The Odin Platform

One platform for continuous offensive security.

Run PR reviews, whitebox pentests, and manage validated vulnerabilities from one place.

Get Started

PR Security Reviews

Catch vulnerabilities before they ship.

Review security-sensitive changes before production.

Pull Request

9ef9a07ce0ee....

#291

OPEN

Add /v1/exports endpoint

hans-dev

25.05.2026

PR Review

ANALYSING DIFF IN CONTEXT

Auth flow

Data handling

Authorisation

warning

Config

0 seconds · 0 files

PR feedback

PR Reviews

Priority:

Critical

build · test · lint

PR review · failing

warning

Merge blocked

More than pattern matching
Understand how changes affect auth, APIs, permissions, and data.
Where developers work
Findings appear directly in the pull request.
Central visibility
Security teams see findings across repositories.

InGitHub

Inline findings
PR security summary
Check status
Optional merge blocking

InOdin

Review history
Findings by severity
Repository visibility
Organisation overview

Whitebox Pentest

Deep testing for live applications.

Test applications and APIs with source context.

whitebox pentest — source analysis

// routes/api/users.ts
router.get('/api/users/:id', auth, async(req, res) => {
  const user = await User.findById(req.params.id);
  // Missing ownership check — IDOR
  res.json(user);
});
 
// routes/api/admin.ts
router.post('/api/admin/roles', async(req, res) => {
  // No auth middleware — priv escalation
  await Role.update(req.body);
});

Analysing847 routes analysed · 12 test cases generated

Vulnerability Coverage

Built for the vulnerabilities scanners miss

Focused on vulnerabilities that require real application context.

Authentication
Login bypasses, session weaknesses, and token issues.
- [Session fixation]
- [Token leakage]
- [Password reset]
Authorization
IDORs, privilege escalation, and broken access control.
- [IDOR]
- [Privilege escalation]
- [Broken access control]
Injection
Server-side injection across application inputs.
- [SQLi]
- [Command injection]
- [SSTI]
Data Exposure
Sensitive data leakage and overly permissive APIs.
- [PII leaks]
- [Redaction]
- [API over-fetch]
SSRF
Requests reaching internal or cloud infrastructure.
- [SSRF]
- [Cloud metadata]
- [Internal services]
Cross-Site Scripting
Reflected, stored, and DOM-based XSS.
- [Reflected XSS]
- [Stored XSS]
- [DOM XSS]
Business Logic
Workflow abuse, race conditions, and logic flaws.
- [Race conditions]
- [Workflow bypass]
- [Logic flaws]
Configuration
Exposed secrets, debug endpoints, and insecure configuration.
- [Exposed secrets]
- [Misconfiguration]
- [Debug endpoints]

Continuous Coverage

Before production. After production.

Review changes before merge. Test the full application after.

Whitebox Pentest

PR Reviews

Coverage

Whitebox pentesting

PR security review

When

On demand

Before merge

Scope

Full application

Code change

Focus

Application-wide risk

Risk introduced by the change

Output

Validated vulnerabilities

Inline findings

Outcome

Find what made it through

Stop it before production

Vulnerability Management

From finding to verified fix

Keep remediation and retesting in one place.

Complete Context
1/4
Evidence, reproduction steps, severity, and remediation.
Finding Lifecycle
2/4
Reported → Mitigating → Retest → Fixed
Triage at Scale
3/4
Prioritise findings across applications and teams.
Flexible Export
4/4
Export findings for teams and stakeholders.

Findings[4 open]

All
Critical
High
Medium

IDOR in user profile update allows cross-account access/api/users/:id — app.borghq.io
Critical
Missing auth middleware on admin role management/api/admin/roles — app.borghq.io
Critical
Session token exposed in URL query parameters/auth/callback — app.borghq.io
High
Verbose error messages expose internal stack trace/api/v2/orders — app.borghq.io
Medium
SQL injection via unsanitised search parameter/api/search?q= — app.borghq.io
High