensive tooling against your web apps and APIs — including the test no unauthenticated scanner can run: can one of your users reach another user’s data? Every finding ships reproducible evidence, and every report says what was not tested.
Join the early-access list · we’ll email your invite when we launch
# control (no payload) curl -s -G https://api.example.com/api/users \ --data-urlencode 'search=alice' control: 0.08s # injected 5s delay curl -s -G https://api.example.com/api/users \ --data-urlencode "search=alice' AND SLEEP(5)-- -" payload: 5.09s
Why CarbonMantis
Give it a credential per role. It tests every confirmed operation under each one and proves the cross-role reads it finds — the bug class unauthenticated scanners cannot see.
Every finding is rated by the evidence behind it — Confirmed, Probable, Possible — and ships a reproducible proof, not a guess.
Mandatory ownership verification, non-destructive payloads, per-target rate limiting, and automatic abort if a target degrades.
Per-tenant envelope encryption, row-level isolation, an isolated execution plane, and an SSRF-hardened control plane.
A first-class CLI, version-controlled config, SARIF output, and deterministic gates on severity and confidence.
New-CVE detections within hours through a controlled pipeline — without giving scan workers internet access.
We automate what is reliably machine-detectable with proof — and every report carries a coverage block naming what was not tested, so nobody mistakes silence for safety.
Every scan is sealed as a cryptographically signed, tamper-evident record — independently verifiable offline against a key we can't swap. Even we can't rewrite or backdate it.
Why we built it
CarbonMantis started inside a SOC 2 Type II company paying for an annual penetration test whose deliverable looked automated — and hand-assembling the endpoint list to give the tester, because there was no OpenAPI to hand over. We built the tool that runs that test continuously, against the inventory you actually have, and returns the one thing an auditor wants and rarely gets: a record of what was tested, under which roles, and what was not.
How it works →In your pipeline
An automated security gate is table stakes for serious software. CarbonMantis drops into your pipeline with the carbon CLI — one static binary, any runner — and fails the build on real, confirmed issues before they ship. Native wrappers for the platforms below follow the CLI.
# fail the build on confirmed criticals
carbon scan gate \
--fail-on critical \
--min-confidence confirmedNew to security testing?
Public, cloud-hosted apps get probed by attackers within hours of going live — and AI-generated code often ships with common, exploitable gaps. You don't need to be a security expert to stay ahead: CarbonMantis is self-serve, safe by default, and your AI assistant can even run it for you.
How CarbonMantis helps →Held to our own standard
Every credential gets its own key, wrapped by a per-tenant key in a cloud KMS. One compromise never crosses tenants.
Scan workers run with locked-down egress and cannot reach internal networks or cloud metadata — even while attacking the internet.
Connect-time IP enforcement that resists DNS rebinding and fails closed. The bug class we report to you, engineered out of our own stack.
Raw request/response bodies are never stored; evidence is synthesized and redacted server-side before anything is persisted.
Don't trust us — verify
Every scan is sealed as a cryptographically signed, tamper-evident record of exactly what ran — anchored to write-once storage and independently verifiable offline, against a key we can't swap. Even we can't rewrite or backdate it. Findings you can reproduce. Evidence you can verify. A record no one can rewrite.
How verification works →Pricing
$1 per scan unit — that's it. No tiers, no feature gating, no "enterprise" markup. Everyone pays the same low, usage-based price and gets every capability. You pay for exactly what you scan: no more, no less.
Go deeper
The full engineering story — confidence-rated findings, platform security, architecture, detection freshness, and where automation ends and expert humans begin.
Read the whitepaper (PDF)Get evidence-backed findings your team will actually act on.
Request Early AccessBe first in line when we launch · we’ll email your invite