Zolt agents get your source code and a running target. They map the surface, trace every input to where it lands, and probe what looks real. A Zolt researcher reproduces every finding before it reaches your report. Priced in credits, quoted before we start. Retest included.
anything in scope · quoted in credits before kickoff · report + retest
acme · web app + API · in reviewReport view
14 candidates from agents · 6 shown · 4 verified · 2 dropped4 findings in the report · every one reproduced by a researcher
Critical · Cross-tenant report export via /v2/reports/:idchained with #3 into account takeoververified by a researcher
High · JWT accepted with alg=none on the mobile APIreproduced on stagingverified by a researcher
High · Password reset token reusable for 24hpart of chain #1verified by a researcher
Medium · Verbose stack trace on /internal/healthinternal only, not reachable from the internetdropped in review
Medium · Rate limit missing on /login200 attempts/min confirmedverified by a researcher
Low · Directory listing on /static/legacyno sensitive files presentdropped in review
01 / how an engagement runs
One target, nothing you did not name
Click a step to see what it looks like on a real engagement.
Scopeacme
In scopeapp.acme.com · api.acme.com · the iOS backend · the AWS account that runs themOut of scopenothing you have not namedPrioritytenant isolation, billing, anything touching customer dataDatesSet by the scope, agreed with the quote · kickoff Monday
Accessacme
Repositoriesacme/web · acme/api · acme/infra · read-only deploy keyEnvironmentstaging.acme.com · seeded with two tenants and a free-tier accountCredentialsone user per role · rotated after the engagementNeverproduction data, production credentials, anything you did not hand over
Agents workacme
›mapped 412 routes, 3 auth flows, 2 file uploads across acme/web and acme/api
›traced req.id from GET /v2/reports/:id to reports.find() · no tenant filter
›probed staging with a tenant-b account · 3 of 3 tenant-a reports returned
Critical · Cross-tenant report export via /v2/reports/:idchained with #3 into account takeoververified by a researcher
High · JWT accepted with alg=none on the mobile APIreproduced on stagingverified by a researcher
High · Password reset token reusable for 24hpart of chain #1verified by a researcher
Medium · Verbose stack trace on /internal/healthinternal only, not reachable from the internetdropped in review
Findings #1 and #3 were chained: a reset token reused against a cross-tenant lookup gives full account takeover. That chain, not the two rows, is what leads the report.
Retest · includedFix on your schedule. We re-run every finding and update the report to closed.
02 / why whitebox
We read the code. Guessing is what the other kind does.
Whitebox, with Zolt
Agents read the source and hit the running target, so the question is never "is there an endpoint here" but "does this input reach that query".
■Every route, not the ones a crawler happens to find
■Source-to-sink traces, then confirmed against the environment
■Auth and tenancy logic read directly, not inferred
■A researcher reproduces each finding before you see it
A blackbox test
Guesses at the application from the outside. Good testers guess well; the coverage still depends on what they stumble into in the time they have.
□Finds what is visible in the time available
□Cannot see the code path behind a response
□Auth logic inferred from behaviour
□Findings limited by the tester's hours, not the app's surface
03 / credits and scope
Quoted in credits. Decided before we start.
CreditsQuoted per engagementEvery scope is quoted in credits before kickoff and the quote does not move. Buy credits once, spend them across engagements as you need them.
IncludedReport + retestThe full report, a findings export for your tracker, and a retest of every finding once you have fixed it.
ScopeAnything you nameWeb, APIs, mobile backends, cloud accounts, internal tools. If it runs code you own, it can be in scope.
Questions
Before you hand over a repo
Do you test against production?+
Only if you ask us to and only for the parts you name. The default is an environment you give us, seeded with test data, with credentials that are rotated afterwards.
What does "human in the loop" mean here?+
Agents do the mapping, tracing and probing. A Zolt researcher reviews every candidate finding, reproduces it, drops what does not hold, chains what does, and writes the report. Nothing reaches you that a person has not confirmed.
How long does an engagement take?+
It depends on the scope. When we quote the credits we also quote the timeline, and both are fixed before we start.
What access do you need?+
Read-only access to the repositories in scope and a way to reach the environment. Nothing is written back to your repositories.
Name the target
Tell us what is in scope and we come back with a credit quote and a start date.