Detectify
Go hack yourself!
Start new thread
Carl-Fredrik Wållgren

Detectify - Application security testing reimagined

by•
Most API scanners are noisy, repackaged engines. We built a proprietary, research-led scanner that finds real exploits, not a backlog of false positives. Get actionable findings you can actually trust.

Add a comment

Replies

Best
Carl-Fredrik Wållgren
Hunter
📌
Most API security tools are noisy, repackaged open-source engines that flood your backlog. We took a different approach. We built our own proprietary engine from the ground up to focus on what matters: exploitability and transparency. We deliver high-accuracy, actionable findings by actually trying to exploit the vulnerability rather than just flagging a potential issue. We also give you the proof on how we found the finding. Reproducible Results: Even with randomization, every finding is verifiable. We use a "seed" to precisely reproduce the exact payload that found a vulnerability. Continuous Discovery: Because every scan is unique, you’re always probing for new weaknesses, not just re-running old checks.
Pixel Echo

I absolutely love the ‘go hack yourself’ tagline — it really sets the mood 🔒.

Urban Sage

I really appreciate that this goes beyond just pointing out issues and actually attempts to exploit them.

Velvet Trace

The proof of findings is a game changer — too many tools leave you wondering if it’s a false positive.

Crimson Orbit

The reproducibility with seeds seems incredibly useful for development teams.

Ava Morgan

I’m curious — how long does a typical scan take for a medium-sized application?

Carl-Fredrik Wållgren
Hunter

@ava_morgan3 Thank you for the question. The runtime of a 'typical' scan depends on a lot of factors, and therefore can be anywhere from 15 minutes up to 48 hours. Factors include things like the size and responsiveness of the application, rate limiting, technologies found, etc.

Noah Carter

This feels like the next step in vulnerability scanners — results that you can actually act on.

Miss Byte

Continuous discovery is essential — most tools just keep repeating the same surface-level checks.

Linta Harisa

Great positioning against the noise of API security — development teams don’t need more false alerts.

Carina Tasha

I’d be interested to know if you provide remediation tips along with proof.

Carl-Fredrik Wållgren
Hunter

@carina_tasha I replied to a similar question so apologies for repeating myself here. Digging into a finding, you get:

  • Request & response with the HTTP request we sent out, and the HTTP response we received from the web application.

  • Details providing additional information, such as what we are basing the finding on. Depending on the finding type, you might see a code snippet, screenshots, or other information.

  • References to online resources from Detectify and other sources that help you to understand and resolve the issue.

12
Next
Last