rorixrorix
dashboard →
// PRODUCT · PENTESTING

Continuous security testing for apps and APIs.

Verify a domain you own, run safely bounded checks against its public application surface, and review structured evidence without mixing Pentesting into the Supply Chain workflow.

Run a pentest →Sample pentest report
// WORKFLOW

Scoped, verified, and measurable

Every report shows the verified scope, attempted engines, completed coverage, observed evidence, and incomplete checks.

01

Verify ownership

Add a DNS TXT record. Rorix blocks scans until you prove control of the target domain.

DNS TXT challenge
02

Configure coverage

Choose the public app URL and optionally provide an OpenAPI document hosted inside the verified scope.

HTTPS · optional OpenAPI
03

Run safe checks

Execute the reviewed HTTP-header baseline and analyze the API document with bounded concurrency and response limits.

safe profile
04

Review evidence

See which engines completed, what they observed, and the remediation supplied by each detector.

coverage · evidence · export
// CURRENT COVERAGE

A focused safe baseline.

Rorix currently ships a reviewed HTTP-hardening baseline and optional OpenAPI document analysis. Broader active endpoint testing will be added only with measured coverage and reproducible evidence.

HTTP hardeningCurated baseline
  • Content-Security-Policy presence
  • Strict-Transport-Security presence
  • X-Content-Type-Options presence
  • Rule-specific remediation
  • Pinned bundled templates
OpenAPI analysisOptional
  • Document accessibility
  • Declared security schemes
  • Inline or in-scope document
  • Spec source in coverage report
  • Explicit engine failure state
Execution safeguardsSafe mode
  • Verified-domain scoping
  • Public HTTP(S) destinations only
  • Private and reserved networks blocked
  • Redirect destination validation
  • Rate and response-size budgets
// FINDING EXAMPLE

Evidence you can verify.

This example reflects a check in the bundled safe baseline and does not imply exploitation.

MEDIUMStrict Transport Security header is missingheader-check · rorix-missing-hsts
REPRODUCTION
$ curl -sS -D - -o /dev/null \
    https://app.example.com
HTTP/2 200
content-type: text/html
x-content-type-options: nosniff
# Strict-Transport-Security: missing
REMEDIATION
  1. Confirm the application and every subdomain are served exclusively over HTTPS.
  2. Add a Strict-Transport-Security response header with an appropriate max-age.
  3. Roll out includeSubDomains only after validating coverage.
  4. Add regression test: assert_hsts_header