Product

See what's exploitable — with proof

CarbonMantis runs real offensive tooling against your web apps and APIs and returns findings you can trust: each rated by evidence and reproducible in seconds. High signal, low noise, safe to run against production.

How it works

From target to proof in six steps

Register a target, prove it’s yours

Add the web app or API. Prove control via DNS, meta tag, or file — you can only scan what you own — and get a quick unauthenticated pass within minutes.

Add a role

Give it a credential for one user — a standard user first — and say what kind of account it is. The credential is sealed on entry and never shown again.

Bring your inventory

Upload your OpenAPI, or the endpoint list you’d hand a pentester. CarbonMantis proposes what’s in scope; you confirm it. Set the cap that controls cost.

Run the scan

Real tooling, rate-limited, safe to run against production, with live progress. Every confirmed operation is tested under every role you supplied.

Get proof — and the gaps

Findings rated by evidence, each reproducible in seconds. Plus the coverage block: what was tested, under which roles, and what was not.

Gate CI

Fail builds on severity + confidence; ship with confidence.

Signal, not alerts

Confidence is earned by evidence

The #1 reason teams abandon scanners is false positives. Every CarbonMantis finding is rated by the evidence behind it — and ships a synthesized, redacted reproduction, the minimum proof for its type, why it's exploitable, and how to validate the fix. Raw request/response bodies are never stored.

Confirmed

Exploitation safely demonstrated with verifiable proof — reflection, timing correlation, an out-of-band callback, behavioral proof, a deterministic misconfiguration, or, for authorization, one role reading what another role owns (shown with the marker redacted).

Probable

Strong indicators from multiple independent sources, but safe exploitation wasn’t fully demonstrated.

Possible

A single heuristic or behavioral anomaly worth a human look. Excluded from CI gates by default.

GET /api/users?search=Critical

# control (no payload)
curl -s -G https://api.example.com/api/users \
  --data-urlencode 'search=alice'
control:  0.08s

# injected 5s delay
curl -s -G https://api.example.com/api/users \
  --data-urlencode "search=alice' AND SLEEP(5)-- -"
payload:  5.09s

Confirmed via timing correlation · CWE-89 · OWASP A03:2021

Coverage

What CarbonMantis tests — and tells you it didn’t

Every report ends with a coverage and assurance block: which operations were tested, under which roles, with what outcome — and what was out of scope or not exercised. For a SOC 2 auditor that block is the artifact. Most pentest reports never include it.

Injection

SQLi, XSS, command injection, SSRF

Transport / TLS

Weak protocols, ciphers, certificates

Security headers

Missing or misconfigured CSP, HSTS

Information disclosure

Sensitive files, listings, verbose errors

Vulnerable components

Known-vulnerable services and exposure

Authorization, across roles

Broken object-level access (BOLA / IDOR): one user reaching another user’s data. Tested with real credentials for the roles you supply, on the operations you confirm.

API authorization

BOLA today; function-level checks (BFLA) on the same engine. Mass assignment and token handling are on the roadmap — and the coverage block says so when they were not tested.

Standards-mapped

OWASP Top 10, API Top 10, WSTG, CWE, CVSS

Authenticated testing

Two roles. One question: can this user reach that user’s data?

Unauthenticated scanners cannot find broken authorization, because the bug only appears when you hold two credentials and compare what each can reach. CarbonMantis holds them for you.

Credentials are write-only: sealed on entry, decrypted only in memory, shown afterwards only as a hint.
You confirm the inventory before anything is tested. Nothing is crawled blind with a credential.
Testing an operation under several roles costs nothing extra — you pay for surface tested, not requests sent.
REST APIs today; GraphQL and gRPC follow on the same scan-unit model.

CI-native

Gate your pipeline on proof

A first-class CLI, version-controlled config, and SARIF output for code scanning. Combine a severity threshold with a confidence floor so builds fail only on issues worth blocking a release for.

Deterministic exit codes for pass / fail / error
SARIF v2.1.0 → code-scanning alerts your team can triage
Findings mapped to OWASP, CWE, and CVSS

Prefer to delegate? Everything here is scriptable via CLI, config, and CI (alongside the web app) — so your AI coding assistant can register a target, run a scan, and act on the findings for you.

See CI/CD integration →

# fail only on Confirmed criticals
carbon scan gate \
  --fail-on critical \
  --min-confidence confirmed

→ Build failed · 1 confirmed critical

Honest scope

What we automate — and what we don't

CarbonMantis automates the vulnerability classes that are reliably machine-detectable with proof. It does not claim to replace expert-led testing for business-logic abuse, multi-step exploit chains, novel techniques, or social engineering. It's a continuous, high-cadence complement to human depth — and we say so plainly, because overclaiming is how scanners lose your trust.